| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <510FD33A.30009@vulnerability-lab.com>
Date: Mon, 04 Feb 2013 16:26:50 +0100
From: Vulnerability Lab <research@...nerability-lab.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Free Monthly Websites v2.0 - Multiple Web
Vulnerabilities
Title:
======
Free Monthly Websites v2.0 - Multiple Web Vulnerabilities
Date:
=====
2013-02-04
References:
===========
http://www.vulnerability-lab.com/get_content.php?id=851
VL-ID:
=====
851
Common Vulnerability Scoring System:
====================================
8.5
Introduction:
=============
Free Monthly Websites 2.0 is here and you no longer have to worry about editing complicated HTML code as we have
taken care of that for you, and you no longer have to worry about anything to do with website design as we have taken
care of that for you too, adding your Google AdSense Publisher code, taken care of, ClickBank! All done for you,
here\\\'s how it works. Upload Your Site To Your Domain (this can be done for you). Login To Your Admin Control Panel.
Personalize Your Website (takes just 5 minutes).
(Copy of the Vendor Homepage: http://www.freemonthlywebsites2.com/ )
Abstract:
=========
The independent Vulnerability Laboratory researcher (x-Cisadane) discovered multiple web vulnerabilities in the Free Monthly Websites v2.0 CMS.
Report-Timeline:
================
2013-02-04: Public Disclosure
Status:
========
Published
Exploitation-Technique:
=======================
Defensiv
Severity:
=========
Critical
Details:
========
Multiple web vulnerabilities are detected in the Free Monthly Websites v2.0 Content Management System.
The first bypass vulnerability allows attackers to bypass the system web application auth of the admin login.
The secound vulnerability allows to upload for example webshells and access them after upload via unauthorized web access.
Vulnerable Module(s):
[+] Login Auth (Admin) - Bypass
[+] Upload File - Unauthorized File Upload & Access
Proof of Concept:
=================
The vulnerabilities can be exploited by remote attackers without required user interaction or privileged application user account.
For demonstration or reproduce ...
Dork(s):
inurl:/index_ebay.php
"Powered by: Resell Rights Fortune"
"Generating Traffic to Your Site with Keyword Based Articles"
Powered By: Free Monthly Websites 2.0
[ 1 ] Admin Login Bypass
Vulnerable page http://target.com/[path]/admin/index.php
Line
40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()">
41 <input type="hidden" name="do_type" value="admin_settings_read">
Vulnerable page http://target.com/[path]/admin/login.php
Line
40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()">
41 <input type="hidden" name="do_type" value="admin_settings_read">
Vulnerable page http://target.com/[path]/admin/file_io.php
Line
14 if($_REQUEST[do_type]=="admin_settings_read")
15 {
16 $filename="settings/admin_settings.txt";
17
18 if(!$handle = fopen($filename, 'r'))
19 {
20 echo "Cannot open file ($filename)";
21 exit;
22 }
23 $contents = fread($handle, filesize($filename));
24 fclose($handle);
25 $argument_arr=explode("#_1_#",$contents);
26
27 if($argument_arr[0]==$_REQUEST[username] && $argument_arr[1]==$_REQUEST[pass])
28 {
29 $_SESSION[logged_in]=true;
30 header("location:welcome.php");
Based at line 16 we know that Admin Username and Password store in admin_settings.txt NOT on Database!
So When we login into Admin Panel, file_io.php will Read Valid Username and Password from admin_settings.txt
If you do a direct access to the file admin_settings.txt, The results is
403 Permission Denied
You do not have permission for this request /admin/settings/admin_settings.txt
Picture: http://i48.tinypic.com/2gvlwt4.png
So... How to Bypass Admin Login Page?
1st. Open the Admin Login Page : http://target.com/[path]/admin/index.php
Live Target : http://www.massmoneywebsites.com/admin/
2nd. Inspect Element on the login Form.
Picture: http://i47.tinypic.com/2r5ddp1.png
3rd. Change from
<form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form>
<input type="hidden" name="do_type" value="admin_settings_read">
CHANGE TO
<form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form>
<input type="text" name="do_type" value="admin_settings_write">
Then press ENTER (please see pic).
Pic : http://i49.tinypic.com/351z3ib.png
4th. You will see A Login Failed Page : >> You need to login in to access that page <<
Picture: http://i50.tinypic.com/33ws8jb.png
Never Mind About that, just click 'Login Button' and VOILA you get and Admin Access!
Picture: http://i45.tinypic.com/jzwpea.png
----------------------------------------
[ 2 ] Upload PHP Backdoor or PHP Shell
This vulnerability works on PREMIUM VERSION of Free Monthly Websites 2.0
So... How to Upload Backdoor (PHP Shell)?
1st. Go to Add/Remove Navigation Page.
http://target.com/[path]/admin/add_main_pages.php
Live Target : http://www.massmoneywebsites.com/admin/add_main_pages.php
2nd. Enter a Name For Your New Navigation Page That You Wish To Add: dwi.php
And click Add New Navigation Page.
Picture: http://i45.tinypic.com/vigzsp.png
3rd. Still at the same page, scroll down the page until you see this section : Sort Your Page Buttons/Links.
Pic : http://i46.tinypic.com/1040oxg.png
Change FROM dwi.php.html TO /dwi.php then Click Sort Navigation Pages.
Picture: http://i49.tinypic.com/24ec1l0.jpg
4th. Go to Edit Navigation Page.
http://www.massmoneywebsites.com/admin/edit_main_pages.php
Please Select a Page To Edit: dwi.php.html <--- Select that page.
5th. Inspect element on dwi.php.html
Pic : http://i50.tinypic.com/29pq1ix.png
Change FROM <option value="dwi.php.html" selected="">dwi.php.html</option>
To <option value="dwi.php" selected="">dwi.php</option>
Picture: http://i47.tinypic.com/wtb0j6.png
6th. Enter A Page Title As You Would Like It To Be Seen. Fill with dwi.php
URL For This Page: main_pages/dwi.php
Use the 'URL For This Page' field above: [Tick]
Display This Page in Left Vertical Site Navigation: [Tick]
Display This Page in Top Horizontal Site Navigation Buttons: [Tick]
Picture: http://i46.tinypic.com/1zebnle.png
7th. Still at the same page, scroll down the page until you see this section : Enter Content For Your Page:
Click SOURCE button
Press Enter Twice at the First Line then Paste your PHP Backdoor/PHP Shell below.
And Press Enter Twice at the Last Line.
*Please see 2 Pictures below If you dunno Understand :p
Picture 1 : http://i49.tinypic.com/1zlzxq0.png
Picture 2 : http://i48.tinypic.com/291kc9h.png
If you wanna do this, please remove your backdoor password.
Click Save edited navigation page.
8th. After this message >> Data saved successfully << Appeared, Visit the Home Page and you will see the Backdoor Page
Picture : http://i49.tinypic.com/4rt1g4.png
Risk:
=====
The security risk of the unauthorized file upload vulnerability via auth bypass is estimated as critical.
Credits:
========
X-Cisadane - (stefanus_dp@...il.com)
Greetz 2: X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club and Ngobas
Disclaimer:
===========
The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register
Contact: admin@...nerability-lab.com - support@...nerability-lab.com - research@...nerability-lab.com
Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin@...nerability-lab.com or support@...nerability-lab.com) to get a permission.
Copyright © 2012 | Vulnerability Laboratory
--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research@...nerability-lab.com
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists