Sircon

These guys have a few beefy ass physical servers in their own rack in a supposedly EMP and fire safe room in the basement of their offices. Those physical machines run virtual machines that run WHM/cPanel and whatever PHP app the customer would like. But >90% of their customers are non-technical and just only interact with the default WordPress setup and maybe the e-mail service that comes with their cPanel. Most of the people calling in to their support line has problems using their e-mail, and it’s usually the end user who fucked up.

Servers

Have you ever used Apache httpd? Have you ever used its .htaccess config? Well it’s pretty cool, but may pose a threat on shared “web hotels” like WHM servers running a whole lot of cPanel accounts. If using .htaccess is allowed users may set their own configuration options for httpd.

And the issue I identified here was the fact that cgi configuration options where allowed in .htaccess. So I had some fun making wired cgi scripts in python, perl and bash.

The last thing I did before disclosing it to Sircon’s server guy was to make a proof of concept script that gave me a shell on the server. As they don’t allow ssh access and PHP is configured to not allow anything dangerous, like the system() function, that would allow you to create shells.

Example .htaccess to run cgi scripts.

1
2

Options +ExecCGI
AddHandler cgi-script .cgi .pl .py .sh .rb

The fix for this is the AllowOverride directive. Just make sure it does not include “FileInfo”.

WordPress

I found a bug on their homepage sircon.no where they have a simple WordPress shop with a couple of cool features, like this where you supposedly can check how green a web page is. As in green energy.

The bug I found was missing server side validation and a shopping cart that’s stored in the browsers local storage with price specified. This is a pretty minor issue however, as they don’t do automatic provisioning, and it only gets added to some internal webpage they use to keep track of everything. But whatever you posted as the price would show up in that tool. You could even post negative prices!