CVE-2020-8656

This Metasploit module exploits multiple vulnerabilities in EyesOfNetwork (CVE-2020-8654, CVE-2020-8655, CVE-2020-8656, CVE-2020-8657) to achieve remote command execution as root. It leverages command injection in the AutoDiscovery feature, privilege escalation via Nmap, and authentication bypass via SQLi or a hardcoded API key.

This exploit demonstrates a multi-stage attack against EyesOfNetwork 5.3, combining SQL injection (CVE-2020-8656) for authentication bypass, user creation via API, and remote code execution (CVE-2020-8654) through command injection in the discovery module. It also includes a privilege escalation (CVE-2020-8655) via a crafted NSE script executed by nmap.

This repository contains functional exploit code for CVE-2020-8656, which involves SQL injection in the EyesOfNetwork API's getApiKey function. The exploit chains multiple CVEs (CVE-2020-8654, CVE-2020-8655, CVE-2020-8656) to achieve remote code execution (RCE) and local privilege escalation (LPE) on EyesOfNetwork versions 5.1 to 5.3.