Exploit-DB #7001
Description: DFLabs PTK 1.0 - Local Command Execution
Type: webapps
Platform: php
Date: 2008-11-05
Author: ikki

Exploit:
==================================================== 
Security Research Advisory

Vulnerability name: DFLabs PTK Local Command Execution Vulnerability
Advisory number: LC-2008-07
Advisory URL: http://www.ikkisoft.com

==================================================== 
1) Affected Software 

* DFLabs PTK 1.0 (final release)

Previous versions are affected as well:

* DFLabs PTK 0.2
* DFLabs PTK 0.1

====================================================
2) Severity 

Severity: High
Local/Remote: Local

Note: remote command execution is possible and moreover 
easy to trigger; however, due to the nature of the tool, only 
the local command execution poses a serious real world threat

==================================================== 
3) Summary

As reported in the project website, "PTK is an alternative advanced interface 
for the suite TSK (The Sleuth Kit). [...] PTK is not just a new graphic and 
highly professional interface based on Ajax technology but offers a great deal 
of features like analysis, search and management of complex cases of digital 
investigation". PTK is included within the SANS Investigative Forensic Toolkit 
(SIFT) Workstation.

This application is vulnerable to multiple input validation attacks. The 
possibility to exploit these findings introduces several malicious scenarios. 
For instance, a criminal may abuse this specific vulnerability to modify 
the evidence of the crime, compromising the digital investigation workstation. 
Even if the original evidence should be accessed only in read-only mode, 
using also hardware write blockers according to forensic best practices, 
several malicious scenarios are possible with just the alteration of the 
working copy image. Additionally, a payload could be crafted to hide, 
or alter, just the information presented to the analyst, something which 
would not be evident unless the same image is analyzed with a tool not 
vulnerable to the attack.

In our research, we have developed a reliable Proof-of-Concept in order 
to exploit an arbitrary local command execution vulnerability showing possible 
anti forensic attacks. As defined by Rogers D. M. (2005), anti forensics 
attempts to "negatively affect the existence, amount and/or quality of 
evidence from a crime scene, or make the analysis and examination of evidence 
difficult or impossible to conduct".

References:
http://ptk.dflabs.com/
http://en.wikipedia.org/wiki/Counter_forensics

====================================================
4) Vulnerability Details

The PTK interface is prone to multiple input validation vulnerabilities that may 
result in a silent local command execution.

Since the application fails to validate most of the input vectors, Cross Site 
Scripting, CSRF and other flaws are possible. However, due to the nature of the 
tool, our research aimed to point out the possible risks and attack techniques 
which could be used in order to silently compromise the investigation platform 
and corrupt evidence without user interaction.
Even if the application is vulnerable to remote command execution, as a real life 
threat it is pretty unrealistic. PTK, as well as Autopsy, are usually used in the 
"localhost" context where a single user (the investigator) analyzes the crime image.

However, in our humble opinion, a local command execution vulnerability triggered 
by the simple inclusion of the acquired crime scene image should be considered 
as an HIGH impact flaw with an HIGH exploitability rate.

Once the investigator has loaded the binary image (e.g. a "dd" file), he can 
browse the filesystem tree and look for a specific file. During the browsing, 
the Ajax-based application uses binaries of the Sleuth Kit in order to access 
the acquired image content. In the browsing, the "fls" application is involved. 
As illustrated in the man, it lists the files and directory names in the image 
and can display file names of recently deleted files for the directory using the 
given inode.

Once the investigator selects a specific file from the image filesystem, PTK 
invokes the following script:

/ptk/lib/file_content.php?arg1=null&arg2=107533&arg3=<FILENAME>&arg4=1  

where <FILENAME> is the filename without any kind of input validation retrieved 
from the image via fls. 
A malicious user (e.g. a person under investigation) may abuse this attack input
simply creating a crafted file in his/her filesystem, as demonstrated below.

Due to the possibility to pollute the "arg3" variable, we can also override the 
"arg1" HTTP parameter with the following content:

arg3 --> Confidential.doc&arg1=[new arg1 variable value]

This request is managed by PTK using the following code:

[..]
$offset = $_GET['arg1'];
$inode = $_GET['arg2'];
$name = $_GET['arg3'];
$partition_id = $_GET['arg4'];
$page_offset = 100;
[..]
$type = get_file_type($_SESSION['image_path'], $offset, $inode);
[..]

where the function "get_file_type" is:

function get_file_type($path, $offset, $inode){
	include("../config/conf.php");
	if($offset == 'null'){
		$offset = '';
	}else{
		$offset = "-o $offset";
	}
	if($inode == 'null') $inode = '';
	$result = shell_exec("$icat_bin -r $offset $path $inode | $file_bin -zb -");
	if(preg_match("/(image data)|(PC bitmap data)/", $result)){
		$_SESSION['is_graphic'] = 1;
	}
	return $result;
}

As you can see, the $offset variable used within the unfiltered shell_exec 
function could be used in order to execute arbitrary system commands 
with the privileges of the web server. 

Since the malicious payload should be included in the filename, some obfuscation 
techniques are pretty interesting in order to force PTK to not reveal the real filename.
Several possibilities were tested, including the usage of UTF-7 encoding since PTK 
does not force a specific page charset. However the most reliable and easy to use 
technique is the inclusion o