Free Link

Note: To fully understand the exploit you will need to fully understand how ssh keys are setup, so you will need to read this article.

I was looking at the scope for SSD Secure Disclosure and I noticed one of the targets is VestaCP, I decided to take a look at the source code to see if I would be able to find anything interesting.

I started by looking at the upload functionality as it’s often misused and usually have security issues, the source code for VestaCP can be found Here.

To install VestaCP follow the instructions at https://vestacp.com/install/ on an Ubuntu VM.

The upload functionality is implemented under /web/upload let's take a look at the index.php file to see how it's implemented.

<?php /* * jQuery File Upload Plugin PHP Example 5.14 * https://github.com/blueimp/jQuery-File-Upload * * Copyright 2010, Sebastian Tschan * https://blueimp.net * * Licensed under the MIT license: * http://www.opensource.org/licenses/MIT */ error_reporting(E_ALL | E_STRICT); require('UploadHandler.php'); $upload_handler = new UploadHandler();

As seen in the above code all what the code does is creating an instance of the UploadHandler class this probably means that the class constructor should handle the upload process, so let's take a look at the constructor of that class, the class is implemented in /web/upload/UploadHandler.php file, at the beginning of…