- November
- 6th
- 2008
Wataniya.mv vulnerabilities and exploits
ROL isn’t bothering me at all now I’ve got 4mb internet connection. Few months back I was checking www.wataniya.mv, I don’t know why but I started browsing all the pages they had. HTML and simple UI, nothing much to offer as we seen in Dhiraagu. Nothing to blame, as I’ve noticed these guys were more secure than Dhiraagu. Security isn’t much of a concern to Wataniya.
Simply I browsed the media page and then to pressroom archive. While I was Hovering each and every link the from 1st june 2008 onwards they had given direct links to the PDF files(the press releases). The days behind 28th may 2008 were given a PHP file “download_sis.php” and a variable SIS to download the PDF i.e “download_sis.php?sis=media/pressrelease-21may2008-talkchoice.pdf” and so on. This isn’t something huge but yes vulnerability is there to Wataniya. This file download_sis.php can be used to download any files in the server. Ok now you do have a question. Why the hell do I need to download some static HTML’s? According to my php knowledge this was indeed vulnerability in the site. A normal user can call for files in the server.
Alright let me tell you why this is not safe. “download_sis.php?sis=download_sis.php” got my point. PHP pages are server side scripts. If you try to save them there’s no way to get the original code thus you get the out from the server which is the HTML.
<?php
$filename = $_GET['sis'];
if( ! is_file($filename) || $filename[0] == ‘.’ || $filename[0] == ‘/’ )
die(”Bad access attempt.\n”);
$file = explode(’.', $filename);
//if($file[1] != ’sis’) die(’Could not download selected file.’);
header(”Pragma: public”);
header(”Expires: 0″);
header(”Cache-Control: must-revalidate, post-check=0, pre-check=0″);
header(”Content-Type: application/force-download”);
header(”Content-Type: application/octet-stream”);
header(”Content-Type: application/download”);
header(”Content-Disposition: attachment; filename=”.basename($filename).”;”);
header(”Content-Transfer-Encoding: binary”);
header(”Content-Length: “.filesize($filename));
readfile(”$filename”);
exit();
?>
That’s the code I’ve downloaded from the download_sis.php file. Basically it checks for whether the typed file exists or not. If the file exists it send the browser the request to download it, else it gives an error message saying “Bad access attempt”. Well the mistake here is they should have mentioned that only PDF files can be downloaded in the coding, as validation or other PHP validations could have been applied.
Still feels it’s not a security measure we can leave, well think again. Linux shadow password file is what you should be looking for “/etc/passwd” Just keep in mind if u get to that file you probably can do some damage.
You have probably got an image here. As I said I was browsing the whole site. I went to the Contact Us page. I tried submitting an enquiry. Filled all the fields they had and tried to send a prank one. As you all know sending an email requires server side support. So I tried submitting my “prank” message. The form was submitted to a file “mail.php”.
A php warning came along:
Warning: fsockopen(): php_hostconnect: connect failed in /var/www/html/wataniya/contactus/class.smtp.php on line 105
Warning: fsockopen(): unable to connect to 10.10.9.2:25 in /var/www/html/wataniya/contactus/class.smtp.php on line 105
Message could not be sent.
Mailer Error: Language string failed to load: connect_host
We can download the mail.php file too. But the important thing here is about the error. An error can give us lots of information. As we can see above, the structure of the site is clearly showed in the error.
As far as the mail php application is concerned, they have lots of SMTP information in those mail files.
Well after everything we have seen above, this is indeed a huge vulnerability for Wataniya and its online server. This should have been taken cared by the Wataniya administrators. Without the use of easy PHP validations they have come up with this exploit. Making it more easier for any one to get into their private data. A telecommunication company user information should be secured. So just think what if this server is connected to their main frame(just in case), what are the out puts of this whose gonna take responsible for just a simple validation they missed out. Am not an expert but figuring out this puzzle was what piece of cake. Yeah.
Drop me a line if you were able to do anything with my information given above. And one last thing am not even 18 I cant take any responsibilities don’t come and scratch my head with “cyber crime unit”. I’ve got better things to do than this. Please take a note that information given above is only ment to be used as educational purpose only.
UPDATE:
They have removed the file download_sis.php, now that was fast. -_-
keke … 
(but keep them flicking the pics are awsome) ;). So I guess you still have to use mvblogs.org for flickr pix :).
. Hehe and by the way I am an satisfied google customer and I have the following video by gmail theater check it out.
