<<< Date Index >>>     <<< Thread Index >>>

Re: Critical phpwiki c99shell exploit



On 12 Apr 2007 13:14:14 -0000, rurban@xxxxxxxx <rurban@xxxxxxxx> wrote:
Via the Phpwiki 1.3.x UpLoad feature some hackers from russia uploaded a php3 
or php4 file,
install a backdoor at port 8081 and have access to your whole disc and overtake 
the server.

A url in the file is http://ccteam.ru/releases/c99shell

The uploaded file has a php, php3 or php4 extension and looks like a gif to the 
mime magic.
So apache usually accepts it.

To fix this phpwiki issue at first move the lib/plugin/UpLoad.php file out of 
this directory.

You can fix it by adding those two lines to your list of disallowed extensions:
  php3
  php4
Currently only "php" is disallowed.

Some people also map .php5 - google for "AddType
application/x-httpd-php5 .php5" and "AddType application/x-httpd-php
.php5" - and goodness knows what else.

This would be much better re-written to use known safe extensions, or
the admin needs to carefully compare the disallowed list against
his/her httpd config.

(If there's anyone who doesn't know c99shell, it's sort of a helper
app for doing things on servers - the kind of things you probably
don't want done - and is often used in conjunction with remote file
include attacks to execute shell commands. There's a screenshot in
Appendix B at http://www.honeynet.org/papers/webapp/ . "Defacing Tool
2.0 by r3v3ng4ns" and r57shell are similar utilities you may have come
across.)

cheers,
Jamie

PS. I can't see where it checks if the file is a GIF, but it's not
hard to fool some programs, and I don't like the idea of guessing file
types based on contents. It's not safe.

== foo.php ==
GIF89a!^@"^@
<?php
 echo "foo";
?>
===========

$ file foo.php
foo.php: GIF image data, version 89a, 33 x 34

The output of visiting http://localhost/foo.php under apache is
'GIF89a!�"� foo'.
--
Jamie Riden / jamesr@xxxxxxxxxx / jamie@xxxxxxxxxxxxxxx
UK Honeynet Project: http://www.ukhoneynet.org/