bugtraq - Re: Critical phpwiki c99shell exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 12 Apr 2007 17:59:25 +0100
From: "Jamie Riden" <jamie.riden@...il.com>
To: bugtraq@...urityfocus.com, "rurban@...ay.at" <rurban@...ay.at>
Subject: Re: Critical phpwiki c99shell exploit

On 12 Apr 2007 13:14:14 -0000, rurban@...ay.at <rurban@...ay.at> wrote:
> Via the Phpwiki 1.3.x UpLoad feature some hackers from russia uploaded a php3 or php4 file,
> install a backdoor at port 8081 and have access to your whole disc and overtake the server.
>
> A url in the file is http://ccteam.ru/releases/c99shell
>
> The uploaded file has a php, php3 or php4 extension and looks like a gif to the mime magic.
> So apache usually accepts it.
>
> To fix this phpwiki issue at first move the lib/plugin/UpLoad.php file out of this directory.
>
> You can fix it by adding those two lines to your list of disallowed extensions:
>   php3
>   php4
> Currently only "php" is disallowed.

Some people also map .php5 - google for "AddType
application/x-httpd-php5 .php5" and "AddType application/x-httpd-php
.php5" - and goodness knows what else.

This would be much better re-written to use known safe extensions, or
the admin needs to carefully compare the disallowed list against
his/her httpd config.

(If there's anyone who doesn't know c99shell, it's sort of a helper
app for doing things on servers - the kind of things you probably
don't want done - and is often used in conjunction with remote file
include attacks to execute shell commands. There's a screenshot in
Appendix B at http://www.honeynet.org/papers/webapp/ . "Defacing Tool
2.0 by r3v3ng4ns" and r57shell are similar utilities you may have come
across.)

cheers,
 Jamie

PS. I can't see where it checks if the file is a GIF, but it's not
hard to fool some programs, and I don't like the idea of guessing file
types based on contents. It's not safe.

== foo.php ==
GIF89a!^@"^@
<?php
  echo "foo";
?>
===========

$ file foo.php
foo.php: GIF image data, version 89a, 33 x 34

The output of visiting http://localhost/foo.php under apache is
'GIF89a!�"� foo'.
-- 
Jamie Riden / jamesr@...ope.com / jamie@...eynet.org.uk
UK Honeynet Project: http://www.ukhoneynet.org/