PHP External Variable Modification in Juniper Junos OS J-Web

This repository contains a proof-of-concept exploit for CVE-2023-36845, a remote code execution vulnerability in Juniper Junos OS J-Web. The main file, 'juniperus.py', is a Python3 script that provides an interactive console for exploiting the vulnerability. It allows the attacker to connect to a target Junos device's web interface (over HTTP or HTTPS), and execute limited PHP commands by abusing the PHPRC variable and the 'auto_prepend_file' directive. The exploit currently supports 'ls' (directory listing) and 'cat' (file reading) commands, implemented via PHP's 'scandir' and 'file_get_contents' functions, respectively. The script handles SSL/TLS issues for older Junos devices and allows customization of the Host header, protocol, and port. The README provides a brief description of the exploit. The code is structured for interactive use and is limited by the FreeBSD jail environment on the target, but demonstrates the core RCE capability. No hardcoded IPs or domains are present; the target is specified at runtime. The exploit is a standalone PoC and not part of a framework.

This repository contains a single Metasploit module targeting Juniper SRX firewalls and EX switches running vulnerable versions of Junos OS (CVE-2023-36845). The exploit leverages PHP environment variable manipulation, specifically abusing the 'auto_prepend_file' and 'allow_url_include' features, to achieve remote code execution via the web interface. The module supports two main attack modes: (1) in-memory PHP payload execution (e.g., Meterpreter reverse shell) within a FreeBSD jail, and (2) a 'jail break' mode that escalates privileges by stealing or creating a J-Web session, changing the root password, and logging in via SSH for full root access, before restoring the original password. The exploit is highly weaponized, supporting customizable payloads and advanced post-exploitation steps. Key fingerprintable endpoints include /dev/fd/0 (for payload delivery), /etc/master.passwd (for password manipulation), and session directories. The module is well-documented, includes multiple configuration options, and is suitable for both proof-of-concept and operational exploitation.

This repository contains a Python proof-of-concept exploit for CVE-2023-36845, a vulnerability in Juniper Networks Junos OS (EX and SRX Series) J-Web component. The exploit targets the PHPRC environment variable manipulation, allowing an attacker to attempt to read arbitrary files (such as /etc/passwd) from vulnerable devices. The main script, 'CVE-2023–36845.py', reads a list of target hosts from 'hosts.txt' (not included in the repo), and concurrently sends crafted HTTP POST requests to each, attempting to exploit the vulnerability. The script prints the HTTP response for each host, which may include sensitive file contents if successful. The repository also includes a README with detailed usage instructions and a requirements.txt specifying the 'requests' library. The exploit is a network-based PoC and does not include weaponized or post-exploitation payloads.

This repository contains a Python proof-of-concept exploit for CVE-2023-36845, a vulnerability in the J-Web component of Juniper Networks Junos OS (affecting EX and SRX Series devices). The main script, 'CVE-2023-36845-POC.py', reads a list of target hosts from 'hosts.txt' and sends crafted HTTP POST requests to each, attempting to exploit the PHPRC environment variable to read the '/etc/passwd' file from the target system. The exploit leverages concurrent execution to test multiple hosts in parallel. The repository also includes a README with usage instructions, a requirements.txt specifying the 'requests' library, and a GPLv3 license. The exploit is a functional proof-of-concept and does not provide a shell or persistent access, but demonstrates the ability to read sensitive files from vulnerable systems.

This repository contains a Bash script (cve.sh) and a README.md file. The script is a proof-of-concept exploit for CVE-2023-36845, a vulnerability affecting Juniper SRX and EX Series devices running Junos OS. The exploit works by reading a list of target hosts from a user-supplied file, then sending a crafted HTTP POST request to each host, attempting to leverage the PHPRC parameter to include /etc/passwd. If the response contains 'root:', the target is considered vulnerable and is logged to vuln.txt. The script is designed for batch testing multiple hosts and provides clear output for vulnerable systems. The README provides usage instructions and references to relevant advisories and articles. No weaponized payload is included; the script is a POC for detection and verification of the vulnerability.