This PoC was created while working on the Sar machine in the OFFSEC Proving Grounds Play. The idea stems from the exploit titled Sar2HTML 3.2.1 - Remote Command Execution (https://www.exploit-db.com/exploits/47204).

Save the script as sar.py. Then run it from command line.

The IP address and port in the URL is not hardcoded for ease of use. Please make sure you put your target IP in the command line. After you run it, the command prompt will become kali@kali.

From here, you can do your thang.

Sar2HTML v3.2.1 has a command injection vulnerability in the 'plot' parameter of the web application. This script exploits the vulnerability to execute commands on the target.

Sar2HTML does not validate user input when processing the $plot variable before passing it to PHP's exec function.

This is one of my first attempts at this so please be nice :)