Info IPTV Smarters Exploit: CVE-2020–9380

[darkvil]

Hello,

IPTV Smarters Exploit

be careful with this application this can affect your server (( destroy / steal ))... see the concept of theft:

To view the content, you need to Sign In or Register.

To view the content, you need to Sign In or Register.

 

[Cobrahosts]

Check the forum rules,
A member since November with 30 likes just needs to FOLLOW the forums rules and the like will appear.......... asking for them..... I sense a hammer coming

 

[AndersonPablo]

Hello,

IPTV Smarters Exploit

be careful with this application this can affect your server (( destroy / steal ))... see the concept of theft:

No quote

No quote

IPTV Smarters Exploit: CVE-2020–9380

IPTV SMARTERS:

medium.com

Vulnerable TV streaming app could give attackers full control over users’ devices

Check those permissions

portswigger.net

 

[evoactivity]

The absolute state of this code

session_start();
if (file_exists("functions.php")) {
    include_once "functions.php";
    if (isset($_FILES["logoImage"])) {
        $target_dir = "../images/";
        $target_file = $target_dir . basename($_FILES["logoImage"]["name"]);
        if (move_uploaded_file($_FILES["logoImage"]["tmp_name"], $target_file)) {
            echo "images/" . $_FILES["logoImage"]["name"];
            exit;
        }
        echo "errorImage";
        exit;
    }
...

This will have been 0dayed for a long time, the quality of development is so so bad with iptv. That will accept any file from anyone. Ridiculous.

 

[AndersonPablo]

The absolute state of this code

session_start();
if (file_exists("functions.php")) {
    include_once "functions.php";
    if (isset($_FILES["logoImage"])) {
        $target_dir = "../images/";
        $target_file = $target_dir . basename($_FILES["logoImage"]["name"]);
        if (move_uploaded_file($_FILES["logoImage"]["tmp_name"], $target_file)) {
            echo "images/" . $_FILES["logoImage"]["name"];
            exit;
        }
        echo "errorImage";
        exit;
    }
...

This will have been 0dayed for a long time, the quality of development is so so bad with iptv. That will accept any file from anyone. Ridiculous.

Certainly! my friend. Those responsible for the smarters contacted me and informed that it is one without many problems. They don't really know anything.

 

[evoactivity]

Certainly! my friend. Those responsible for the smarters contacted me and informed that it is one without many problems. They don't really know anything.

Ahh, the man himself. Nice job on the exploit, good to see it properly reported as CVE. Hopefully smarters will do something now it's getting picked up in the tech news.

 

[migueltarga]

Added a patch:

To view the content, you need to Sign In or Register.

 

[d3t]

Added a patch:
No quote

Yep, tried it and it works

 

[Mobilehacks]

Added a patch:
No quote

How can we be sure that this patch is safe to use?
As you joined the forum 6 months ago
and only have 1 post which is this patch

 

[migueltarga]

How can we be sure that this patch is safe to use?
As you joined the forum 6 months ago
and only have 1 post which is this patch

Hi Mobilehacks,

6 months of forum, but the creator of the CVE and the exploit.
10 years in google hall of fame for security:

To view the content, you need to Sign In or Register.

You don't have to trust me if you don't want to, the patch source is open.

But I think I'm the wrong person to have questions about, I would personally rather question the IPTV Smarters quality.

 

[Mobilehacks]

Hi Mobilehacks,

You don't have to trust me if you don't want to, the patch source is open.

But I think I'm the wrong person to have questions about, I would personally rather question the IPTV Smarters quality.

Nothing personal intended i was purely just asking a question

 

[JoAodeDeUs]

It is not new that IPTV Smarters does not expire confidence. At least for me ...
Now it has only been exposed in the media.

 

[AndersonPablo]

It is not new that IPTV Smarters does not expire confidence. At least for me ...
Now it has only been exposed in the media.

Roger that!
João br?

 

[FireTvGuru]

This would be a good solution instead of removing the snips, if not please correct if im wrong.

<?php
    //Vulnerability 1: Arbitrary File Upload
    
    if (isset($_FILES["logoImage"])) {
        //added to check file extentions
        $file_ext=pathinfo($_FILES['logoImage']['name']);
        $extensions= array("jpeg","jpg","png","JPEG","JPG","PNG");
        if(in_array($file_ext,$extensions)=== false){echo 'Not a valid file ext.';die("Error")}
        //end of check
        $target_dir = "../images/";
        $target_file = $target_dir . basename($_FILES["logoImage"]["name"]);
        if (move_uploaded_file($_FILES["logoImage"]["tmp_name"], $target_file)) {
            echo "images/" . $_FILES["logoImage"]["name"];
            exit;
        }
        echo "errorImage";
        exit;
    }

    //Vulnerability 2: Code Injection
    
    if (isset($_POST["action"]) && $_POST["action"] == "installation") {
        //check to see if form data came from same REFERER
        if ((isset($_SERVER['HTTP_REFERER']) && !empty($_SERVER['HTTP_REFERER']))) {
            if (strtolower(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)) != strtolower($_SERVER['HTTP_HOST'])) {
            die("Error")
            }
        }
        //end check
        $response["result"] = "no";
        $content = "<?php \n";
        $content .= "\$XCStreamHostUrl = \"" . $_POST["HostUrlVal"] . "\";" . "\n";
        $content .= "\$XClogoLinkval = \"" . $_POST["logoLinkval"] . "\";" . "\n";
        $content .= "\$XCcopyrighttextval = \"" . $_POST["copyrighttextval"] . "\";" . "\n";
        $content .= "\$XCcontactUslinkval = \"" . $_POST["contactUslinkval"] . "\";" . "\n";
        $content .= "\$XChelpLinkval = \"" . $_POST["helpLinkval"] . "\";" . "\n";
        $content .= "\$XClicenseIsval = \"" . $_POST["licenseIsval"] . "\";" . "\n";
        $content .= "\$XClocalKey = \"" . $_POST["LocalKey"] . "\";" . "\n";
        $content .= "\$XCsitetitleval = \"" . $_POST["sitetitleval"] . "\";" . "\n";
        $content .= "?>";
        if (file_exists("../configuration.php")) {
            unlink("../configuration.php");
        }
        $fp = fopen("../configuration.php", "w");
        fwrite($fp, $content);
        fclose($fp);
        chmod("../configuration.php", 511);
        if (file_exists("../configuration.php")) {
            $response["result"] = "yes";
        }
        echo json_encode($response);
        exit;
    }
?>

 

[migueltarga]

This would be a good solution instead of removing the snips, if not please correct if im wrong.

<?php
    //Vulnerability 1: Arbitrary File Upload
   
    if (isset($_FILES["logoImage"])) {
        //added to check file extentions
        $file_ext=pathinfo($_FILES['logoImage']['name']);
        $extensions= array("jpeg","jpg","png","JPEG","JPG","PNG");
        if(in_array($file_ext,$extensions)=== false){echo 'Not a valid file ext.';die("Error")}
        //end of check
        $target_dir = "../images/";
        $target_file = $target_dir . basename($_FILES["logoImage"]["name"]);
        if (move_uploaded_file($_FILES["logoImage"]["tmp_name"], $target_file)) {
            echo "images/" . $_FILES["logoImage"]["name"];
            exit;
        }
        echo "errorImage";
        exit;
    }

    //Vulnerability 2: Code Injection
   
    if (isset($_POST["action"]) && $_POST["action"] == "installation") {
        //check to see if form data came from same REFERER
        if ((isset($_SERVER['HTTP_REFERER']) && !empty($_SERVER['HTTP_REFERER']))) {
            if (strtolower(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)) != strtolower($_SERVER['HTTP_HOST'])) {
            die("Error")
            }
        }
        //end check
        $response["result"] = "no";
        $content = "<?php \n";
        $content .= "\$XCStreamHostUrl = \"" . $_POST["HostUrlVal"] . "\";" . "\n";
        $content .= "\$XClogoLinkval = \"" . $_POST["logoLinkval"] . "\";" . "\n";
        $content .= "\$XCcopyrighttextval = \"" . $_POST["copyrighttextval"] . "\";" . "\n";
        $content .= "\$XCcontactUslinkval = \"" . $_POST["contactUslinkval"] . "\";" . "\n";
        $content .= "\$XChelpLinkval = \"" . $_POST["helpLinkval"] . "\";" . "\n";
        $content .= "\$XClicenseIsval = \"" . $_POST["licenseIsval"] . "\";" . "\n";
        $content .= "\$XClocalKey = \"" . $_POST["LocalKey"] . "\";" . "\n";
        $content .= "\$XCsitetitleval = \"" . $_POST["sitetitleval"] . "\";" . "\n";
        $content .= "?>";
        if (file_exists("../configuration.php")) {
            unlink("../configuration.php");
        }
        $fp = fopen("../configuration.php", "w");
        fwrite($fp, $content);
        fclose($fp);
        chmod("../configuration.php", 511);
        if (file_exists("../configuration.php")) {
            $response["result"] = "yes";
        }
        echo json_encode($response);
        exit;
    }
?>

FireTvGuru The file Upload code is good, that's a perfect solution.

But the second one, it will be easy to be exploited, because anyone can spoof the Referer. The best solution would be having an installation script that gets removed after executed.

 

[gambitz]

Added a patch:
No quote

Thank you for your work.