BSW Gallery Shell Upload

Posted on 18 October 2012
ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿
Â³ ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ‚ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿ Â³
Â³ Â³ Undergroundthalo Hacking Team - Security Advisory Â³ Â³
Â³ ÃÂšÃÂ----------------------------------------ÃÂ€Â³ÃÂ™-----------------------------------ÃÂ¿ Â³
Â³ÃÂš´ Author : cr4wl3r Â³ Release Date : 18-Okt-2012 ÃÂƒ¿Â³
Â³Â³Â³ Product : BSW Gallery Â³ Size : 38.2 kB Â³Â³Â³
Â³Â³Â³ Link : http://sourceforge.net/projects/bswgallery/ Â³Â³Â³
Â³ÃÂƒÃÂ------------------------------------------Â³-------------------------------------ÃÂ´Â³
Â³Â³ gallery.zip Â³ Â³Â³
Â³ÃÂ€ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ™Â³
Â³ Details Â³
Â³ Â³
Â³ BSW Gallery Â³
Â³ Â³
Â³ This is a very simple photo gallery which is written in PHP code Â³
Â³ designer by Dr.Mohamed AbdelWahab Â³
Â³ The web application is vulnerable Arbitrary File Upload Â³
Â³ where an attacker could upload a malicious php code without difficulty Â³
Â³ on the file to be uploaded Â³
Â³------------------------------------------------------------------------------------Â³
 Code in uploadpic.php

print "<form method="POST" action="dopic.php"enctype="multipart/form-data" style="width: 227px">";
print "<table align="center" style="width: 600px"dir="ltr"><tr><th align="right"width="120" class="topic"><b>File Upload:</b></th>";
print "<th align="left"><input type="file" name="fileupload"></th></tr>";
print "<tr><th><input type="hidden" name="MAX_FILE_SIZE" value="10240000"></th></tr></table>";
print"<table align="center"width="600"dir="ltr">";
print"<th class="topic"width="120"align="right">Image Title</th><th align="left"><input style="width:400"type="text" name="picture" /></th></table>";
print"<table align="center"dir="ltr" width="600"><th class="topic" width="120"align="right">Image Description</th>";
print"<th align="left"><textarea name="descrip"cols="48"rows="5"></textarea></th></table>";

 Code in dopic.php

$fname=$_POST['picture'];
$descrip=$_POST['descrip'];
$file_dir ="gallery/";

foreach($_FILES as $file_name => $file_array) {
 echo "path: ".$file_array["tmp_name"]."<br/>
";
 echo "name: ".$file_array["name"]."<br/>
";
 echo "type: ".$file_array["type"]."<br/>
";

 echo "size: ".$file_array["size"]."<br/>
";

 if (is_uploaded_file($file_array["tmp_name"])) {
 move_uploaded_file($file_array["tmp_name"], "$file_dir/".$file_array["name"]) or die ("Couldn't copy");
 echo "Done!<br/>";
 }

}
$image=$file_dir.$file_array["name"];
$ip = getenv("REMOTE_ADDR");
$sql = "insert into gallery (picture,files,descrip,updated)values('$fname','$image','$descrip',now());";
mysql_query($sql,$mysql);
mysql_close($mysql);

Â³------------------------------------------------------------------------------------Â³
Â³ Proof of Concept : Â³
Â³ Â³
Â³ http://b0x/path_gallery/uploadpic.php Â³
Â³ Â³
Â³ Shell : Â³
Â³ Â³
Â³ http://b0x/path_gallery/gallery/shell.php Â³
Â³ Â³
Â³ See for the demo : Â³
Â³ Â³
Â³ http://0xuht.org/demo/demo1.png Â³
Â³ http://0xuht.org/demo/demo2.png Â³
Â³ http://0xuht.org/demo/demo3.png Â³
Â³ Â³
Â³ Â³
Â³ Undergroundthalo Hacking Team Â³
Â³ Site: http://0xuht.org Â³
Â³ Twitter: @hackb0x Â³
Â³ Â³
Â³ ÃÂšÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„¿ Â³
Â³ Â³ Happy Birhtday Saskia Adam :) Â³ Â³
ÃÂ€ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ„ÃÂ™
TOP
Malware :

Last 20
Exploits :

Last 20