CVE-2017-9841 PoC — PHPUnit 安全漏洞

Description

phpunit-shell | CVE_2017-9841

Readme

# phpunit-shell ⭐
a simple python3 script to exploit CVE-2017-9841.

## the exploit - CVE-2017-9841 ❗
simple script that exploits a remote code execution vulnerability found in
PHPUnit before 4.8.28 and 5.x before 5.6.3. makes a post request to the
target with user input system commands.  
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9841.
***

## prerequisites ✔
* python3
* requests module and bs4 module for python3. can be installed with:
```
pip3 install requests bs4
```
***

## usage ℹ
After identifying a target running phpunit:
```
chmod +x phpunit-shell
./phpunit-shell -h
```
or
```
python3 phpunit-shell -h
```
the -h or --help option shows how to run the script with a few examples.  
there are two positional arguments and a few optional arguments.
```
usage: phpunit-shell.py [-h] [-a] [-n] address

phpunit-shell.py exploits an RCE vulnerability in
applications running PHPUnit before 4.8.28 and 5.x before 5.6.3.

positional arguments:
  address           ip/hostname, port, sub-directories to the vulnerable eval-stdin.php file.

optional arguments:
  -h, --help        show this help message and exit
  -a, --accessible  turns off features which may negatively affect screen readers
  -n, --no-colour   removes colour output

example:
        phpunit-shell.py 10.10.10.10/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
```
### --accessible argument:
`phpunit-shell` by default, prints in colour and with some additional formatting to the terminal output, however this is not always helpful for those that use screenreaders. using the `--accessible` argument will disable fancy formatting and colour from being printed to the terminal.  
it will also disable ascii art.
***

## limitations ⚠
the script cannot make assumptions about the system it is targetting or the limitations of the user/service running the vulnerable application. ie. this is not a full-shell so changing directories cannot be achieved and longer commands may not be possible.  
it's more of a simple, quick half-shell 🐢 designed as a gateway to further exploitation - and eventual full-shell, privesc, etc... 👍

the script also utilises a timeout of 30 seconds for requests, this can be changed or turned off altogether by editing the script.  
php code 'shell_exec' is used by default but this can also be changed if the user wishes. eg using 'system' instead.

## notes 📝
the script was mainly an exercise in creating a simple python script to exploit CVE-2017-9841 and speed up further exploitation.
***

## credits 👍
https://skerritt.blog/a11y/ - accessibility implementation.

File Snapshot

Remarks