RaphielGang / Telegram-Paperplane

The Paperplane userbot project - a Telegram userbot helping to improve your Telegram experience. https://t.me/tgpaperplane
Other
289 stars 1.06k forks source link

Fix a pair of vulns #237

Closed penn5 closed 4 years ago

penn5 commented 4 years ago

Any command can be executed unless it specifies at least one of group_only or disable_edited. The procedure is to:

  1. Persuade victim to join channel
  2. Promote victim in channel
  3. Persuade victim to send message in channel (this can be done through abuse of the lists feature if the victim has a saved glist)
  4. Edit the message sent by victim to .pip ;<SHELL COMMAND>, where shell command could be env to dump environment variables, it could be a curl command to upload the userbot session file, it could be a command to download and execute a shell script that further exploits the unrestricted execution.