[39136] in bugtraq
Re: Arbitrary code execution in eping plugin
daemon@ATHENA.MIT.EDU (Sam Michaels)
Mon Jun 13 13:59:20 2005
Message-ID: <4a477e9e05061223362f3af9cf@mail.gmail.com>
Date: Mon, 13 Jun 2005 02:36:32 -0400
From: Sam Michaels <samthecomputerman@gmail.com>
Reply-To: Sam Michaels <samthecomputerman@gmail.com>
To: "oliver@codersquad.de" <oliver@codersquad.de>
Cc: bugtraq@securityfocus.com
In-Reply-To: <20050611201509.27599.qmail@securityfocus.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
On 11 Jun 2005 20:15:09 -0000, oliver@codersquad.de
<oliver@codersquad.de> wrote:
> So only IP-Adresses are allowed and no kind of code injection is possible.
I'm unfamiliar with this particular program, so forgive me if I'm way
off base...however...give this a try:
function eping_validaddr($eping_hosttocheck)
{
return ip2long($eping_hosttocheck);
}
On a failure, it will return (int)-1 or (bool)FALSE depending on your
PHP version. Before doing the actual ping, you'll want to grab the
result of eping_validaddr() and run it through long2ip() as a final
step of validation. Example:
$exploit = long2ip(ip2long('127.0.0.1;commands%20here'));
It will populate $exploit with (string)"255.255.255.255" (just
ip2long() alone on that returns -1 in PHP4 or FALSE in PHP5).
Sam
