Sar2HTML Exploit | Reverse shell

The index.php script in Sar2HTML 3.2.1 is vulnerable to remote command execution. The vulnerability is due to insufficient sanitizing of user supplied inputs in the application when handling a crafted HTTP request. A remote attacker may be able to exploit this to execute arbitrary commands within the context of the application, via a crafted HTTP request.

"This Vulnerability could allow a remote attacker to execute arbitrary commands on the system, caused by a commend injection flaw in the index.php script. By sending specially-crafted commands, an attacker could exploit this vulnerability to execute arbitrary commands on the system."

This script has two ways of exploiting the vulnerability. Use with ethics and wisdom:

---

1 - Command Injection

Sends GET requests, using the ?plot parameter to inject Linux Commands and then returns the output of the command. To pass more complex commands or commands with arguments, use quotation marks "".

2 - Reverse Shell Injection

Remotely uploads a reverse shell to the user's machine using the same command injection method, but opens a mini HTTP server on the local machine for the transfer.

Lab for vulnerability testing

• VulnHub
• TryHackMe

Warning:

I am not responsible for any illegal use or damage caused by this tool. It was written for fun, not evil and is intended to raise awareness about cybersecurity.

Have a good hack :D