Exploiting FreeRealty Authentication Bypass

What this paper is

This paper details an authentication bypass vulnerability in the FreeRealty software, a free web application designed for real estate agents to list properties online. The author, Sid3^effects, discovered that by providing a specific string in both the username and password fields, an attacker could bypass the login mechanism and gain administrative access.

Simple technical breakdown

The core of the vulnerability lies in how the FreeRealty application handles user input during the login process. Instead of properly sanitizing or validating the username and password, the application likely incorporates the user's input directly into a database query. By using the SQL injection string ' or 1=1 or ''=', an attacker manipulates the query to always evaluate to true, effectively tricking the application into granting access without a valid username or password.

Complete code and payload walkthrough

The provided exploit is not a complex script with extensive code or shellcode. It is a simple, manual technique described by the author.

• Exploit Title: Authentication bypass in FreeRealty(Free Real Estate Listing Software)
• Date: 27-apr-2010
• Author: Sid3^effects
• Software Link: N/a (Vendor link provided: http://freerealty.rwcinc.net/)
• CVE: [] (Not specified in the paper)
• Code: [] (No code provided, only a technique)

The "code" or "payload" described is the specific string to be entered into the login fields:

' or 1=1 or ''='

Let's break down this string as if it were part of a SQL query:

• ': This likely closes a string literal that the application would have started for the username or password field in its SQL query. For example, if the query was SELECT * FROM users WHERE username = 'user_input', the ' would close the 'user_input' part.
• or 1=1: This is the core of the SQL injection. It introduces a logical OR condition. 1=1 is always true. So, the condition becomes username = '...' OR TRUE. In SQL, if any part of an OR condition is true, the entire condition is true.
• or ''=': This part is a bit redundant but serves to further ensure the condition is met, especially if the preceding or 1=1 is somehow neutralized or if the original query structure is slightly different. ''=' is also a tautology (always true) in many SQL contexts, especially when dealing with empty strings. It essentially adds another OR TRUE condition.

Mapping list:

• ': Closes the expected string literal in the SQL query.
• or 1=1: Introduces a condition that is always true, bypassing the original authentication check.
• or ''=': An additional, redundant condition that also evaluates to true, further ensuring bypass.

Execution Flow (Conceptual):

1. The user attempts to log in to agentadmin.php (or a similar login page).
2. The application constructs a SQL query to verify credentials, e.g., SELECT * FROM admin_users WHERE username = 'entered_username' AND password = 'entered_password'.
3. The attacker enters ' or 1=1 or ''=' into both the username and password fields.
4. The constructed SQL query becomes something like:
   SELECT * FROM admin_users WHERE username = '' or 1=1 or ''=' ' AND password = '' or 1=1 or ''=' '
5. Due to the OR 1=1 clauses, the WHERE condition evaluates to true for potentially any row in the admin_users table (or at least the first one it finds).
6. The application, seeing a successful query result, proceeds to grant access to the administrator panel.

Shellcode/Payload Segments:

There is no shellcode or executable payload in this exploit. The "payload" is purely the crafted string used for input.

Practical details for offensive operations teams

• Required Access Level: Typically, an attacker would need to be able to interact with the web application's login page. No prior authenticated access is required.
• Lab Preconditions:
  • A running instance of FreeRealty (or a similar version susceptible to this vulnerability).
  • A web browser to interact with the application.
  • Knowledge of the target application's login URL (e.g., http://target.com/freerealty/agentadmin.php).
• Tooling Assumptions:
  • A standard web browser is sufficient.
  • For more automated testing, a web vulnerability scanner or a custom script using libraries like requests (Python) could be employed to send the crafted POST request.
• Execution Pitfalls:
  • Web Application Firewall (WAF): Modern WAFs are highly likely to detect and block the ' or 1=1 pattern.
  • Input Sanitization: If the FreeRealty version has been patched or if the vendor implemented basic input filtering, this specific string might be neutralized.
  • Query Structure: The exploit relies on the application's specific SQL query construction. If the query is built differently (e.g., using prepared statements or different logic), the bypass might not work.
  • Case Sensitivity: Some database configurations or application logic might be case-sensitive, though OR is usually case-insensitive in SQL.
  • Database Type: While this is a common SQL injection technique, specific database systems might have minor variations in how they handle certain syntax.
• Tradecraft Considerations:
  • Reconnaissance: Identify the target application and its login page. Look for version information if possible.
  • Manual Testing: Start with manual testing in a browser to confirm the vulnerability before automating.
  • Obfuscation (Limited): For this specific exploit, obfuscation is difficult as the core OR 1=1 is hard to hide. However, one might try variations like ' OR '1'='1 or using different character encodings if the application is susceptible to those.
  • Post-Exploitation: Once authenticated, the attacker has administrative access to the FreeRealty system, allowing them to manage listings, potentially access user data, or use it as a pivot point.

Where this was used and when

• Context: This vulnerability was relevant to organizations using the FreeRealty software for their real estate listings.
• Approximate Years/Dates: The exploit was published in April 2010. Therefore, its active exploitation window would have been around that time and potentially for some period afterward until patches were applied or the software was updated/replaced.

Defensive lessons for modern teams

• Input Validation and Sanitization: This is the most critical lesson. All user-supplied input that is used in database queries must be rigorously validated and sanitized. This includes:
  • Parameterized Queries (Prepared Statements): This is the gold standard. It separates the SQL code from the data, preventing user input from being interpreted as executable SQL.
  • Escaping Special Characters: If parameterized queries are not feasible, all special characters that have meaning in SQL (like ', ", ;, --) must be properly escaped before being included in a query.
  • Allowlisting/Denylisting: Only permit expected characters or patterns in input fields.
• Principle of Least Privilege: Ensure that the database user account used by the web application has only the necessary permissions. It should not have administrative privileges.
• Regular Patching and Updates: Keep all web applications and their underlying frameworks updated to the latest secure versions.
• Web Application Firewalls (WAFs): While not a complete solution, WAFs can provide a layer of defense by detecting and blocking common attack patterns like SQL injection attempts. However, they can be bypassed.
• Security Audits and Code Reviews: Regularly audit web application code for security vulnerabilities.

ASCII visual (if applicable)

This exploit is a direct interaction with a web application's login form and its backend database query. An ASCII diagram can illustrate the flow of data and the manipulation.

+-----------------+      +-----------------+      +-----------------+
| Attacker's Input| ---> | Web Application | ---> | Database Query  |
| (Crafted String)|      | (Login Page)    |      | (Manipulated)   |
+-----------------+      +-----------------+      +-----------------+
                                   |
                                   | (Bypassed Authentication)
                                   v
                           +-----------------+
                           | Admin Access    |
                           +-----------------+

Explanation:

The attacker's input, the crafted string ' or 1=1 or ''=', is sent to the web application's login page. The application then uses this input to construct a database query. Instead of a valid query that checks for a specific username and password, the injected string causes the query to become a condition that is always true. This bypasses the authentication mechanism, granting the attacker administrative access.

Source references

• Paper Title: FreeRealty(Free Real Estate Listing Software) - Authentication Bypass
• Author: Sid3^effects
• Published: 2010-04-27
• Exploit-DB Paper ID: 12411
• Exploit-DB Raw URL: https://www.exploit-db.com/raw/12411
• Vendor URL (as per paper): http://freerealty.rwcinc.net/

Original Exploit-DB Content (Verbatim)

# Exploit Title: Authentication bypass in FreeRealty(Free Real Estate Listing Software)
# Date: 27-apr-2010
# Author: Sid3^effects
# Software Link: N/a
# CVE : []
# Code : []                   ______________________________________________________________________________                               Authentication bypass in FreeRealty
                       Vendor:http://freerealty.rwcinc.net/
      ___________________________Author:Sid3^effects_________________________________
  

Description :

 Free Realty  is primarily designed for real estate agents and offices to list properties on the internet. With Free Realty the end user does not need to be fluent in web page design.
 

script cost :Free
---------------------------------------------------------------------------
	* Authentication bypass:

	The following script has authentication bypass.

	use ' or 1=1 or ''=' in both login and password.

DEMO :http://[site]/demo/agentadmin.php


ShoutZ :
------- 
               ---Indian Cyber warriors--Andhra hackers-- 

Greetz :
--------
 ---*L0rd ÇrusAdêr*---d4rk-blu™® [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--