Hi Folks,
this morning I wanna point out a very useful (ok, it depends 🙂 ) vulnerability found inside some PHP Downloader. First of all Let me say what is a vulnerability: ” We call vulnerability a bug with security implications ” . So if your code has a bug probably it could be vulnerable at some kind of attacks. In this particular scenario the code looks like that:

No controls on file type, no controls on location. Just give the file’s name and the file’s path and it’ll open it in read mode. This is a bug. Why this bug can been considered Vulnerability ? Because if you ask some specific System’s files to this downloader implementation, it will give you every files you want.
Just for example you can try with the following URI (maybe someone has been fixed):

http://www.mpbp.gov.my/download.php?file=download.php
http://elearning.mmu.edu.my/download.php?file=download.php
http://www.utem.edu.my/fkp/latihanIndustri/download.php?file=../../../../../../etc/passwd
http://www.moe.gov.my/pipp/download.php?filename=/../../../../../../etc/passwd

One of the previous URI gave me the following file which shows the passwd file of the machine. Here it is.

As you may see, from the users names, it’s very easy to figure out which kind of services the machine has. For instance the machine runs clam AntiVirus, ssh server, virtual console, MySQL and so forth. For the most experts of you, it’s easy forging this request exploiting the server asking for passwords’ file and/or for system’s files… Thanks to google, this bug which is just became a Vulnerability; can reach the MassVulnearbility status and – if coded inside a script – (for instance a perl script) it can become a Massive Exploit. Why I’m saying that ? Using google it’s easy to find lots of different pages affected to this bug. Just typing : inurl:”download.php?file=*.pdf” you will find lots of download.php file. Now try to change some parameters on the URI bar and here we are ! You’ve just found plenty of vulnerable downloader scripts. Well, this post doesn’t want teaching how to overuse this Vulnerability, it doesn’t want teaching hacking and/or how to break security too. I wanna only say -through it- that, not every bug is a vulnerability and also not every vulnerability comes from a bug (let think to Social Engineering), BUT most of vulnerabilities come from developer and/or programming mistakes. For this reason it so important don’t sleep a code…. trying to avoid this elementary security mistakes…. and it’s so important having a good software engineering project behind your shoulders able to prevent and, at least, to correct quickly these mistakes.

Published by marcoramilli

Ethical Hacking, Advanced Targeted Attack Expert and Malware Evasion Expert

28 thoughts on “ PHP Downloader Vulnerability ”

  1. hi every person,

    I identified marcoramilli.blogspot.com after previous months and I'm very excited much to commence participating. I are basically lurking for the last month but figured I would be joining and sign up.

    I am from Spain so please forgave my speaking english[url=http://thehottesttopicsfo.info/].[/url][url=http://palatesttrends.info/forum].[/url][url=http://sportsnewste.info/].[/url]

  2. example rooms
    [url

    cheap hotel websites
    [/url]booking class
    hotels search
    tiffany figure hostelry
    [url=http://www.earthday.org/users/48490]cheap rates for hotels
    [/url]pensione bed
    grant-in-aid reasonable
    kenya airways online booking
    [url=http://www.fairview.org/cty/members/klemot/default.aspx]find hotel prices
    [/url]booking of hotel
    cut-price ps3
    lousy houses america
    [url=http://www.youthcabinet.org/profile/Josh]hotel price bot
    [/url]agile phones deals
    bed prices from
    tinpot hotels near disneyland
    [url=http://www.beautyresearch.com/blogs/alexa/archive/2010/08/15/hotels-and-accomodations.aspx]maldron hotel
    [/url]right to bribe
    asiana airlines saving class
    levico terme
    [url=http://www.mazdacommunity.com/profiles/blogs/special-hotel-offers-or]cheap niagara falls hotels
    [/url]at house in spain
    catalyst housing
    carefree booking

  4. harry potter movie 6 [url=http://moviestrawberry.com/films/film_men_of_war/]men of war[/url] gossip girls movie http://moviestrawberry.com/films/film_gone/ the great dictator movie
    the movie gameplan [url=http://moviestrawberry.com/films/film_the_pacific_and_eddy/]the pacific and eddy[/url] cameos in across the universe movie http://moviestrawberry.com/films/film_the_wings_of_the_dove/ anime download free movie
    adult movie gallaries [url=http://moviestrawberry.com/films/film_the_self_destruction_of_the_ultimate_warrior/]the self destruction of the ultimate warrior[/url] pulse movie
    bikini bistro movie trailer [url=http://moviestrawberry.com/films/film_winter_of_frozen_dreams/]winter of frozen dreams[/url] camden maine movie theater http://moviestrawberry.com/films/film_repli_kate/ movie nightmare
    aim movie help [url=http://moviestrawberry.com/films/film_invincible_70/]invincible 70[/url] movie facts http://moviestrawberry.com/films/film_ghost_lake/ download movie onto final cut pro

  5. health care 2020 corning [url=http://usadrugstoretoday.com/products/arimidex.htm]arimidex[/url] teeth stain and antibiotics http://usadrugstoretoday.com/products/requip.htm
    free online drug reference book [url=http://usadrugstoretoday.com/categories/antidepressivum—anti-angst.htm]antidepressivum anti angst[/url] health policy decisions value based [url=http://usadrugstoretoday.com/products/requip.htm ]quick review of pharmacy [/url] antibiotics sheep
    internet pharmacy sales in pa [url=http://usadrugstoretoday.com/products/kamasutra-ribbed-condoms.htm]kamasutra ribbed condoms[/url] red gold the epic story of blood http://usadrugstoretoday.com/products/zofran.htm
    anti aging drugs [url=http://usadrugstoretoday.com/categories/artritis.htm]artritis[/url] costo pharmacy [url=http://usadrugstoretoday.com/categories/weibliche-verstarkung.htm ]purchase stanozolol pharmacy rx on line [/url] viagra cialis generic

  7. disney movie princess enchanted tales follow your dreams jpeg [url=http://worldmovs.co.cc/full_version-hitman/9175database/]Hitman[/url] little mermaid movie [url=http://worldmovs.co.cc/full_version-kill-buljo-the-movie/4467database/]Kill Buljo The Movie[/url]
    animals movie utah [url=http://worldmovs.co.cc/full_version-run-fat-boy-run/11253database/]Run Fat Boy Run[/url] the former mustang drive in in al in a movie [url=http://full-length-movies.com/dvd-quality-movie-freddy-vs-jason/28809database/]Freddy Vs Jason[/url]
    tenacious d movie trailer [url=http://worldmovs.co.cc/full_version-legally-blonde/14652database/]Legally Blonde[/url] disney movie cars [url=http://full-length-movies.com/dvd-quality-movie-mama-s-boy/16491database/]Mama's Boy[/url]
    movie clips of pamela anderson [url=http://full-length-movies.com/dvd-quality-movie-el-arcangel/13819database/]El Arcangel[/url] sex movie gallaries [url=http://worldmovs.co.cc/full_version-manolito-gafotas/17570database/]Manolito Gafotas[/url]

  8. хорошая статья, побольше таких писать! Автору респект

  9. хорошая статья, побольше таких писать! Автору респект

  10. nicole mason sex porn forums http://theporncollection.in/orgasm/hard-core-orgasm
    [url=http://theporncollection.in/orgy/homemade-amateur-orgy]global porn[/url] ruptured anal gland dog [url=http://theporncollection.in/hentai-porn/amy-hentai]amy hentai[/url]
    japan adult movie http://theporncollection.in/free-hentai/su-kaolla-hentai
    [url=http://theporncollection.in/gay-xxx/x-demon-gay-cigarette-smoking-fetish]lexi belle dildo[/url] adult flag football [url=http://theporncollection.in/gay-movie/anti-gay-marriega]anti gay marriega[/url]
    adult art classes oswego ny http://theporncollection.in/hentai-porn/kenshin-doujinshi-scans-hentai
    [url=http://theporncollection.in/gay-video/medical-fetish-pictures-gay]watch free hentai videos online[/url] teens try anal [url=http://theporncollection.in/mature-xxx/mature-housewife-movies]mature housewife movies[/url]
    coulpe porn http://theporncollection.in/porn-galleries/porn-star-working-for-fox
    [url=http://theporncollection.in/lesbian-xxx/lesbian-communities]avril lavenge porn[/url] real free porn videos [url=http://theporncollection.in/hentai-sex/streaming-hentai-vids]streaming hentai vids[/url]

  13. travel frames http://livetravel.in/lufthansa/which-is-better-airbus-boeing travel study services
    [url=http://livetravel.in/inn/howard-johnson-inn-kissimmee-maingate-east]how is river travel[/url] canadian travel to us [url=http://livetravel.in/tours/monmouthshire-tours]monmouthshire tours[/url]
    best travel websites flights http://livetravel.in/tourist/perpetual-tourist
    [url=http://livetravel.in/tour/north-italian-lakes-tour]small travel pouches[/url] travel brochure template [url=http://livetravel.in/expedia/expedia-car-rental]expedia car rental[/url]
    cheapest time to travel to paraguay http://livetravel.in/plane-tickets/cheap-plane-tickets-discount-travel-online-reserva
    [url=http://livetravel.in/expedia/discount-travel-online-booking-cheap-airfare-expedia-flights]travel fitness equipment[/url] adult diapers travel [url=http://livetravel.in/inn/comfort-inn-calgary]comfort inn calgary[/url] sato travel airline tickets [url=http://livetravel.in/airlines/continental-airlines-incoming-flight-information]continental airlines incoming flight information[/url]
    travel from buenos aires to iquazzu [url=http://livetravel.in/airline/airline-cheap-international-ticket-travel]airline cheap international ticket travel[/url]
    travel about lightweight stroller http://livetravel.in/inn/holiday-inn-express-hotel-and-suites-seabrook-tx
    [url=http://livetravel.in/vacation-packages/vacation-package-harrahs-new-orleans]first aid kit and travel[/url] vaccinations for travel to india fco [url=http://livetravel.in/tourist/colorado-tourist-garden-of-the-gods]colorado tourist garden of the gods[/url]
    [url=http://livetravel.in/travel/long-travel-suspension]long travel suspension[/url] alaska air travel [url=http://livetravel.in/adventure/bookworm-adventure-tips]bookworm adventure tips[/url] arc benefitsn as travel agent [url=http://livetravel.in/vacation-packages/hanalei-bay-resort-car-package-vacation]hanalei bay resort car package vacation[/url]
    last minute travel deals by departure [url=http://livetravel.in/vacation-packages/puerto-rico-vacation-package-htm]puerto rico vacation package htm[/url]

  14. http://meen.in/fluocinolone/what-is-fluocinolone-acetonide-tropical-solution-used-for
    [url=http://meen.in/erythromycin/erythromycin-vs-retin-a-micro]viagra find online pages edinburgh free[/url] buy viagra in the uk [url=http://meen.in/escitalopram/escitalopram-no-prescription]escitalopram no prescription[/url]
    pharmacy schools and data http://meen.in/fluocinolone/fluocinolone-acetonide-cream
    [url=http://meen.in/escitalopram/citalopram-escitalopram-uk]cialis generic pharmacy[/url] vitamins and herbs for erectile dysfunction [url=http://meen.in/felodipine/felodipine]felodipine[/url]
    drug lipitor prescription http://meen.in/cleocin/do-not-lie-down-for-at-least-30-minutes-cleocin
    [url=http://meen.in/ezetimibe/virgil-brown-ezetimibe-2008]lenox pharmacy massachusetts[/url] ramipril drug interactions [url=http://meen.in/flonase/effect-flonase-side]effect flonase side[/url] addicted to drugs [url=http://meen.in/erection/spheric-tank-erection]spheric tank erection[/url]

  15. overdosing by smoking tobacco [url=http://usadrugstoretoday.com/products/stress-relief.htm]stress relief[/url] the national center for posttraumatic stress disorder http://usadrugstoretoday.com/products/zofran.htm dental adenoma on jaw http://usadrugstoretoday.com/products/ed-discount-pack-3.htm
    city on a diet [url=http://usadrugstoretoday.com/categories/antibiotics.htm]antibiotics[/url] orgasm spankwire [url=http://usadrugstoretoday.com/categories/stop-smoking.htm]can stress change your emotions[/url]

  16. Хорошая статья. Действительно было интересно почитать. Не часто такое и встречается та.Наверное стоит подписаться на ваше RSS

  18. Подскажите, а у вас сквозную ссылку купить можно? Если да, сообщите цену на мыло, пожалуйста?

  19. Мульти портал. Есть все, почти всё. Немного из навигации сайта.

    [url=http://pi7.ru/video/]Видео для взрослых[/url]
    ————————————— |
    Анекдотик, не помешает… 🙂
    Она и он. Она:
    – Хочу [url=http://pi7.ru]секса[/url]… Ну очень хочу! На 2 часа не меньше! Вот ты можешь два часа?
    – Ну конечно могу!
    – А можно нескромный вопрос… Ты будешь во время [url=http://pi7.ru]секса[/url] кричать?
    – Да, от ужаса…
    – Почему?
    – Потому, что я уже всё, а до конца секса ещё 1 час 50 минут!

    блуждала по сети , [URL=http://pi7.ru][IMG]http://pi7.ru/12.gif[/IMG][/URL]

  20. У нас в жж за такой пост бы закидали какашками в каментах:)

  21. [b]Автоспутник Украина[/b]

    Внесены уточнения дорожной сети и адресной базы городов Киев и Днепропетровск.
    Добавлены отсутствующие сегменты трассы Харьков – Днепропетровск.
    Добавлена подробная дорожная сеть во всех населенных пунктах Киевской области: Бровары, Ирпень, Боярка, Вишневое, Фастов, Украинка, Обухов, Васильков, Узин, Белая Церковь, Сквира, Тараща, Богуслав, Мироновка, Кагарлык , Ржищев, Яготин, Переяслав-Хмельницкий, Березань. В данных городах частично присутствуют названия улиц, информация о запретах проезда не учитывается.
    Добавлена база данных: 120 камер-радаров и 783 передвижных поста ГАИ/ДПС. За 400 метров Автоспутник выдаст визуальное и звуковое предупреждение.

    [url=http://info.je1.ru/GPS_032.html]Подробнее…[/url]

  24. [color=#808080]
    Как дела? Может-быть… есть cупер мысль по[url=http://www.pi7.ru] видео[/url] порталу Думаю вам понравится

    [url=http://www.pi7.ru]девочки в бане[/url]
    aнекдот для разнообразия 🙂

    Сидят два деда в куста, испражняются. Один другому:
    – А помнишь, рагьше, время было, яйца то до земли доставали.
    – Да, ослеа земля, осела.

    Я 7 часво блуджала по сети, пока не вышела на ваш форум! Дмуаю, я здесь останусь надолго!
    прошу прощенря за опечатки…. очень амленькая клавиатура у PDA!

    [/color]

  25. [color=#808080]Музыкальный ансамбль [url=http://dejavu-group.ru/artist.php]Dejavu-group[/url] – это коллектив дипломированных вокалистов и музыкантов на праздник.
    [url=http://dejavu-group.ru/svadba.php]Deja Vu[/url]- лидер в области организации и проведения свадеб, дней рождения, корпоративных вечеров, шоу программ.
    В копилке Музыкантов Deja Vu более 3000 песен.
    Живая музыка. Поп, хиты 70-80-90-х, диско, джаз, ретро, современная музыка, европейские хиты, фоновая музыка, шансон .
    Музыкальная группа Дежа вю обладает мощной качественной музыкальной аппаратурой, которая позволяет заполнить плотным и приятным уху звуком как маленькое помещение (фуршет), так и огромное помещение (корпоратив до 1000 человек).

    Андрей +7 910 483 8294 [/color]

  27. miley cyrus nude [url=http://crystal-liu.com/forums/index.php?showuser=1113]miley cyrus nude[/url] miley cyrus sex tape [url=http://forum.ondertitel.com/index.php?showuser=74503]miley cyrus sex tape[/url] miley cyrus nude [url=http://stabilo.forumsunlimited.com/index.php?showuser=799]miley cyrus nude[/url] miley cyrus nude [url=http://ragga-jungle.com/user/15036-vebsterd]miley cyrus nude[/url] kim kardashian nude [url=http://forums.quark.com/members/vebsterd.aspx]kim kardashian nude[/url]

  28. Speaking about avoiding this coding mistake… a solution could be proxing the download request through a file list/database; i.e. having on a database a list of the downloadable files and hence getting the file path by the means of an id. Creating a loophole in a upper system level to expose some convenience feature of underlying levels it is a very bad, bad idea and practice; if you think you definitely need it, well, think again.As always an interesting post 😉 rising the level of security awareness. Keep up with the good work!

Comments are closed.