文件列表:

LICENSE (1072, 2020-08-21)
exploit.rb (2858, 2020-08-21)

# Bludit Auth BF mitigation bypass exploit / PoC > Bludit <= 3.9.2 - Authentication Bruteforce Mitigation Bypass Exploit / PoC for [CVE-2019-17240](https://nvd.nist.gov/vuln/detail/CVE-2019-17240). [[EDB-48746](https://www.exploit-db.com/exploits/48746)] [[PacketStorm](https://packetstormsecurity.com/files/158875/Bludit-3.9.2-Authentication-Bruteforce-Mitigation-Bypass.html)] [[WLB-2020080094](https://cxsecurity.com/issue/WLB-2020080094)] ## Usage ``` $ ruby exploit.rb --help Bludit <= 3.9.2 - Authentication Bruteforce Mitigation Bypass Usage: exploit.rb -r -u -w [--debug] exploit.rb -H | --help Options: -r , --root-url Root URL (base path) including HTTP scheme, port and root folder -u , --user Username of the admin -w , --wordlist Path to the wordlist file --debug Display arguments -H, --help Show this screen Examples: exploit.rb -r http://example.org -u admin -w myWordlist.txt exploit.rb -r https://example.org:8443/bludit -u john -w /usr/share/wordlists/password/rockyou.txt ``` ## Requirements - [httpclient](https://github.com/nahi/httpclient) - [docopt.rb](https://github.com/docopt/docopt.rb) Example for BlackArch: ``` pacman -S ruby-httpclient ruby-docopt ``` Example using gem: ``` gem install httpclient docopt ``` ## Reference This is an exploit for the vulnerability found by [Rastating](https://rastating.github.io/) on [Bludit CMS](https://www.bludit.com/). Vulnerability explanation: https://rastating.github.io/bludit-brute-force-mitigation-bypass/. Patch: https://github.com/bludit/bludit/pull/1090 This exploit was tested with Ruby 2.7.1.

近期下载者：

相关文件：

评论：[我要评论] [举报此文件]

收藏者：