CVE-2023-38035

This repository contains a functional exploit for CVE-2023-38035, an unauthenticated command injection vulnerability in Ivanti Sentry. The exploit uses a Hessian proxy to interact with the vulnerable service endpoint and execute arbitrary commands as the root user.

This repository contains a functional exploit for CVE-2023-38035, an authentication bypass vulnerability in MobileIron Sentry. The exploit uses Hessian serialization to invoke the 'getApplianceLicenseInfo' method, extracting company name and contact email without authentication.

This repository contains a functional exploit for CVE-2023-38035, targeting MobileIron systems via a Hessian-based deserialization vulnerability. The exploit includes a Python script (`hessian.py`) for command execution and a bash script (`mics_hunter.sh`) for automated scanning and reverse shell setup.

This repository contains a functional exploit for CVE-2023-38035, targeting MobileIron systems via a Hessian deserialization vulnerability. The exploit includes a Python script (`hessian.py`) for command execution and a bash script (`mics_hunter.sh`) for automated scanning and reverse shell execution.

This Metasploit module exploits an authentication bypass in Ivanti Sentry (CVE-2023-38035) to achieve remote code execution as root via the Hessian binary web service protocol. It leverages the `uploadFileUsingFileInput` function to execute arbitrary commands.