This project aims at re-analyzing and PoC about CVE-2023-33733. Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file. # CVE-2023-33733 on Reportlab v3.6.12
This lab was set up to test CVE-2023-33733.
## Analyzing process
You can see our analyzing process about this CVE in PDF file on main repo.
## Setup and Run
### Server
#### Setup
```bash
pip3 install -r requirements.txt
```
#### Run
```bash
python3 app.py
```
### Attacker
#### Connect to server
Connect to server IP address
```http://{Server_IP}:4444```<br>
After running, you will see an interface like this, you can upload malicious HTML file to see the RCE.
#### Listening and uploading file
```bash
nc -lvnp 4444
```
Then, upload your evil.html and get the reverse shell
[4.0K] /data/pocs/7cbb879821b989d42fdf78c53451fc9cf37463d0
├── [1.2K] app.py
├── [4.0K] assets
│ ├── [279K] 1000_F_443702089_Du3AvDIohGuY892HOcuAUv7UlZPlURcY.jpg
│ ├── [5.7M] bg.svg
│ ├── [2.8M] c860da74910a36e98da7eada780c1330.svg
│ ├── [ 39K] image.png
│ ├── [ 54K] image-removebg-preview.png
│ ├── [ 828] Picture1.svg
│ ├── [7.6K] Picture2.svg
│ ├── [ 828] Picture3.svg
│ └── [526K] rpl.svg
├── [ 199] clean.html
├── [4.5M] CVE-2023-33733.pdf
├── [ 539] evil.html
├── [ 871] README.md
├── [ 31] requirements.txt
├── [4.0K] static
│ ├── [4.0K] js
│ │ └── [2.6K] script.js
│ └── [4.0K] styles
│ └── [2.5K] style.css
└── [4.0K] templates
└── [2.8M] index.html
5 directories, 18 files