a simple python3 script to exploit CVE-2017-9841.
simple script that exploits a remote code execution vulnerability found in
PHPUnit before 4.8.28 and 5.x before 5.6.3. makes a post request to the
target with user input system commands.
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9841.
- python3
- requests module and bs4 module for python3. can be installed with:
pip3 install requests bs4
After identifying a target running phpunit:
chmod +x phpunit-shell
./phpunit-shell -h
or
python3 phpunit-shell -h
the -h or --help option shows how to run the script with a few examples.
there are two positional arguments and a few optional arguments.
usage: phpunit-shell.py [-h] [-a] [-n] address
phpunit-shell.py exploits an RCE vulnerability in
applications running PHPUnit before 4.8.28 and 5.x before 5.6.3.
positional arguments:
address ip/hostname, port, sub-directories to the vulnerable eval-stdin.php file.
optional arguments:
-h, --help show this help message and exit
-a, --accessible turns off features which may negatively affect screen readers
-n, --no-colour removes colour output
example:
phpunit-shell.py 10.10.10.10/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
phpunit-shell by default, prints in colour and with some additional formatting to the terminal output, however this is not always helpful for those that use screenreaders. using the --accessible argument will disable fancy formatting and colour from being printed to the terminal.
it will also disable ascii art.
the script cannot make assumptions about the system it is targetting or the limitations of the user/service running the vulnerable application. ie. this is not a full-shell so changing directories cannot be achieved and longer commands may not be possible.
it's more of a simple, quick half-shell 🐢 designed as a gateway to further exploitation - and eventual full-shell, privesc, etc... 👍
the script also utilises a timeout of 30 seconds for requests, this can be changed or turned off altogether by editing the script.
php code 'shell_exec' is used by default but this can also be changed if the user wishes. eg using 'system' instead.
the script was mainly an exercise in creating a simple python script to exploit CVE-2017-9841 and speed up further exploitation.
https://skerritt.blog/a11y/ - accessibility implementation.