Title: ====== Free Monthly Websites v2.0 - Multiple Web Vulnerabilities
Date: ===== 2013-02-04 References: =========== http://www.vulnerability-lab.com/get_content.php?id=851 VL-ID: ===== 851 Common Vulnerability Scoring System: ==================================== 8.5 Introduction: ============= Free Monthly Websites 2.0 is here and you no longer have to worry about editing complicated HTML code as we have taken care of that for you, and you no longer have to worry about anything to do with website design as we have taken care of that for you too, adding your Google AdSense Publisher code, taken care of, ClickBank! All done for you, here\\\'s how it works. Upload Your Site To Your Domain (this can be done for you). Login To Your Admin Control Panel. Personalize Your Website (takes just 5 minutes). (Copy of the Vendor Homepage: http://www.freemonthlywebsites2.com/ ) Abstract: ========= The independent Vulnerability Laboratory researcher (x-Cisadane) discovered multiple web vulnerabilities in the Free Monthly Websites v2.0 CMS. Report-Timeline: ================ 2013-02-04: Public Disclosure Status: ======== Published Exploitation-Technique: ======================= Defensiv Severity: ========= Critical Details: ======== Multiple web vulnerabilities are detected in the Free Monthly Websites v2.0 Content Management System. The first bypass vulnerability allows attackers to bypass the system web application auth of the admin login. The secound vulnerability allows to upload for example webshells and access them after upload via unauthorized web access. Vulnerable Module(s): [+] Login Auth (Admin) - Bypass [+] Upload File - Unauthorized File Upload & Access Proof of Concept: ================= The vulnerabilities can be exploited by remote attackers without required user interaction or privileged application user account. For demonstration or reproduce ... Dork(s): inurl:/index_ebay.php "Powered by: Resell Rights Fortune" "Generating Traffic to Your Site with Keyword Based Articles" Powered By: Free Monthly Websites 2.0 [ 1 ] Admin Login Bypass Vulnerable page http://target.com/[path]/admin/index.php Line 40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()"> 41 <input type="hidden" name="do_type" value="admin_settings_read"> Vulnerable page http://target.com/[path]/admin/login.php Line 40 <form name="frm" action="file_io.php" method="post" onSubmit="return chk()"> 41 <input type="hidden" name="do_type" value="admin_settings_read"> Vulnerable page http://target.com/[path]/admin/file_io.php Line 14 if($_REQUEST[do_type]=="admin_settings_read") 15 { 16 $filename="settings/admin_settings.txt"; 17 18 if(!$handle = fopen($filename, 'r')) 19 { 20 echo "Cannot open file ($filename)"; 21 exit; 22 } 23 $contents = fread($handle, filesize($filename)); 24 fclose($handle); 25 $argument_arr=explode("#_1_#",$contents); 26 27 if($argument_arr[0]==$_REQUEST[username] && $argument_arr[1]==$_REQUEST[pass]) 28 { 29 $_SESSION[logged_in]=true; 30 header("location:welcome.php"); Based at line 16 we know that Admin Username and Password store in admin_settings.txt NOT on Database! So When we login into Admin Panel, file_io.php will Read Valid Username and Password from admin_settings.txt If you do a direct access to the file admin_settings.txt, The results is 403 Permission Denied You do not have permission for this request /admin/settings/admin_settings.txt Picture: http://i48.tinypic.com/2gvlwt4.png So... How to Bypass Admin Login Page? 1st. Open the Admin Login Page : http://target.com/[path]/admin/index.php Live Target : http://www.massmoneywebsites.com/admin/ 2nd. Inspect Element on the login Form. Picture: http://i47.tinypic.com/2r5ddp1.png 3rd. Change from <form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form> <input type="hidden" name="do_type" value="admin_settings_read"> CHANGE TO <form name="frm" action="file_io.php" method="post" onsubmit="return chk()"></form> <input type="text" name="do_type" value="admin_settings_write"> Then press ENTER (please see pic). Pic : http://i49.tinypic.com/351z3ib.png 4th. You will see A Login Failed Page : >> You need to login in to access that page << Picture: http://i50.tinypic.com/33ws8jb.png Never Mind About that, just click 'Login Button' and VOILA you get and Admin Access! Picture: http://i45.tinypic.com/jzwpea.png ---------------------------------------- [ 2 ] Upload PHP Backdoor or PHP Shell This vulnerability works on PREMIUM VERSION of Free Monthly Websites 2.0 So... How to Upload Backdoor (PHP Shell)? 1st. Go to Add/Remove Navigation Page. http://target.com/[path]/admin/add_main_pages.php Live Target : http://www.massmoneywebsites.com/admin/add_main_pages.php 2nd. Enter a Name For Your New Navigation Page That You Wish To Add: dwi.php And click Add New Navigation Page. Picture: http://i45.tinypic.com/vigzsp.png 3rd. Still at the same page, scroll down the page until you see this section : Sort Your Page Buttons/Links. Pic : http://i46.tinypic.com/1040oxg.png Change FROM dwi.php.html TO /dwi.php then Click Sort Navigation Pages. Picture: http://i49.tinypic.com/24ec1l0.jpg 4th. Go to Edit Navigation Page. http://www.massmoneywebsites.com/admin/edit_main_pages.php Please Select a Page To Edit: dwi.php.html <--- Select that page. 5th. Inspect element on dwi.php.html Pic : http://i50.tinypic.com/29pq1ix.png Change FROM <option value="dwi.php.html" selected="">dwi.php.html</option> To <option value="dwi.php" selected="">dwi.php</option> Picture: http://i47.tinypic.com/wtb0j6.png 6th. Enter A Page Title As You Would Like It To Be Seen. Fill with dwi.php URL For This Page: main_pages/dwi.php Use the 'URL For This Page' field above: [Tick] Display This Page in Left Vertical Site Navigation: [Tick] Display This Page in Top Horizontal Site Navigation Buttons: [Tick] Picture: http://i46.tinypic.com/1zebnle.png 7th. Still at the same page, scroll down the page until you see this section : Enter Content For Your Page: Click SOURCE button Press Enter Twice at the First Line then Paste your PHP Backdoor/PHP Shell below. And Press Enter Twice at the Last Line. *Please see 2 Pictures below If you dunno Understand :p Picture 1 : http://i49.tinypic.com/1zlzxq0.png Picture 2 : http://i48.tinypic.com/291kc9h.png If you wanna do this, please remove your backdoor password. Click Save edited navigation page. 8th. After this message >> Data saved successfully << Appeared, Visit the Home Page and you will see the Backdoor Page Picture : http://i49.tinypic.com/4rt1g4.png Risk: ===== The security risk of the unauthorized file upload vulnerability via auth bypass is estimated as critical. Credits: ======== X-Cisadane - (stefanus...@ymail.com) Greetz 2: X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club and Ngobas Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: ad...@vulnerability-lab.com - supp...@vulnerability-lab.com - resea...@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (ad...@vulnerability-lab.com or supp...@vulnerability-lab.com) to get a permission. Copyright © 2012 | Vulnerability Laboratory -- VULNERABILITY RESEARCH LABORATORY LABORATORY RESEARCH TEAM CONTACT: resea...@vulnerability-lab.com
