来源

关联漏洞

描述

SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)

介绍

# SPIP CVE-2023-27372 Unauthenticated RCE Exploit (Web Shell Upload)

This Python script exploits CVE-2023-27372, an unauthenticated remote code execution vulnerability in SPIP CMS versions prior to 4.2.1. It leverages a cache poisoning flaw in the password reset mechanism to upload a web shell and gather basic system information.

**Author:** [@ronkkeli](https://github.com/1Ronkkeli) (Script v1.2)
**TryHackMe:** [ronkkeli](https://tryhackme.com/p/ronkkeli)
**Original PoC Concept:** nuts7

## CVE Information

* **CVE ID:** CVE-2023-27372
* **CVSS Score:** 9.8 (Critical)
* **Affected Versions:** SPIP CMS versions < 4.2.1

## Vulnerability Description

An unauthenticated RCE vulnerability exists in the `ecrire/inc/filtres.php` file within the `reset_cache` function. This function uses the `oubli` parameter from the password recovery page (`spip.php?page=spip_pass`). By sending a specially crafted serialized payload in the `oubli` parameter, an attacker can inject arbitrary PHP code into the cache file `ecrire/data/cache/reset_cache.php`. This script uses this flaw to execute `file_put_contents` and write a persistent web shell to the server.

## Script Features (v1.2)

* Fetches the required Anti-CSRF token automatically.
* Constructs and sends the serialized payload to upload a web shell.
* Allows customization of the web shell's filename (`-f`).
* Allows customization of the web shell's PHP code (`-d`).
* **Enhanced Post-Exploit Check:** Verifies shell upload and attempts to gather basic system info (`whoami`, `hostname`, `uname`, `id`, `pwd`) using the shell.
* Presents gathered information in a clean, aligned format.
* Provides colorized output for better readability.
* Includes usage examples for reverse shells.

## Requirements

* Python 3.x
* `requests` library
* `beautifulsoup4` library

## Installation

```bash
pip install requests beautifulsoup4

文件快照

 [4.0K]  /data/pocs/588e8358c586fa6caeb75e4c7262886dfb723dd3
├── [ 14K]  cve.py
└── [1.8K]  README.md

0 directories, 2 files

备注