SQL Injection in ATutor 2.2.1 searchFriends function

This repository contains a single Metasploit module (atutor_sqli.rb) that exploits a SQL injection and authentication bypass vulnerability (CVE-2016-2555) in ATutor 2.2.1. The exploit works by performing a SQL injection to extract the admin username and password hash, then uses this information to log in as the admin. After authentication, it uploads a malicious ZIP archive as a module, which contains a PHP webshell. The shell is then triggered via a crafted HTTP request with a custom header containing the attacker's payload (base64-encoded PHP code). The module is fully weaponized, supporting arbitrary PHP payloads via Metasploit, and leverages multiple HTTP endpoints in the ATutor application. The code is written in Ruby and is structured as a standard Metasploit exploit module, making it easy to use within the Metasploit framework.

This repository contains a single Metasploit module (atutor_filemanager_traversal.rb) targeting ATutor 2.2.1 running on Linux/Apache/PHP. The exploit leverages a directory traversal vulnerability in the file manager component to upload a malicious ZIP file containing a PHP webshell, enabling remote code execution. If remote registration is not enabled, the module can exploit two additional vulnerabilities: a type juggling authentication bypass (confirm.php) and a password reset TOCTOU issue (password_reminder.php) to gain access. The exploit requires either valid credentials or the ability to exploit these authentication bypasses. The payload is a PHP webshell that executes code sent via a custom HTTP header. The module is operational and provides remote code execution if successful. The main attack vector is network-based, targeting HTTP endpoints of the ATutor application.

This repository contains a Python exploit script (CVE-2016-2555.py) and a README.md. The exploit targets ATutor 2.2.1, leveraging a SQL injection vulnerability to extract a username and password hash from the database. It then uses a pass-the-hash technique to authenticate as the user, and uploads a malicious ZIP file containing a PHP webshell to the server via a vulnerable import endpoint. The webshell is written to a web-accessible directory, allowing the attacker to execute arbitrary commands via HTTP requests. The exploit is operational, providing a working attack chain from initial access to remote code execution. The main endpoints involved are the SQL injection point, login page, file upload handler, and the final webshell location. The repository is well-structured, with clear separation between exploit code and documentation.