Exploit-DB #8880
Description: kloxo 5.75 - Multiple Vulnerabilities
Type: remote
Platform: linux
Date: 2009-06-04
Author: anonymous

Exploit:
#####################################################################
#
#  Who  : http://lxlabs.com
#
#  What : kloxo
# 
#  "Kloxo (Previously Lxadmin) The most flexible software on this
#  planet. From Kloxo HostInaBox, World's lightest and the most
#  efficient webhosting platform, to Kloxo Enterprise, which can
#  manage 100s of thousands of domains on hundreds of servers. Kloxo
#  is a fully scriptable, distributed, 100% object oriented hosting
#  platform. There is nothing in the hosting industry that's even
#  comparable to Kloxo in its sheer flexibility."
#
#  =============================================
#  A few dozen lxadmin / kloxo bugs
#  Tested on centos-5-i386-hostinabox575.tar.gz
#  =============================================
#
#  Timeline :
#
#  05/21/2009 - sent initial email to vendor with a link to a private
#               resource for viewing various kloxo hiab575
#               vulnerability info
#
#  05/23/2009 - received the following: "Thanks for the info. I will
#               review this and let you know." (no signature)
#
#  05/30/2009 - sent an email asking if there were any updates
#
#  06/01/2009 - received the following: "Sorry for the delay. I am
#               currently looking into this, and will reply in a couple
#               of hours time." (no signature)
#
#  06/04/2009 - nothing heard from vendor, and the private resource
#               containing the vulnerability info still does not
#               appear to have been accessed
#
#  2 weeks have passed since the initial notification. Vendor appears
#  uninterested.
#
#  Don't drink the Kool-Aid. None of these things are entirely true:
#  http://lxlabs.com/software/kloxo/security/
#
#  Some are just blatantly false. If you want proof, just keep
#  reading, but try not to fall asleep. These are mostly incredibly
#  trivial and boring issues.
#  
#####################################################################


#####################################################################
#  ISSUE #1 - uid/gid reuse
#####################################################################

Kloxo / Lxadmin allows unprivileged users to create and remove user
accounts. This is a common feature of the more popular webhosting
control, whereby the users with this privilege are referred to as
"resellers".

1. A reseller creates an account called "user1", which is automatically
assigned the next available uid and gid on the system (1012.1012 for
this example).

2. The reseller then logs into the user1 account, such as via FTP.

3. As user1, they upload a file, let's say to /home/user1/testfile

4. As user1, they copy or move testfile to /tmp

5. Now, as the reseller, they remove the user1 account. When the user1
account was removed, all of /home/user1 was destroyed. However, the
testfile file will still exist in /tmp, and will have the uid and gid
which user1 previously held (let's say 1012.1012).

6. The reseller then creates a new account, let's call it "user2".

7. "user2" now owns /tmp/testfile, because the uid and gid 1012.1012
were the next available ids.

The problem with this design is that the testfile could have been a
suid/sgid helper shell, with calls to setregid(1012,1012) and
setreuid(1012,1012), and the reseller could have waited for the next
account to be created. Once the new account was created (perhaps by
another reseller, or by root as a staff account, etc), the reseller
could execute the helper shell and have full access to the new user's
account.


#####################################################################
#  ISSUE #2 - unprivileged port use
#####################################################################

By default, Kloxo / Lxadmin uses multiple unprivileged ports: 7776,
7777, 7778, and 7779. In the event that a service responsible for
using those ports (kloxo.httpd and kloxo.exe) stops listening on
them, a local user can bind to the port, preventing kloxo from using
it until it is freed.

Note: not all ports were tested. This was tested simply by 1) stopping
kloxo, 2) listening on port 7777, and 3) attempting to restart kloxo.

kloxo did not attempt to take control of the port. 7777/7778 are the
login ports for kloxo, so a local user could craft an authentic looking
login page and obtain the username and password of the next person
attempting to log in.


#####################################################################
#  ISSUE #3 - default passwords
#####################################################################

"21232f297a" is the default password to the kloxo db, which contains
the base64 encoded admin password, which is more or less a user with
full root privileges.

"pass" is the default roundcube db password.

"admin" is the default password for the root account, and for the
admin account.

Are there more? Are these documented anywhere? Do all lxlabs products
contain default passwords?


#####################################################################
#  ISSUE #4 - useradd string in the process list
#####################################################################

When a new account is created via lxadmin / kloxo, the useradd string
appears in the process list, complete with password hash.


#####################################################################
#  ISSUE #5 - XSS
#####################################################################

Surely there are plenty more:

:7778/display.php?frm_action=XSS
:7778/display.php?frm_action=delete&frm_o_cname=XSS

The software does tie the user's IP address to the session, but this
could be problematic for people behind the same proxy, or those on
networks where non SSL based web traffic could appear to come from
any of a number of hosts at any given time (e.g., AOL. Do they still
do this? Are there others that do the same?).


#################