nomisec
WORKING POC
70 stars
by jas502n · remote
https://github.com/jas502n/CVE-2019-16278
The repository contains functional exploit scripts for CVE-2019-16278 (RCE via directory traversal) and CVE-2019-16279 (DoS via memory error). The PoC for CVE-2019-16278 sends a crafted HTTP POST request to execute arbitrary commands via `/bin/sh`, while the DoS exploit floods the target with excessive `
` sequences.
Classification
Working Poc 100%
Target:
Nostromo httpd <= 1.9.6
No auth needed
Prerequisites:
Network access to the target server · Nostromo httpd running on the target
nomisec
WORKING POC
9 stars
by imjdl · remote
https://github.com/imjdl/CVE-2019-16278-PoC
This repository contains a functional Python-based exploit for CVE-2019-16278, a path traversal vulnerability in Nhttpd that allows remote command execution via crafted HTTP requests. The PoC sends a malformed POST request to execute arbitrary commands on the target system.
Classification
Working Poc 95%
Target:
Nhttpd (version not specified)
No auth needed
Prerequisites:
Network access to the target server · Nhttpd running on the target
nomisec
WORKING POC
8 stars
by AnubisSec · remote
https://github.com/AnubisSec/CVE-2019-16278
The repository contains a functional Python script that exploits CVE-2019-16278, a path traversal vulnerability in Nostromo web server leading to unauthenticated remote code execution. The exploit sends a crafted HTTP POST request to traverse directories and execute arbitrary commands via `/bin/sh`.
Classification
Working Poc 95%
Target:
Nostromo web server (nhttpd) <= 1.9.6
No auth needed
Prerequisites:
Network access to the target Nostromo web server · Nostromo web server running on a vulnerable version
nomisec
WORKING POC
6 stars
by aN0mad · remote
https://github.com/aN0mad/CVE-2019-16278-Nostromo_1.9.6-RCE
This repository contains a functional Python exploit for CVE-2019-16278, which targets a remote code execution vulnerability in Nostromo nhttpd <= 1.9.6. The exploit leverages a path traversal flaw in the HTTP request handling to execute arbitrary commands on the server.
Classification
Working Poc 95%
Target:
Nostromo nhttpd <= 1.9.6
No auth needed
Prerequisites:
Network access to the target server · Nostromo nhttpd <= 1.9.6 running on the target
nomisec
WORKING POC
3 stars
by andknownmaly · remote
https://github.com/andknownmaly/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, a remote code execution vulnerability in Nostromo nhttpd <= 1.9.6. The exploit leverages directory traversal via URL-encoded CRLF characters to execute arbitrary commands via /bin/sh.
Classification
Working Poc 100%
Target:
Nostromo nhttpd <= 1.9.6
No auth needed
Prerequisites:
Network access to target server · Target running vulnerable Nostromo nhttpd
nomisec
WORKING POC
3 stars
by ianxtianxt · remote
https://github.com/ianxtianxt/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, a remote command execution vulnerability in Nostromo httpd (nhttpd) 1.9.6. The exploit crafts a malicious HTTP POST request with a payload that bypasses input validation, allowing arbitrary command execution on the target system.
Classification
Working Poc 95%
Target:
Nostromo httpd (nhttpd) 1.9.6
No auth needed
Prerequisites:
Target running Nostromo httpd 1.9.6 · Network access to the target's HTTP port
nomisec
WORKING POC
1 stars
by darkerego · remote
https://github.com/darkerego/Nostromo_Python3
This repository contains a functional Python3 exploit for CVE-2019-16278, targeting a path traversal vulnerability in Nostromo web server versions <= 1.9.6. The exploit sends a crafted HTTP POST request to execute arbitrary commands via a traversal sequence (./.%0d./) leading to /bin/sh.
Classification
Working Poc 100%
Target:
Nostromo web server <= 1.9.6
No auth needed
Prerequisites:
Network access to the vulnerable Nostromo web server · Nostromo web server version <= 1.9.6
nomisec
WORKING POC
1 stars
by Kr0ff · remote
https://github.com/Kr0ff/cve-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, which targets a directory traversal vulnerability in Nostromo (nhttpd) 1.9.6, leading to remote code execution (RCE). The exploit sends a crafted HTTP POST request to traverse directories and execute arbitrary commands via `/bin/sh`.
Classification
Working Poc 100%
Target:
Nostromo (nhttpd) 1.9.6
No auth needed
Prerequisites:
Network access to the target server · Nostromo (nhttpd) 1.9.6 running on the target
nomisec
WORKING POC
1 stars
by cancela24 · remote
https://github.com/cancela24/CVE-2019-16278-Nostromo-1.9.6-RCE
This repository contains a functional exploit for CVE-2019-16278, a directory traversal vulnerability in Nostromo Web Server 1.9.6 that allows remote code execution via a crafted HTTP request. The exploit uses pwntools to send a reverse shell payload to the target.
Classification
Working Poc 95%
Target:
Nostromo Web Server 1.9.6
No auth needed
Prerequisites:
Python 3.x · pwntools library · netcat on target system
nomisec
WORKING POC
by NHPT · remote
https://github.com/NHPT/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, a path traversal vulnerability in Nostromo web server <= 1.9.6 that allows remote command execution via crafted HTTP requests with %0d bypass.
Classification
Working Poc 95%
Target:
Nostromo web server <= 1.9.6
No auth needed
Prerequisites:
Network access to the target Nostromo web server
nomisec
WORKING POC
by alexander-fernandes · remote
https://github.com/alexander-fernandes/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, which leverages a directory traversal vulnerability in Nostromo nhttpd 1.9.6 to achieve unauthenticated remote code execution via a crafted HTTP POST request.
Classification
Working Poc 95%
Target:
Nostromo nhttpd 1.9.6
No auth needed
Prerequisites:
Network access to the target Nostromo web server · Nostromo nhttpd 1.9.6 running on the target
nomisec
WORKING POC
by CybermonkX · remote
https://github.com/CybermonkX/CVE-2019-16278_Nostromo-1.9.6---Remote-Code-Execution
This repository contains a functional Python exploit for CVE-2019-16278, targeting Nostromo 1.9.6. The exploit leverages directory traversal to achieve remote code execution by sending a crafted HTTP POST request.
Classification
Working Poc 95%
Target:
Nostromo 1.9.6
No auth needed
Prerequisites:
Target running Nostromo 1.9.6 · Network access to the target
nomisec
WORKING POC
by h3x0v3rl0rd · poc
https://github.com/h3x0v3rl0rd/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, a remote code execution vulnerability in nostromo 1.9.6. The exploit sends a crafted HTTP POST request with a path traversal payload to execute arbitrary commands on the target system.
Classification
Working Poc 95%
Target:
nostromo 1.9.6
No auth needed
Prerequisites:
Target must be running nostromo 1.9.6 · Network access to the target system
nomisec
WORKING POC
by FredBrave · remote
https://github.com/FredBrave/CVE-2019-16278-Nostromo-1.9.6-RCE
The repository contains a functional Python exploit for CVE-2019-16278, targeting Nostromo 1.9.6. The exploit leverages a path traversal vulnerability to achieve remote code execution (RCE) via a crafted HTTP request.
Classification
Working Poc 95%
Target:
Nostromo 1.9.6
No auth needed
Prerequisites:
Network access to the target · Nostromo 1.9.6 running on the target
nomisec
WORKING POC
by keshiba · remote
https://github.com/keshiba/cve-2019-16278
This repository contains a functional Rust-based exploit for CVE-2019-16278, targeting nhttpd v1.9.6. The exploit sends a maliciously crafted HTTP POST request to trigger remote code execution via a path traversal vulnerability.
Classification
Working Poc 95%
Target:
nhttpd v1.9.6
No auth needed
Prerequisites:
Network access to the target nhttpd server
gitlab
WORKING POC
by Kr0ff · poc
https://gitlab.com/Kr0ff/cve-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, which targets a directory traversal vulnerability in Nostromo (nhttpd) 1.9.6, leading to remote code execution (RCE). The exploit sends a crafted HTTP POST request to traverse directories and execute arbitrary commands via `/bin/sh`.
Classification
Working Poc 100%
Target:
Nostromo (nhttpd) 1.9.6
No auth needed
Prerequisites:
Network access to the target server · Nostromo (nhttpd) 1.9.6 running on the target
metasploit
WORKING POC
GOOD
rubypocunix
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/nostromo_code_exec.rb
This Metasploit module exploits a directory traversal vulnerability (CVE-2019-16278) in Nostromo <= 1.9.6 to achieve remote command execution via a crafted HTTP POST request targeting `/bin/sh`. It supports both in-memory Unix payloads and Linux droppers for various architectures.
Classification
Working Poc 100%
Target:
Nostromo <= 1.9.6
No auth needed
Prerequisites:
Network access to the Nostromo web server · Nostromo version <= 1.9.6
vulncheck_xdb
WORKING POC
remote
https://github.com/n3rdh4x0r/CVE-2019-16278
This repository contains a functional Python exploit for CVE-2019-16278, a remote code execution vulnerability in Nostromo 1.9.6. The exploit leverages a path traversal flaw in the HTTP request handling to execute arbitrary commands via a crafted POST request.
Classification
Working Poc 95%
Target:
Nostromo 1.9.6
No auth needed
Prerequisites:
Target IP address · Target port · Command to execute
exploitdb
WORKING POC
VERIFIED
by Metasploit · rubyremotemultiple
https://www.exploit-db.com/exploits/47573
This Metasploit module exploits CVE-2019-16278, a directory traversal vulnerability in Nostromo web server <= 1.9.6, allowing unauthenticated remote command execution via a crafted HTTP POST request targeting the `http_verify` function.
Classification
Working Poc 100%
Target:
Nostromo nhttpd <= 1.9.6
No auth needed
Prerequisites:
Network access to the Nostromo web server · Server running Nostromo <= 1.9.6
vulncheck_xdb
WORKING POC
remote
https://github.com/Ghostdust-u/pentest
The repository contains a functional Python exploit for CVE-2019-16278, a remote command execution vulnerability in the Nostromo web server. The exploit constructs a malicious HTTP POST request to execute arbitrary commands via a path traversal and command injection technique.
Classification
Working Poc 95%
Target:
Nostromo web server (nhttpd) 1.9.6 and earlier
No auth needed
Prerequisites:
Network access to the target server · Nostromo web server running on the target
exploitdb
WORKING POC
VERIFIED
by Kr0ff · pythonremotemultiple
https://www.exploit-db.com/exploits/47837
This exploit leverages a path traversal vulnerability in nostromo 1.9.6 to achieve remote code execution by sending a maliciously crafted HTTP POST request. The payload bypasses input validation to execute arbitrary shell commands via the '.%0d' directory traversal technique.
Classification
Working Poc 100%
Target:
nostromo 1.9.6
No auth needed
Prerequisites:
Network access to the target server · Nostromo server running on port 80 or another specified port