[ADVISORY] Kusaba X = 0.9.2 0-DAY ARBITRARY FILE UPLOAD

Discussion in 'Hard Gay Shitpost Metropolis' started by Xero, Jul 26, 2011.

  1. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    1. Get admin somehow (CSRF, social, already have it and hate the other admins)
    2. add filetypes PHP and HTACCESS to any board
    3. upload .htaccess allowing CGI execution
    4. upload shell
    5. ???
    6. PROFIT!

    Severity:
    KX <= 0.9.1: CRITICAL, can possibly result in full system compromise when paired with the CSRF in manage.class.php
    KX 0.9.2 and Anonsaba 0.1.5 RC2: low/moderate, don't be stupid and you should be ok

    UPDATE Jul 28 - Anonsaba 0.1.5 RC3: apparently not totally fixed, low severity, overwriting files possible. Upgrade to RC4.


    This exploit effectively renders Kusaba X 0.9.1 completely fucked, as if it wasn't already. 0.9.2 is also affected, but the exploit has less impact due to the inability to give oneself admin privileges.

    Affects Anonsaba 0.1.5 RC2 and older
    - Fixed in RC3, after I burned it on rockstarchan.org which is why I'm releasing it
    - Make sure you trust your admins!!!
    Affects Kusaba X 0.9.2 and older
    - Upgrade to 0.9.3 IMMEDIATELY, released as response to this advisory
    - Make sure you trust your admins!!!
    Possibly affects ALL versions of Kusaba and Futaba?
    Disclaimer: I claim no responsibility for what you do with this information.

    Chans h4x0r3d by people using this so far:
    • Rockstarchan
    • 000chan
    • n0chan
     
  2. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    lol some know all about this
     
  3. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    rat a tat tat
     
  4. Vyktor

    Vyktor
    Expand Collapse
    Dramacrat

    Joined:
    Jul 19, 2011
    Messages:
    229
    Then he ran out of bullets and he ran away...
     
  5. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    gimme dem
     
  6. Vyktor

    Vyktor
    Expand Collapse
    Dramacrat

    Joined:
    Jul 19, 2011
    Messages:
    229
    Combo breaking faggot.
     
  7. Rock

    Rock
    Expand Collapse
    Girlvinyl

    Joined:
    Jul 15, 2011
    Messages:
    4,645
    Occupation:
    Pretty boy swag'n
    Home Page:
    Well now, that's a whole lotta text
     
  8. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    HOLY SHIT IS THIS A ZERO DAY
     
  9. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    lol yes
     
  10. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    EXCUSE ME I MEANT XERO DAY LOLOLOL IMA GENIUS
     
  11. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    HEY I WANT SOME FUCKING ICONS UNDER MY NAME

    AND WHO YOU CALLING A NEWFAG

    AND LOL AT SHARE THIS PAGE, dox traps everywhere
     
  12. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    my only response to this is "dongs"
     
  13. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    loldongs is my pw irl
     
  14. NekoArc

    NekoArc
    Expand Collapse
    Dramacrat

    Joined:
    Jul 14, 2011
    Messages:
    37
    Occupation:
    Webmaster
    Home Page:
  15. Sazpaimon

    Sazpaimon
    Expand Collapse
    Dramacrat

    Joined:
    Jul 26, 2011
    Messages:
    2
    Sorry to burst your bubble, but how is this even an exploit? If you had admin, you could just delete every board anyway, or use the SQL panel to do SELECT 'shell script here' INTO OUTFILE whatever and run that.
     
  16. Emily

    Emily
    Expand Collapse
    BANNED LOL

    Joined:
    Jul 14, 2011
    Messages:
    2,417
    Rockstarchan is still down.
     
  17. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
  18. interpolate

    interpolate
    Expand Collapse
    Ediot

    Joined:
    Jul 26, 2011
    Messages:
    22
    lol what a tard, signed up to get trolled love it
     
  19. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    Actually, proper fs permissions (and most sane web hosts) will disallow select into outfile.
     
  20. Sazpaimon

    Sazpaimon
    Expand Collapse
    Dramacrat

    Joined:
    Jul 26, 2011
    Messages:
    2
    Shows what I know about webhosting and mysql (I deal in dedis and use postgres almost exclusively). Still think this is a pretty weak exploit, and imo if you're stupid enoug to not secure your admin password and/or have 8 million retarded admins you deserve to get rooted. On the plus side, I used this as an opportunity to release 0.9.3 which fixes this little bug (I actually had a fix for this sitting in trunk for about 2 years that somehow never managed to find its way into the stable branch) and replaces our aging captcha system which is super easy to OCR (thanks for that too, by the way)
     
  21. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    Great response to vulnerability (both of them), 1 day to fix, unlike most vendors who would take months. Respect.
     
  22. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    ehhhh, it's actually, as Saz pointed out, kind of a weak bug unless you're still on KX0.9.1
    Anyone using that is totally screwed though.
     
  23. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    edited a bit
     
  24. Emily

    Emily
    Expand Collapse
    BANNED LOL

    Joined:
    Jul 14, 2011
    Messages:
    2,417
  25. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
  26. rst8

    rst8
    Expand Collapse
    EDF Elite

    Joined:
    Jul 16, 2011
    Messages:
    3,642
    you guys are being nerds
     
  27. Emily

    Emily
    Expand Collapse
    BANNED LOL

    Joined:
    Jul 14, 2011
    Messages:
    2,417
    You are a nerd already by browsing ED(f)
     
  28. rst8

    rst8
    Expand Collapse
    EDF Elite

    Joined:
    Jul 16, 2011
    Messages:
    3,642
    no it doesnt you nerd
    go do my homework to feel like you are actually popular
    BUT YOUR NOT
     
  29. Xero

    Xero
    Expand Collapse
    JESUS CHRIST ITS A TIGER GET IN THE CAR

    Joined:
    Jul 14, 2011
    Messages:
    289
    Occupation:
    LOOK AT ME IM A FUCKING WHITE TIGER FUCK YOU
    Home Page:
    brb hacking ur gibsons
     
  30. rst8

    rst8
    Expand Collapse
    EDF Elite

    Joined:
    Jul 16, 2011
    Messages:
    3,642
    i dont have a gibson rtrd i have a fender