来源

关联漏洞

描述

This is a script written in Python that allows the exploitation of the Chamilo's LMS software security flaw described in CVE-2023-4220 

介绍

# Chamilo LMS Unauthenticated RCE PoC

This is a script written in Python that allows the exploitation of the **Chamilo's LMS** software security flaw described in **CVE-2023-4220**.  The system is vulnerable in versions preceding **1.11.24**.

## Usage

Clone the repository to your machine and install the dependencies using **pip** (it is recommended to use **virtualenv** to create an environment to separate these installations from global installations)


git clone https://github.com/charchit-subedi/chamilo-lms-unauthenticated-rce-poc
cd chamilo-lms-unauthenticated-rce-poc
pip install -r requirements.txt


The script needs the **target URL** with the **Chamilo's** root path (like **http://example.com/chamilo, http://example.com** or **http://chamilo.example.com)** and a action to perform (there is three of them available: **scan, webshell** and **revshell**).

### Scan
 
This action will check if the target is vulnerable by trying to access the **/main/inc/lib/javascript/bigupload/files/** endpoint.

python3 main.py -u http://example.com/chamilo -a scan


### Webshell

This action will create a **PHP webshell** file in the vulnerable endpoint.


python3 main.py -u http://example.com/chamilo -a webshell


### Revshell

This action will create and execute a **bash reverse shell** file. To do this, a **webshell** will first be created using the same method used in the previous action. After that, some commands will be executed to create and execute the **bash** file. Be sure to be listening on the port you defined with **nc** or any other utilitary so you actually get the reverse connection. Also, the host can be a valid **internal/public IPv4** (like **172.17.1.4** or **186.227.4.31)** or the domain that you have registered (like **evil-vps.domainreg.net**)


python3 main.py -u http://example.com/chamilo -a revshell

文件快照

 [4.0K]  /data/pocs/51d90cbf151e93774b1e517057359da0ee994b79
├── [2.3K]  exploit.py
├── [3.5K]  main.py
├── [4.0K]  __pycache__
│   └── [3.9K]  exploit.cpython-311.pyc
├── [1.8K]  README.md
└── [  59]  requirements.txt

1 directory, 5 files

备注