Zoho ManageEngine SAML XML Signature Validation RCE

Repository is very small and consists of a README plus a single Python entry point, main.py. The code is an exploit script for CVE-2022-47966 affecting ManageEngine products. Although the README says the repo is part of the 'hgrab-framework', this repository itself is just a standalone Python exploit script rather than a full framework module set. Main capability: the script performs unauthenticated remote command execution attempts against supplied target URLs. For each host read from an operator-provided file, it spawns a thread and sends an HTTP POST to /SamlResponseServlet with a base64-encoded SAMLResponse parameter. The embedded XML contains an XSLT transform using Xalan Java extension namespaces to call java.lang.Runtime.getRuntime().exec() with the operator-supplied command. This is the core exploitation primitive. Targeting and behavior: targets are expected in the format <http-https>://<target>:<port>/<optional-uri>, then the script appends /SamlResponseServlet. TLS certificate validation is disabled. The script does not capture command output or establish a shell; instead it infers likely vulnerability from response behavior. A 404 response or the string 'FATAL: You are not authorized to use this service' is treated as not vulnerable, while 'Unknown error occurred while processing your request' is treated as an indicator that the target appears vulnerable. Repository structure: README.md provides minimal usage instructions. main.py contains helper functions for timestamp formatting and random string generation, an Exploit class with the HTTP POST logic, and a main() function that parses arguments, reads the target list, and launches one thread per target. The random string helper is unused. Overall, this is an operational but basic mass-targeting RCE PoC/exploit with hardcoded payload structure and customizable command input.

This repository is an exploit for CVE-2022-47966, targeting multiple ManageEngine products vulnerable to unauthenticated remote code execution via SAML SSO. The exploit is implemented in Python (main.py) and is part of the hgrab-framework. It takes a list of target URLs (in a file) and a command to execute as arguments. For each target, it crafts a malicious SAMLResponse XML containing an XSLT transform that leverages Java's Runtime.exec() to execute the supplied command on the server. The payload is sent via HTTP POST to the /SamlResponseServlet endpoint of the target. The exploit is operational, allowing arbitrary command execution if the target is vulnerable. The repository contains a README with usage instructions and a single exploit script (main.py).

This repository contains a Metasploit module that exploits CVE-2022-47966, an unauthenticated remote code execution vulnerability in Zoho ManageEngine ServiceDesk Plus (versions 14003 and below). The exploit leverages a flaw in the SAML authentication endpoint (/SamlResponseServlet), which is vulnerable due to the use of an outdated Apache Santuario library. By sending a specially crafted SAMLResponse XML to this endpoint, an attacker can execute arbitrary code on the server without authentication, provided SAML-based SSO was ever configured. The module supports multiple payloads, including Java Meterpreter, Windows and Linux droppers, and command execution for Unix and Windows. The exploit is highly weaponized, allowing attackers to easily customize payloads and target different platforms. The code is structured as a single Ruby file compatible with the Metasploit framework, and it includes options for target URI and request delay. The main attack vector is network-based, targeting the HTTP SAML endpoint.

This repository contains a single Metasploit module that exploits CVE-2022-47966, a critical unauthenticated remote code execution vulnerability in Zoho ManageEngine ADSelfService Plus (versions 6210 and below). The exploit leverages a flaw in the SAML SSO implementation, specifically due to the use of an outdated Apache Santuario library, to execute arbitrary code via a crafted SAMLResponse XML. The module supports both command execution and EXE dropper payloads, targeting Windows systems. It requires the attacker to specify the SAML endpoint GUID and the Issuer URL, and optionally a RelayState URL. The default network configuration targets port 9251 over SSL. The exploit is weaponized, allowing for customizable payloads and reliable exploitation. The code is structured as a standard Metasploit module, with options for payload selection and automatic target checking. No hardcoded IPs or domains are present, but the endpoints '/samlLogin' and '/samlLogin/LoginAuth' are fingerprintable as the SAML endpoints used in the attack.

This repository contains a single Metasploit module targeting CVE-2022-47966, a critical unauthenticated remote code execution vulnerability in Zoho ManageEngine Endpoint Central and MSP (versions 10.1.2228.10 and below) when SAML-based SSO is enabled. The exploit leverages a flaw in the Apache Santuario library to send a crafted SAMLResponse XML to the /SamlResponseServlet endpoint, resulting in arbitrary code execution as SYSTEM. The module supports multiple payload types, including Java in-memory payloads, Windows EXE droppers, and Windows command payloads, and can deliver Meterpreter shells. The exploit is fully weaponized and integrated into the Metasploit framework, with options for target URI and delay between requests. The only file in the repository is a Ruby script structured as a standard Metasploit exploit module, making use of Metasploit's HTTP client and command stager mixins. The attack vector is network-based, requiring access to the SAML endpoint, and the exploit is effective only if SAML SSO is enabled on the target.

This repository contains a proof-of-concept (POC) exploit for CVE-2022-47966, a pre-authentication remote code execution vulnerability affecting several ManageEngine products that use Apache Santuario (xmlsec) <= 1.4.1. The exploit is implemented in a single Python script (CVE-2022-47966.py) that crafts a malicious SAML response containing an XSLT transform. This transform abuses Java's Runtime.exec method to execute arbitrary commands on the target server. The script takes three arguments: the target SAML endpoint URL, the command to execute, and an optional SAML issuer. The README.md provides detailed usage instructions, affected product lists, technical analysis links, and example endpoints. The exploit targets network-accessible SAML endpoints and is effective against products that do not perform additional validation on SAML responses. The repository is structured simply, with one exploit script and a comprehensive README.