Arbitrary Code Execution via eval in Searchor main.py

The repository contains one Python exploit script, CVE-2023-43364.py, targeting CVE-2023-43364 in Searchor 2.4.0. It posts a crafted query value to http://searcher.htb/search with engine=Brave. The query injects a Python expression that imports os and calls os.popen, allowing execution of a shell command on the server. The script prompts for an operator IP address and port, Base64-encodes a Bash /dev/tcp reverse shell, and has the injected command decode and execute it. It uses requests.Session() with browser-like Origin, Referer, and User-Agent headers, then prints the HTTP response status, request body, request headers, and encoded payload. This is an operational exploit rather than a detection utility because it delivers a configurable reverse-shell payload.

This repository is a small standalone Python proof-of-concept exploit for CVE-2023-43364 affecting Searchor versions prior to 2.4.2. The repo contains only two files: a single exploit script (CVE-2023-43364.py) and a README with usage guidance and references. The exploit script uses argparse to support three modes: (1) a test mode that sends an injected payload to run 'id', (2) a custom command mode that executes any attacker-supplied shell command, and (3) a reverse shell mode that sequentially tries four callback techniques. All exploitation is delivered via HTTP POST requests to a user-supplied target URL, with form fields 'engine=Google' and a malicious 'query' value. The injected payloads abuse Python expression/code execution primitives such as __import__('os').system(...) and exec(...), consistent with the README's description of unsafe eval() usage in Searchor. The reverse shell logic is more than a minimal PoC: it attempts multiple fallback methods to improve reliability across target environments. Specifically, it tries a Python socket reverse shell to <LHOST>:4444, then a bash /dev/tcp shell, then a telnet+mkfifo shell, and finally a busybox nc -e shell. This makes the exploit operational rather than purely demonstrative, though payload customization is still manual and limited. No hardcoded victim URL is present; the operator must provide the target endpoint. The main fingerprintable artifacts are the POST parameters ('engine' and 'query'), the callback port 4444, and the shell paths/techniques used on the target. Overall, the repository's purpose is straightforward: exploit Searchor RCE to obtain command execution or an interactive shell on a vulnerable server.