Result of debug
This is the result of debug (I juste replace the real ip by 99.99.99.99 for security reason : I have in this moment brute force attacks)
I am a little bit surprised as it checks file /usr/bin/passwd (not existing) and never goes to /etc/shadow where the password is.
In fact, I do not know exactly what directadmin should do.
My first thought was
-read shadow,
-replace password in user line
-write the file
where am I wrong ?
====================
Sockets::handshake - begin
Sockets::handshake - end
/CMD_USER_PASSWD
0: Accept-Encoding: gzip, deflate
1: Accept-Language: en-us,en;q=0.7,fr-fr;q=0.3
2: Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
3: Connection: keep-alive
4: Content-Length: 53
5: Content-Type: application/x-www-form-urlencoded
6: Cookie: wordpress_polylang=en; __utma=45944621.1495621769.1343316726.1343316726.1343316726.1; __utmz=45944621.1343316726.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=45944621; session=OH5pqF0C7eUoNjtkigmwH2tl30e2XcuwszlgCkqIOL6l2xTkdFevFYeGYIG5sAzi
7: Host: 99.99.99.99:2222
8: Referer:
https://99.99.99.99:2222/HTM_USER_PASSWD
9: User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:14.0) Gecko/20100101 Firefox/14.0.1
Post string: username=essaiml&passwd=Nfakepass1&passwd2=Nfakepass1
Checking referer
https://99.99.99.99:2222/HTM_USER_PASSWD to 99.99.99.99:2222
Referer check passed: 99.99.99.99=99.99.99.99 2222=2222
Command::doCommand(/CMD_USER_PASSWD)
executeAsUser('/usr/local/bin/php', 512, diradmin, 1, '<?php
/*
This script is to enforce a level of password difficulty that users must use.
You can change the minimum length if you wish, the default is 6.
The requirement for special characters is disabled by default.
To disable any function, simply add // in front of its call below.
To enable any disabled function, remove the // from in front of its call.
Do this at the FUNCTION CALL section of the script:
*/
$min_length = 6;
$pass = getenv("password");
$random_password_length = getenv("random_password_length");
if ($random_password_length < $min_length)
{
$min_length = $random_password_length;
}
//FUNCTION CALL section
check_length($pass);
enforce_mixed_case($pass);
enforce_numbers($pass);
//enforce_shift_chars($pass);
//FUNCTION CALL section, end
//passes the test
echo "Password OK\n";
exit(0);
function enforce_shift_chars($str)
{
if (!has_shift_chars($str))
{
echo "Password must have at least one special character such as !@#%$ etc..\n";
exit(3);
}
}
function enforce_numbers($str)
{
if (!has_numbers($str))
{
echo "Password must have numbers\n";
exit(2);
}
}
function enforce_mixed_case($str)
{
if (!has_caps($str) || !has_lower_case($str))
{
echo "Password must have both upper and lower case characters\n";
exit(2);
}
}
function check_length($str)
{
global $min_length;
if (strlen($str) < $min_length)
{
echo "Password is too short. Use at least $min_length characters\n";
exit(1);
}
}
function has_shift_chars($str)
{
//return ereg("[\~\!\@\#\$\%\^\&\*\(\)\-\=\_\+\{\}\:\;\|\<\>\,\.\?\/]+", $str);
return preg_match("/[\~\!\@\#\$\%\^\&\*\(\)\-\=\_\+\{\}\:\;\|\<\>\,\.\?\/]+/", $str);
}
function has_numbers($str)
{
//return ereg("[0-9]+", $str);
return preg_match("/[0-9]+/", $str);
}
function has_caps($str)
{
//return ereg("[A-Z]+", $str);
return preg_match("/[A-Z]+/", $str);
}
function has_lower_case($str)
{
//return ereg("[a-z]+", $str);
return preg_match("/[a-z]+/", $str);
}
exit(0);
?>
', int *child_pid, *snd, group=(null)) uid=497 gid=497
sh: /usr/bin/passwd: No such file or directory
Database::connect 0
Database::connect 0.5 - da_admin : 95IcnsXn
Database::connect 1
Database::connect 5
executeAsUser('/usr/local/bin/php', 512, diradmin, 1, '<?php
/*
This script is to enforce a level of password difficulty that users must use.
You can change the minimum length if you wish, the default is 6.
The requirement for special characters is disabled by default.
To disable any function, simply add // in front of its call below.
To enable any disabled function, remove the // from in front of its call.
Do this at the FUNCTION CALL section of the script:
*/
$min_length = 6;
$pass = getenv("password");
$random_password_length = getenv("random_password_length");
if ($random_password_length < $min_length)
{
$min_length = $random_password_length;
}
//FUNCTION CALL section
check_length($pass);
enforce_mixed_case($pass);
enforce_numbers($pass);
//enforce_shift_chars($pass);
//FUNCTION CALL section, end
//passes the test
echo "Password OK\n";
exit(0);
function enforce_shift_chars($str)
{
if (!has_shift_chars($str))
{
echo "Password must have at least one special character such as !@#%$ etc..\n";
exit(3);
}
}
function enforce_numbers($str)
{
if (!has_numbers($str))
{
echo "Password must have numbers\n";
exit(2);
}
}
function enforce_mixed_case($str)
{
if (!has_caps($str) || !has_lower_case($str))
{
echo "Password must have both upper and lower case characters\n";
exit(2);
}
}
function check_length($str)
{
global $min_length;
if (strlen($str) < $min_length)
{
echo "Password is too short. Use at least $min_length characters\n";
exit(1);
}
}
function has_shift_chars($str)
{
//return ereg("[\~\!\@\#\$\%\^\&\*\(\)\-\=\_\+\{\}\:\;\|\<\>\,\.\?\/]+", $str);
return preg_match("/[\~\!\@\#\$\%\^\&\*\(\)\-\=\_\+\{\}\:\;\|\<\>\,\.\?\/]+/", $str);
}
function has_numbers($str)
{
//return ereg("[0-9]+", $str);
return preg_match("/[0-9]+/", $str);
}
function has_caps($str)
{
//return ereg("[A-Z]+", $str);
return preg_match("/[A-Z]+/", $str);
}
function has_lower_case($str)
{
//return ereg("[a-z]+", $str);
return preg_match("/[a-z]+/", $str);
}
exit(0);
?>
', int *child_pid, *snd, group=(null)) uid=497 gid=497
Command::doCommand(/CMD_USER_PASSWD) : finished
Command::run: finished /CMD_USER_PASSWD
