OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Re: Arbitrary code execution in eping plugin

From: Sam Michaels (samthecomputermangmail.com)
Date: Mon Jun 13 2005 - 01:36:32 CDT

On 11 Jun 2005 20:15:09 -0000, olivercodersquad.de
<olivercodersquad.de> wrote:
> So only IP-Adresses are allowed and no kind of code injection is possible.

I'm unfamiliar with this particular program, so forgive me if I'm way
off base...however...give this a try:

function eping_validaddr($eping_hosttocheck)
{
  return ip2long($eping_hosttocheck);
}

On a failure, it will return (int)-1 or (bool)FALSE depending on your
PHP version. Before doing the actual ping, you'll want to grab the
result of eping_validaddr() and run it through long2ip() as a final
step of validation. Example:

$exploit = long2ip(ip2long('127.0.0.1;commands%20here'));

It will populate $exploit with (string)"255.255.255.255" (just
ip2long() alone on that returns -1 in PHP4 or FALSE in PHP5).

Sam